Files
landing-api/tests/Feature/Api/TechnologyApiTest.php
Josep Piguillem ac546eba2b
Some checks failed
Tests / lint (push) Has been cancelled
Tests / test (push) Has been cancelled
Tests / test-postgres (push) Has been cancelled
Tests / mcp (push) Has been cancelled
Manage technologies through the API, with SVG logos
/api/v1/technologies is a full CRUD with the panel's own rules: name and
slug are plain strings, the prose is translatable, `radar_ring: null`
takes one off the radar, and TechnologyPolicy still refuses to delete
one a project, member or call uses. The MCP server picks the tools up
from openapi.yaml on its own.

A logo is an SVG, so POST /v1/media now accepts one — sanitized with
enshrined/svg-sanitize (scripts, event handlers and remote references
removed), and served by Caddy under a Content-Security-Policy that
would stop a script regardless. `for` (pages or technologies) says what
an upload is for, which picks the directory the panel uses for it and
the permission it takes.

Creating a technology without a category answered 500: the column's
default never reached the model, so the response read a null enum. The
controller now states the default, as the panel does.

Beside a file, the MCP upload tool no longer demands the JSON body's
`url`: the body then carries the upload's other fields, such as `for`.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-09-28 19:49:00 +02:00

166 lines
5.3 KiB
PHP

<?php
declare(strict_types=1);
namespace Tests\Feature\Api;
use App\Enums\RadarRing;
use App\Models\Project;
use App\Models\Technology;
use App\Models\User;
use Database\Seeders\RolePermissionSeeder;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Illuminate\Http\UploadedFile;
use Illuminate\Support\Facades\Storage;
use PHPUnit\Framework\Attributes\Test;
use Tests\FakesPireon;
use Tests\TestCase;
class TechnologyApiTest extends TestCase
{
use FakesPireon, RefreshDatabase;
protected function setUp(): void
{
parent::setUp();
$this->seed(RolePermissionSeeder::class);
}
protected function actingWithRole(string $role): void
{
$user = User::factory()->create();
$user->syncRoles([$role]);
$this->withHeaders($this->apiHeadersFor($user));
}
#[Test]
public function it_creates_a_technology_with_its_prose_in_several_languages(): void
{
$this->actingWithRole('editor');
$this->postJson('/api/v1/technologies?lang=es&with=translations', [
'name' => 'Kotlin Multiplatform',
'slug' => 'kotlin-multiplatform',
'category' => 'framework',
'radar_ring' => 'trial',
'color' => '#7F52FF',
'website' => 'https://kotlinlang.org/docs/multiplatform.html',
'description' => ['es' => 'Código Kotlin compartido.', 'en' => 'Shared Kotlin code.'],
])
->assertCreated()
->assertJsonPath('data.name', 'Kotlin Multiplatform')
->assertJsonPath('data.radar_ring', 'trial')
->assertJsonPath('data.description', 'Código Kotlin compartido.')
->assertJsonPath('data.translations.description.en', 'Shared Kotlin code.');
$this->assertSame(RadarRing::Trial, Technology::query()->sole()->radar_ring);
}
#[Test]
public function the_logo_is_a_path_from_the_upload_endpoint(): void
{
Storage::fake((string) config('media.disk'));
$this->actingWithRole('editor');
$path = $this->post('/api/v1/media', [
'file' => UploadedFile::fake()->createWithContent(
'angular.svg',
'<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 10 10"><rect width="10" height="10"/></svg>',
),
'for' => 'technologies',
], ['Accept' => 'application/json'])->json('data.path');
$this->postJson('/api/v1/technologies', [
'name' => 'Angular',
'slug' => 'angular',
'logo' => $path,
])
->assertCreated()
->assertJsonPath('data.logo', $path)
->assertJsonPath('data.logo_media.url', fn (string $url) => str_ends_with($url, $path))
->assertJsonPath('data.logo_media.alt', 'Angular');
}
#[Test]
public function a_partial_update_leaves_the_rest_alone(): void
{
$this->actingWithRole('editor');
$technology = Technology::factory()->create([
'name' => 'Laravel',
'radar_ring' => RadarRing::Assess,
'description' => ['es' => 'Framework PHP.', 'en' => 'PHP framework.'],
]);
$this->patchJson("/api/v1/technologies/{$technology->id}", [
'radar_ring' => 'adopt',
'description' => ['ca' => 'Framework PHP.'],
])
->assertOk()
->assertJsonPath('data.name', 'Laravel')
->assertJsonPath('data.radar_ring', 'adopt');
$this->assertSame('PHP framework.', $technology->fresh()->getTranslation('description', 'en'));
}
#[Test]
public function a_ring_can_be_cleared_to_take_it_off_the_radar(): void
{
$this->actingWithRole('editor');
$technology = Technology::factory()->create(['radar_ring' => RadarRing::Hold]);
$this->patchJson("/api/v1/technologies/{$technology->id}", ['radar_ring' => null])
->assertOk()
->assertJsonPath('data.radar_ring', null);
$this->getJson('/api/v1/technologies?radar_ring=none')
->assertOk()
->assertJsonCount(1, 'data');
}
#[Test]
public function slugs_are_unique_and_url_safe(): void
{
$this->actingWithRole('editor');
Technology::factory()->create(['slug' => 'react']);
$this->postJson('/api/v1/technologies', ['name' => 'React', 'slug' => 'react'])
->assertUnprocessable()
->assertJsonValidationErrors('slug');
$this->postJson('/api/v1/technologies', ['name' => 'Spring Boot', 'slug' => 'spring boot'])
->assertUnprocessable()
->assertJsonValidationErrors('slug');
}
#[Test]
public function one_still_in_use_cannot_be_deleted(): void
{
$this->actingWithRole('editor');
$technology = Technology::factory()->create();
Project::factory()->create()->technologies()->attach($technology);
$this->deleteJson("/api/v1/technologies/{$technology->id}")->assertForbidden();
$this->assertModelExists($technology);
}
#[Test]
public function a_reader_can_list_but_not_write(): void
{
$this->actingWithRole('viewer');
Technology::factory()->create();
$this->getJson('/api/v1/technologies')->assertOk()->assertJsonCount(1, 'data');
$this->postJson('/api/v1/technologies', ['name' => 'Flutter', 'slug' => 'flutter'])
->assertForbidden();
}
}