project-manager/tests/CardStatusTest.php

<?php

declare(strict_types=1);

namespace Tests;

use PDOException;

final class CardStatusTest extends ApiTestCase
{
    /** Create a project and return its id. */
    private function newProject(array $auth, string $title = 'Board'): int
    {
        return $this->decode(
            $this->request('POST', '/api/projects', ['title' => $title], $auth),
        )['project']['id'];
    }

    /** @param array<string, string> $auth @return array<int, mixed> */
    private function statuses(int $projectId, array $auth): array
    {
        return $this->decode(
            $this->request('GET', "/api/projects/{$projectId}/statuses", null, $auth),
        )['statuses'];
    }

    public function test_statuses_require_authentication(): void
    {
        $projectId = $this->newProject($this->authHeader());

        self::assertSame(401, $this->request('GET', "/api/projects/{$projectId}/statuses")->getStatusCode());
    }

    public function test_new_projects_are_seeded_with_the_default_statuses(): void
    {
        $auth = $this->authHeader();
        $projectId = $this->newProject($auth);

        $statuses = $this->statuses($projectId, $auth);

        self::assertSame(['To do', 'Doing', 'Done'], array_column($statuses, 'name'));
        self::assertSame([0, 1, 2], array_column($statuses, 'position'));
        self::assertSame([$projectId, $projectId, $projectId], array_column($statuses, 'project_id'));
    }

    public function test_each_project_gets_its_own_status_rows(): void
    {
        $auth = $this->authHeader();
        $first = $this->newProject($auth, 'One');
        $second = $this->newProject($auth, 'Two');

        $firstIds = array_column($this->statuses($first, $auth), 'id');
        $secondIds = array_column($this->statuses($second, $auth), 'id');

        self::assertSame([], array_intersect($firstIds, $secondIds));
    }

    public function test_statuses_are_only_visible_to_the_project_owner(): void
    {
        $owner = $this->authHeader('owner@example.com');
        $other = $this->authHeader('other@example.com');
        $projectId = $this->newProject($owner, 'Private');

        self::assertSame(200, $this->request('GET', "/api/projects/{$projectId}/statuses", null, $owner)->getStatusCode());
        self::assertSame(404, $this->request('GET', "/api/projects/{$projectId}/statuses", null, $other)->getStatusCode());
    }

    public function test_a_card_created_directly_in_a_project_starts_in_its_first_status(): void
    {
        $auth = $this->authHeader();
        $projectId = $this->newProject($auth);
        $firstStatus = $this->statuses($projectId, $auth)[0];

        $card = $this->decode(
            $this->request('POST', "/api/projects/{$projectId}/cards", ['text' => 'First'], $auth),
        )['card'];

        self::assertSame($firstStatus['id'], $card['status_id']);
        self::assertSame('To do', $card['status']['name']);
        self::assertSame($projectId, $card['project_id']);
    }

    public function test_a_referenced_status_cannot_be_deleted(): void
    {
        // There's no delete-status endpoint; this exercises the FK directly.
        // A card with a project must have a status (the CHECK constraint), so
        // the FK is ON DELETE RESTRICT rather than SET NULL.
        $auth = $this->authHeader();
        $projectId = $this->newProject($auth);
        $statusId = $this->statuses($projectId, $auth)[0]['id'];
        $this->request('POST', "/api/projects/{$projectId}/cards", ['text' => 'x'], $auth);

        $this->db()->exec('PRAGMA foreign_keys = ON');
        $this->expectException(PDOException::class);
        $this->db()->prepare('DELETE FROM card_statuses WHERE id = ?')->execute([$statusId]);
    }

    public function test_deleting_a_project_cascades_to_its_statuses(): void
    {
        $auth = $this->authHeader();
        $projectId = $this->newProject($auth, 'Temp');

        $count = fn (): int => (int) $this->db()
            ->query("SELECT COUNT(*) FROM card_statuses WHERE project_id = {$projectId}")
            ->fetchColumn();

        self::assertSame(3, $count());

        $this->request('DELETE', "/api/projects/{$projectId}", null, $auth);

        self::assertSame(0, $count());
    }
}