api/services/nginx/app/tests/Api/DepartmentsApiTest.php

<?php

declare(strict_types=1);

usesApiSuite();

it('lists only visible departments and can return a single department with the slack webhook', function (): void {
    api_test_covers('GET /departments', 'happy');

    $session = api_fixtures()->createUserSession([
        'list_departments',
        'view_slack_webhook',
    ]);

    $visibleDepartment = api_fixtures()->createDepartment([
        'name' => 'Visible Department',
        'visible' => 1,
    ]);
    $hiddenDepartment = api_fixtures()->createDepartment([
        'name' => 'Hidden Department',
        'visible' => 0,
    ]);
    $webhookDepartment = api_fixtures()->createDepartment([
        'name' => 'Webhook Department',
        'slack_webhook' => 'https://hooks.slack.test/example',
        'visible' => 1,
    ]);

    $listResponse = api_client()->get('/departments', $session['headers']);

    $listResponse
        ->assertStatus(200)
        ->assertEnvelope()
        ->assertSuccess();

    $departmentIds = array_map(
        static fn(array $department): int => (int)($department['id'] ?? 0),
        is_array($listResponse->data()) ? $listResponse->data() : []
    );

    expect($departmentIds)
        ->toContain($visibleDepartment['id'])
        ->toContain($webhookDepartment['id'])
        ->not->toContain($hiddenDepartment['id']);

    $singleResponse = api_client()->get('/departments?id=' . $webhookDepartment['id'], $session['headers']);

    $singleResponse
        ->assertStatus(200)
        ->assertEnvelope()
        ->assertSuccess();

    expect($singleResponse->data())
        ->toBeArray()
        ->toHaveKey('id', $webhookDepartment['id'])
        ->toHaveKey('slack_webhook', 'https://hooks.slack.test/example');
});

it('rejects department listing when the permission is missing', function (): void {
    api_test_covers('GET /departments', 'auth');

    $session = api_fixtures()->createUserSession([]);

    $response = api_client()->get('/departments', $session['headers']);

    $response
        ->assertStatus(403)
        ->assertEnvelope()
        ->assertSuccess(false)
        ->assertMissingPermissions(['list_departments']);
});

it('creates departments through the real endpoint', function (): void {
    api_test_covers('POST /departments', 'happy');

    $session = api_fixtures()->createUserSession(['add_department']);
    $name = 'Created Department ' . uniqid('', false);

    $response = api_client()->post('/departments', [
        'name' => $name,
        'description' => 'Created by API test',
    ], $session['headers']);

    $response
        ->assertStatus(200)
        ->assertEnvelope()
        ->assertSuccess()
        ->assertMessage('Department added successfully');

    $createdRow = api_test_runtime()->queryOne(
        "SELECT * FROM departments WHERE name = '" . api_test_runtime()->db()->real_escape_string($name) . "' ORDER BY id DESC LIMIT 1"
    );

    expect($createdRow)->not->toBeNull();
    api_fixtures()->cleanupDeleteById('departments', (int)$createdRow['id']);
});

it('rejects invalid department create requests', function (): void {
    api_test_covers('POST /departments', 'failure');

    $authorizedSession = api_fixtures()->createUserSession(['add_department']);
    $missingDescription = api_client()->post('/departments', [
        'name' => 'Broken Department',
    ], $authorizedSession['headers']);

    $missingDescription
        ->assertStatus(400)
        ->assertEnvelope()
        ->assertSuccess(false)
        ->assertMessage('Description is required');

    $unauthorizedSession = api_fixtures()->createUserSession([]);
    $missingPermission = api_client()->post('/departments', [
        'name' => 'No Permission Department',
        'description' => 'Should fail',
    ], $unauthorizedSession['headers']);

    $missingPermission
        ->assertStatus(403)
        ->assertEnvelope()
        ->assertSuccess(false)
        ->assertMissingPermissions(['add_department']);
});

it('updates departments through the real endpoint', function (): void {
    api_test_covers('PUT /departments', 'happy');

    $session = api_fixtures()->createUserSession(['edit_department']);
    $department = api_fixtures()->createDepartment([
        'name' => 'Original Department',
        'description' => 'Original description',
        'order_priority' => 1,
    ]);

    $response = api_client()->put('/departments', [
        'id' => $department['id'],
        'name' => 'Updated Department',
        'description' => 'Updated description',
        'order_priority' => 5,
    ], $session['headers']);

    $response
        ->assertStatus(200)
        ->assertEnvelope()
        ->assertSuccess()
        ->assertMessage('Department updated successfully');

    $row = api_fixtures()->fetchRowById('departments', (int)$department['id']);

    expect($row)->not->toBeNull();
    expect($row['name'] ?? null)->toBe('Updated Department');
    expect($row['description'] ?? null)->toBe('Updated description');
    expect((int)($row['order_priority'] ?? 0))->toBe(5);
});

it('rejects invalid department update requests', function (): void {
    api_test_covers('PUT /departments', 'failure');

    $authorizedSession = api_fixtures()->createUserSession(['edit_department']);
    $missingId = api_client()->put('/departments', [
        'name' => 'Missing ID',
    ], $authorizedSession['headers']);

    $missingId
        ->assertStatus(400)
        ->assertEnvelope()
        ->assertSuccess(false)
        ->assertMessage('Missing required parameters: id');

    $unauthorizedSession = api_fixtures()->createUserSession([]);
    $missingPermission = api_client()->put('/departments', [
        'id' => 123,
        'name' => 'No Permission',
    ], $unauthorizedSession['headers']);

    $missingPermission
        ->assertStatus(403)
        ->assertEnvelope()
        ->assertSuccess(false)
        ->assertMissingPermissions(['edit_department']);
});

it('lists department categories for a department', function (): void {
    api_test_covers('GET /departments/categories', 'happy');

    $session = api_fixtures()->createUserSession(['list_department_categories']);
    $department = api_fixtures()->createDepartment();
    $category = api_fixtures()->createCategory([
        'name' => 'Department Category',
    ]);
    api_fixtures()->linkDepartmentCategory((int)$department['id'], (int)$category['id']);

    $response = api_client()->get('/departments/categories?id=' . $department['id'], $session['headers']);

    $response
        ->assertStatus(200)
        ->assertEnvelope()
        ->assertSuccess();

    expect($response->data())
        ->toBeArray()
        ->toHaveCount(1)
        ->and($response->data()[0]['department_id'] ?? null)->toBe($department['id'])
        ->and($response->data()[0]['category']['id'] ?? null)->toBe($category['id']);
});

it('rejects invalid department category requests', function (): void {
    api_test_covers('GET /departments/categories', 'failure');

    $authorizedSession = api_fixtures()->createUserSession(['list_department_categories']);
    $missingId = api_client()->get('/departments/categories', $authorizedSession['headers']);

    $missingId
        ->assertStatus(400)
        ->assertEnvelope()
        ->assertSuccess(false)
        ->assertMessage('Missing required parameters: id');

    $unauthorizedSession = api_fixtures()->createUserSession([]);
    $missingPermission = api_client()->get('/departments/categories?id=1', $unauthorizedSession['headers']);

    $missingPermission
        ->assertStatus(403)
        ->assertEnvelope()
        ->assertSuccess(false)
        ->assertMissingPermissions(['list_department_categories']);
});