ProjectTest.php

<?php

declare(strict_types=1);

namespace Tests\Feature\Api\V1;

use App\Enums\ProjectStatus;
use App\Models\Project;
use App\Models\Task;
use App\Models\User;
use Illuminate\Foundation\Testing\RefreshDatabase;
use PHPUnit\Framework\Attributes\Test;
use Tests\TestCase;

class ProjectTest extends TestCase
{
    use RefreshDatabase;

    private User $user;

    protected function setUp(): void
    {
        parent::setUp();

        $this->user = User::factory()->create();
    }

    #[Test]
    public function it_requires_authentication(): void
    {
        $this->getJson(route('api.v1.projects.index'))->assertUnauthorized();
    }

    #[Test]
    public function it_lists_only_the_projects_of_the_authenticated_user(): void
    {
        Project::factory(3)->for($this->user)->create();
        Project::factory(2)->create();

        $this->actingAs($this->user, 'sanctum')
            ->getJson(route('api.v1.projects.index'))
            ->assertOk()
            ->assertJsonCount(3, 'data')
            ->assertJsonPath('meta.total', 3);
    }

    #[Test]
    public function it_paginates_and_reports_the_page_meta(): void
    {
        Project::factory(7)->for($this->user)->create();

        $this->actingAs($this->user, 'sanctum')
            ->getJson(route('api.v1.projects.index', ['per_page' => 3]))
            ->assertOk()
            ->assertJsonCount(3, 'data')
            ->assertJsonPath('meta.per_page', 3)
            ->assertJsonPath('meta.total', 7)
            ->assertJsonPath('meta.last_page', 3);
    }

    #[Test]
    public function it_filters_projects_by_status(): void
    {
        Project::factory(2)->active()->for($this->user)->create();
        Project::factory(3)->archived()->for($this->user)->create();

        $this->actingAs($this->user, 'sanctum')
            ->getJson(route('api.v1.projects.index', ['status' => ProjectStatus::Archived->value]))
            ->assertOk()
            ->assertJsonCount(3, 'data')
            ->assertJsonPath('data.0.status', ProjectStatus::Archived->value);
    }

    #[Test]
    public function it_rejects_an_unknown_status_filter(): void
    {
        $this->actingAs($this->user, 'sanctum')
            ->getJson(route('api.v1.projects.index', ['status' => 'flying']))
            ->assertUnprocessable()
            ->assertJsonValidationErrors('status');
    }

    #[Test]
    public function it_creates_a_project_owned_by_the_authenticated_user(): void
    {
        $this->actingAs($this->user, 'sanctum')
            ->postJson(route('api.v1.projects.store'), [
                'name' => 'Assessment API',
                'description' => 'Task management system',
            ])
            ->assertCreated()
            ->assertJsonPath('data.name', 'Assessment API')
            ->assertJsonPath('data.status', ProjectStatus::Active->value)
            ->assertJsonPath('data.tasks_count', 0);

        $this->assertDatabaseHas('projects', [
            'name' => 'Assessment API',
            'user_id' => $this->user->id,
        ]);
    }

    #[Test]
    public function it_ignores_a_user_id_sent_by_the_client(): void
    {
        $victim = User::factory()->create();

        $this->actingAs($this->user, 'sanctum')
            ->postJson(route('api.v1.projects.store'), [
                'name' => 'Hijack attempt',
                'user_id' => $victim->id,
            ])
            ->assertCreated();

        $this->assertDatabaseHas('projects', [
            'name' => 'Hijack attempt',
            'user_id' => $this->user->id,
        ]);
    }

    #[Test]
    public function it_validates_the_payload(): void
    {
        $this->actingAs($this->user, 'sanctum')
            ->postJson(route('api.v1.projects.store'), ['description' => 'no name'])
            ->assertUnprocessable()
            ->assertJsonValidationErrors('name');
    }

    #[Test]
    public function it_shows_a_project_with_its_task_count(): void
    {
        $project = Project::factory()->for($this->user)->create();
        Task::factory(4)->for($project)->create();

        $this->actingAs($this->user, 'sanctum')
            ->getJson(route('api.v1.projects.show', $project))
            ->assertOk()
            ->assertJsonPath('data.id', $project->id)
            ->assertJsonPath('data.tasks_count', 4);
    }

    #[Test]
    public function it_updates_only_the_provided_fields(): void
    {
        $project = Project::factory()->active()->for($this->user)->create(['name' => 'Original']);

        $this->actingAs($this->user, 'sanctum')
            ->patchJson(route('api.v1.projects.update', $project), [
                'status' => ProjectStatus::Completed->value,
            ])
            ->assertOk()
            ->assertJsonPath('data.name', 'Original')
            ->assertJsonPath('data.status', ProjectStatus::Completed->value);
    }

    #[Test]
    public function it_soft_deletes_a_project_together_with_its_tasks(): void
    {
        $project = Project::factory()->for($this->user)->create();
        $task = Task::factory()->for($project)->create();

        $this->actingAs($this->user, 'sanctum')
            ->deleteJson(route('api.v1.projects.destroy', $project))
            ->assertOk()
            ->assertJsonPath('message', 'Project deleted successfully.');

        $this->assertSoftDeleted($project);
        $this->assertSoftDeleted($task);
    }

    #[Test]
    public function it_hides_a_deleted_project_from_later_requests(): void
    {
        $project = Project::factory()->for($this->user)->create();
        $project->delete();

        $this->actingAs($this->user, 'sanctum')
            ->getJson(route('api.v1.projects.show', $project))
            ->assertNotFound()
            ->assertJsonPath('message', 'Resource not found.');
    }

    #[Test]
    public function it_forbids_touching_a_project_of_another_user(): void
    {
        $project = Project::factory()->create();

        $this->actingAs($this->user, 'sanctum')
            ->getJson(route('api.v1.projects.show', $project))
            ->assertForbidden();

        $this->actingAs($this->user, 'sanctum')
            ->patchJson(route('api.v1.projects.update', $project), ['name' => 'Taken over'])
            ->assertForbidden();

        $this->actingAs($this->user, 'sanctum')
            ->deleteJson(route('api.v1.projects.destroy', $project))
            ->assertForbidden();

        $this->assertNotSoftDeleted($project);
    }
}