UI-tests und fixes aus tests

public/js/test/api-edge.test.js

@@ -0,0 +1,115 @@
+import { describe, it, expect, csrf } from './runner.js';
+
+describe('API: Edge Cases', () => {
+    it('create card with special characters in title', async () => {
+        const title = '__test <script>alert(1)</script> &amp; "quotes"__';
+        const res = await fetch('api/cards', {
+            method: 'POST', headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf() },
+            body: JSON.stringify({ title, body: '', color: '#38bdf8' }),
+        }).then(r => r.json());
+        expect(res.id).toBeGreaterThan(0);
+
+        const cards = await fetch(`api/cards?ids=${res.id}`).then(r => r.json());
+        expect(cards[0].title).toBe(title);
+    });
+
+    it('PATCH with empty body clears body', async () => {
+        const card = await fetch('api/cards', {
+            method: 'POST', headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf() },
+            body: JSON.stringify({ title: '__test_empty_body__', body: 'has content', color: '#38bdf8' }),
+        }).then(r => r.json());
+
+        await fetch(`api/cards/${card.id}`, {
+            method: 'PATCH', headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf() },
+            body: JSON.stringify({ body: '' }),
+        });
+
+        const updated = (await fetch(`api/cards?ids=${card.id}`).then(r => r.json()))[0];
+        expect(updated.body).toBe('');
+        expect(updated.tags).toBe('');
+    });
+
+    it('PATCH due_date to null clears it', async () => {
+        const card = await fetch('api/cards', {
+            method: 'POST', headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf() },
+            body: JSON.stringify({ title: '__test_clear_due__', body: '', color: '#38bdf8' }),
+        }).then(r => r.json());
+
+        await fetch(`api/cards/${card.id}`, {
+            method: 'PATCH', headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf() },
+            body: JSON.stringify({ due_date: '2099-01-01' }),
+        });
+
+        await fetch(`api/cards/${card.id}`, {
+            method: 'PATCH', headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf() },
+            body: JSON.stringify({ due_date: null }),
+        });
+
+        const updated = (await fetch(`api/cards?ids=${card.id}`).then(r => r.json()))[0];
+        expect(updated.due_date).toBe(null);
+    });
+
+    it('DELETE nonexistent card returns ok', async () => {
+        const res = await fetch('api/cards/999999', {
+            method: 'DELETE', headers: { 'X-CSRF-Token': csrf() },
+        }).then(r => r.json());
+        expect(res.ok).toBe(true);
+    });
+
+    it('PATCH nonexistent card returns card data (null)', async () => {
+        const res = await fetch('api/cards/999999', {
+            method: 'PATCH', headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf() },
+            body: JSON.stringify({ title: 'nope' }),
+        }).then(r => r.json());
+        // Returns false/null for nonexistent card
+        expect(res.title || null).toBe(null);
+    });
+
+    it('create bucket with empty name returns error', async () => {
+        const res = await fetch('api/buckets', {
+            method: 'POST', headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf() },
+            body: JSON.stringify({ name: '' }),
+        });
+        expect(res.status).toBe(400);
+    });
+
+    it('CSRF required for mutations', async () => {
+        const res = await fetch('api/cards', {
+            method: 'POST', headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ title: 'no csrf', body: '' }),
+        });
+        expect(res.status).toBe(403);
+    });
+
+    it('GET requests dont need CSRF', async () => {
+        const res = await fetch('api/cards');
+        expect(res.status).toBe(200);
+    });
+});
+
+describe('API: Card Position', () => {
+    it('new card gets position', async () => {
+        const card = await fetch('api/cards', {
+            method: 'POST', headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf() },
+            body: JSON.stringify({ title: '__test_position__', body: '', color: '#38bdf8', position: 42 }),
+        }).then(r => r.json());
+
+        const all = await fetch(`api/cards?ids=${card.id}`).then(r => r.json());
+        expect(all[0].position).toBe(42);
+    });
+
+    it('position update via PATCH', async () => {
+        const card = await fetch('api/cards', {
+            method: 'POST', headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf() },
+            body: JSON.stringify({ title: '__test_pos_patch__', body: '', color: '#38bdf8' }),
+        }).then(r => r.json());
+
+        await fetch(`api/cards/${card.id}`, {
+            method: 'PATCH', headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf() },
+            body: JSON.stringify({ position: 99 }),
+        });
+
+        const all = await fetch(`api/cards?ids=${card.id}`).then(r => r.json());
+        expect(all[0].position).toBe(99);
+    });
+});