Add stage 3: todo list and item CRUD API

Two migrations add todo_lists (owner_id FK to users, title, description) and todo_items (list_id FK, text, complete, position), both with ON DELETE CASCADE. New endpoints under /api/lists, all behind AuthMiddleware: - lists: index / store / show / update (PATCH) / destroy - items: nested under a list, same five verbs Lists are owner-scoped — another user's or a missing list responds 404, never 403. New items append after the highest position unless one is given; the list carries item_count / completed_count. Item PATCH is partial and never renumbers siblings. Adds App\Support\Validator for request-body checks, TodoList/TodoItem repositories, and body()/user() helpers on the Controller base. Feature tests move their shared harness into tests/ApiTestCase; TodoTest covers CRUD, ownership isolation, ordering, completion counts, validation and cascade delete. Full suite: 15 passing. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-03 18:30:52 +01:00
parent 5e3b8dbd7e
commit 5a0d29a308
12 changed files with 1093 additions and 4 deletions
@@ -0,0 +1,88 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests;
+
+use PDO;
+use PHPUnit\Framework\TestCase;
+use Psr\Http\Message\ResponseInterface;
+use Slim\App;
+use Slim\Psr7\Factory\ServerRequestFactory;
+
+/**
+ * Boots the real Slim app against a throwaway SQLite database with all
+ * migrations applied.
+ */
+abstract class ApiTestCase extends TestCase
+{
+    protected App $app;
+    private string $databasePath;
+
+    protected function setUp(): void
+    {
+        $this->databasePath = sys_get_temp_dir() . '/todo-test-' . uniqid() . '.sqlite';
+        putenv('DATABASE_PATH=' . $this->databasePath);
+        $_ENV['DATABASE_PATH'] = $this->databasePath;
+
+        $pdo = new PDO('sqlite:' . $this->databasePath);
+        $pdo->exec('PRAGMA foreign_keys = ON');
+        foreach (glob(dirname(__DIR__) . '/migrations/*.sql') ?: [] as $migration) {
+            $pdo->exec((string) file_get_contents($migration));
+        }
+
+        $this->app = require dirname(__DIR__) . '/src/bootstrap.php';
+    }
+
+    protected function tearDown(): void
+    {
+        @unlink($this->databasePath);
+        putenv('DATABASE_PATH');
+        unset($_ENV['DATABASE_PATH']);
+    }
+
+    /**
+     * @param array<string, mixed>|null $body
+     * @param array<string, string> $headers
+     */
+    protected function request(
+        string $method,
+        string $path,
+        ?array $body = null,
+        array $headers = [],
+    ): ResponseInterface {
+        $request = (new ServerRequestFactory())->createServerRequest($method, $path);
+
+        foreach ($headers as $name => $value) {
+            $request = $request->withHeader($name, $value);
+        }
+
+        if ($body !== null) {
+            $request = $request->withParsedBody($body)->withHeader('Content-Type', 'application/json');
+        }
+
+        return $this->app->handle($request);
+    }
+
+    /**
+     * Register a fresh user and return an `Authorization` header for them.
+     *
+     * @return array<string, string>
+     */
+    protected function authHeader(string $email = 'user@example.com'): array
+    {
+        $token = $this->decode(
+            $this->request('POST', '/api/auth/register', ['email' => $email, 'password' => 'password123']),
+        )['token'];
+
+        return ['Authorization' => 'Bearer ' . $token];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    protected function decode(ResponseInterface $response): array
+    {
+        return (array) json_decode((string) $response->getBody(), true, 512, JSON_THROW_ON_ERROR);
+    }
+}