hyprcrd/public/plugins/tests/api-edge.test.js

import { describe, it, expect, csrf } from './runner.js?v=4';

describe('API: Edge Cases', () => {
    it('create card with special characters in title', async () => {
        const title = '__test <script>alert(1)</script> &amp; "quotes"__';
        const res = await fetch('api/cards', {
            method: 'POST', headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf() },
            body: JSON.stringify({ title, body: '', color: '#38bdf8' }),
        }).then(r => r.json());
        expect(res.id).toBeGreaterThan(0);

        const cards = await fetch(`api/cards?ids=${res.id}`).then(r => r.json());
        expect(cards[0].title).toBe(title);
    });

    it('PATCH with empty body clears body', async () => {
        const card = await fetch('api/cards', {
            method: 'POST', headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf() },
            body: JSON.stringify({ title: '__test_empty_body__', body: 'has content', color: '#38bdf8' }),
        }).then(r => r.json());

        await fetch(`api/cards/${card.id}`, {
            method: 'PATCH', headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf() },
            body: JSON.stringify({ body: '' }),
        });

        const updated = (await fetch(`api/cards?ids=${card.id}`).then(r => r.json()))[0];
        expect(updated.body).toBe('');
        expect(updated.tags).toBe('');
    });

    it('PATCH due_date to null clears it', async () => {
        const card = await fetch('api/cards', {
            method: 'POST', headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf() },
            body: JSON.stringify({ title: '__test_clear_due__', body: '', color: '#38bdf8' }),
        }).then(r => r.json());

        await fetch(`api/cards/${card.id}`, {
            method: 'PATCH', headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf() },
            body: JSON.stringify({ due_date: '2099-01-01' }),
        });

        await fetch(`api/cards/${card.id}`, {
            method: 'PATCH', headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf() },
            body: JSON.stringify({ due_date: null }),
        });

        const updated = (await fetch(`api/cards?ids=${card.id}`).then(r => r.json()))[0];
        expect(updated.due_date).toBe(null);
    });

    it('DELETE nonexistent card returns ok', async () => {
        const res = await fetch('api/cards/999999', {
            method: 'DELETE', headers: { 'X-CSRF-Token': csrf() },
        }).then(r => r.json());
        expect(res.ok).toBe(true);
    });

    it('PATCH nonexistent card returns card data (null)', async () => {
        const res = await fetch('api/cards/999999', {
            method: 'PATCH', headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf() },
            body: JSON.stringify({ title: 'nope' }),
        }).then(r => r.json());
        // Returns false/null for nonexistent card
        expect(res.title || null).toBe(null);
    });

    it('create bucket with empty name returns error', async () => {
        const res = await fetch('api/buckets', {
            method: 'POST', headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf() },
            body: JSON.stringify({ name: '' }),
        });
        expect(res.status).toBe(400);
    });

    it('CSRF required for mutations', async () => {
        const res = await fetch('api/cards', {
            method: 'POST', headers: { 'Content-Type': 'application/json' },
            body: JSON.stringify({ title: 'no csrf', body: '' }),
        });
        expect(res.status).toBe(403);
    });

    it('GET requests dont need CSRF', async () => {
        const res = await fetch('api/cards');
        expect(res.status).toBe(200);
    });
});

describe('API: Card Position', () => {
    it('new card gets position', async () => {
        const card = await fetch('api/cards', {
            method: 'POST', headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf() },
            body: JSON.stringify({ title: '__test_position__', body: '', color: '#38bdf8', position: 42 }),
        }).then(r => r.json());

        const all = await fetch(`api/cards?ids=${card.id}`).then(r => r.json());
        expect(all[0].position).toBe(42);
    });

    it('position update via PATCH', async () => {
        const card = await fetch('api/cards', {
            method: 'POST', headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf() },
            body: JSON.stringify({ title: '__test_pos_patch__', body: '', color: '#38bdf8' }),
        }).then(r => r.json());

        await fetch(`api/cards/${card.id}`, {
            method: 'PATCH', headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf() },
            body: JSON.stringify({ position: 99 }),
        });

        const all = await fetch(`api/cards?ids=${card.id}`).then(r => r.json());
        expect(all[0].position).toBe(99);
    });
});