nexarch/workflow/internal/approvalapi/handler_test.go

package approvalapi

import (
	"context"
	"encoding/json"
	"net/http"
	"net/http/httptest"
	"os"
	"path/filepath"
	"strings"
	"testing"

	"gitea.perlbach24.de/scripte/nexarch/common/testdb"
	"gitea.perlbach24.de/scripte/nexarch/workflow/internal/approval"
	"gitea.perlbach24.de/scripte/nexarch/workflow/internal/migrate"
)

func findModuleRoot(t *testing.T) string {
	t.Helper()
	dir, err := os.Getwd()
	if err != nil {
		t.Fatalf("getwd: %v", err)
	}
	for {
		if _, err := os.Stat(filepath.Join(dir, "go.mod")); err == nil {
			return dir
		}
		parent := filepath.Dir(dir)
		if parent == dir {
			t.Fatal("go.mod nicht gefunden")
		}
		dir = parent
	}
}

func newTestServer(t *testing.T) (*Server, *approval.Service) {
	t.Helper()
	dsn := os.Getenv("TEST_TENANT_DSN")
	if dsn == "" {
		t.Skip("TEST_TENANT_DSN nicht gesetzt, Integrationstest uebersprungen")
	}
	ctx := context.Background()
	pool := testdb.Pool(t, dsn)
	migrations, err := migrate.Load(filepath.Join(findModuleRoot(t), "migrations", "tenant"))
	if err != nil {
		t.Fatalf("migrationen laden: %v", err)
	}
	if _, err := migrate.Up(ctx, pool, migrations); err != nil {
		t.Fatalf("migrationen anwenden: %v", err)
	}
	eng, err := approval.NewEngineWithApproval(pool)
	if err != nil {
		t.Fatalf("engine anlegen: %v", err)
	}
	svc := approval.NewService(pool, eng)
	return NewServer(svc), svc
}

func TestHandleList_RequiresUser(t *testing.T) {
	s, _ := newTestServer(t)
	mux := http.NewServeMux()
	s.RegisterRoutes(mux)

	req := httptest.NewRequest(http.MethodGet, "/approvals", nil)
	rec := httptest.NewRecorder()
	mux.ServeHTTP(rec, req)
	if rec.Code != http.StatusUnauthorized {
		t.Fatalf("status = %d, want 401 ohne X-User-Id", rec.Code)
	}
}

func TestHandleList_ReturnsOwnOpenTasks(t *testing.T) {
	s, svc := newTestServer(t)
	mux := http.NewServeMux()
	s.RegisterRoutes(mux)
	ctx := context.Background()

	if _, err := svc.Create(ctx, "alice", "dms:document:1", "carol"); err != nil {
		t.Fatalf("create: %v", err)
	}

	req := httptest.NewRequest(http.MethodGet, "/approvals", nil)
	req.Header.Set("X-User-Id", "alice")
	rec := httptest.NewRecorder()
	mux.ServeHTTP(rec, req)
	if rec.Code != http.StatusOK {
		t.Fatalf("status = %d, want 200", rec.Code)
	}
	var tasks []approval.Task
	if err := json.NewDecoder(rec.Body).Decode(&tasks); err != nil {
		t.Fatalf("decode: %v", err)
	}
	if len(tasks) != 1 || tasks[0].Assignee != "alice" {
		t.Fatalf("tasks = %+v, want genau 1 fuer alice", tasks)
	}
}

func TestHandleDecide_ConflictOnDoubleDecision(t *testing.T) {
	s, svc := newTestServer(t)
	mux := http.NewServeMux()
	s.RegisterRoutes(mux)
	ctx := context.Background()

	task, err := svc.Create(ctx, "alice", "dms:document:1", "carol")
	if err != nil {
		t.Fatalf("create: %v", err)
	}

	body := `{"decision":"approved","reason":"ok"}`
	req := httptest.NewRequest(http.MethodPost, "/approvals/"+task.ID+"/decide", strings.NewReader(body))
	req.Header.Set("X-User-Id", "alice")
	rec := httptest.NewRecorder()
	mux.ServeHTTP(rec, req)
	if rec.Code != http.StatusOK {
		t.Fatalf("erste entscheidung: status = %d, body = %s", rec.Code, rec.Body.String())
	}

	req2 := httptest.NewRequest(http.MethodPost, "/approvals/"+task.ID+"/decide", strings.NewReader(body))
	req2.Header.Set("X-User-Id", "alice")
	rec2 := httptest.NewRecorder()
	mux.ServeHTTP(rec2, req2)
	if rec2.Code != http.StatusConflict {
		t.Fatalf("zweite entscheidung: status = %d, want 409", rec2.Code)
	}
}

func TestHandleDecide_ForbiddenForWrongUser(t *testing.T) {
	s, svc := newTestServer(t)
	mux := http.NewServeMux()
	s.RegisterRoutes(mux)
	ctx := context.Background()

	task, err := svc.Create(ctx, "alice", "dms:document:1", "carol")
	if err != nil {
		t.Fatalf("create: %v", err)
	}

	body := `{"decision":"approved","reason":"unbefugt"}`
	req := httptest.NewRequest(http.MethodPost, "/approvals/"+task.ID+"/decide", strings.NewReader(body))
	req.Header.Set("X-User-Id", "mallory")
	rec := httptest.NewRecorder()
	mux.ServeHTTP(rec, req)
	if rec.Code != http.StatusForbidden {
		t.Fatalf("status = %d, want 403", rec.Code)
	}
}