import { afterAll, beforeEach, describe, expect, it } from "vitest"; import postgres from "postgres"; import * as repo from "../server/utils/repo"; const sql = postgres(process.env.DATABASE_URL!, { max: 1, onnotice: () => {} }); const U1 = "user-1"; const U2 = "user-2"; beforeEach(async () => { await sql`truncate lists cascade`; }); afterAll(async () => { await sql.end(); }); describe("lists", () => { it("full-replace upserts supplied and deletes missing", async () => { await repo.replaceLists(sql, U1, [ { id: "a", name: "A" }, { id: "b", name: "B" }, ]); await repo.replaceLists(sql, U1, [{ id: "a", name: "A2" }]); // b removed, a renamed const got = await repo.getLists(sql, U1); expect(got).toEqual([{ id: "a", name: "A2", owner_id: U1 }]); }); it("empty payload clears all my lists", async () => { await repo.replaceLists(sql, U1, [{ id: "a", name: "A" }]); await repo.replaceLists(sql, U1, []); expect(await repo.getLists(sql, U1)).toEqual([]); }); it("deleting a list cascades its tasks", async () => { await repo.replaceLists(sql, U1, [{ id: "a", name: "A" }]); await repo.upsertDesktopTask(sql, U1, "t1", { listId: "a", title: "x" }); await repo.replaceLists(sql, U1, []); // removes a + cascades t1 expect(await repo.getUnconsumed(sql, U1)).toEqual([]); }); it("listExists validates listId within the caller's scope", async () => { await repo.replaceLists(sql, U1, [{ id: "L", name: "List" }]); expect(await repo.listExists(sql, U1, "L")).toBe(true); expect(await repo.listExists(sql, U1, "ghost")).toBe(false); expect(await repo.listExists(sql, U2, "L")).toBe(false); // not my list }); }); describe("tasks", () => { beforeEach(async () => { await repo.replaceLists(sql, U1, [{ id: "L", name: "List" }]); }); it("web create returns generated GUID, source=web, consumed=false, stamped owner", async () => { const t = await repo.createWebTask(sql, U1, { listId: "L", title: "buy milk", description: null }); expect(t.id).toMatch(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/); expect(t.source).toBe("web"); expect(t.consumed).toBe(false); expect(t.title).toBe("buy milk"); expect(t.owner_id).toBe(U1); }); it("desktop upsert is idempotent by id; source=desktop on insert", async () => { const a = await repo.upsertDesktopTask(sql, U1, "fixed-id", { listId: "L", title: "one" }); expect(a.created).toBe(true); const b = await repo.upsertDesktopTask(sql, U1, "fixed-id", { listId: "L", title: "two", description: "d" }); expect(b.created).toBe(false); const tasks = await repo.getTasksForList(sql, U1, "L"); expect(tasks).toHaveLength(1); expect(tasks[0].title).toBe("two"); expect(tasks[0].description).toBe("d"); expect(tasks[0].source).toBe("desktop"); }); it("getUnconsumed returns only web tasks with consumed=false", async () => { await repo.createWebTask(sql, U1, { listId: "L", title: "web1", description: null }); await repo.upsertDesktopTask(sql, U1, "d1", { listId: "L", title: "desk1" }); const u = await repo.getUnconsumed(sql, U1); expect(u).toHaveLength(1); expect(u[0].title).toBe("web1"); }); it("consume sets consumed=true and is reflected in getUnconsumed", async () => { const t = await repo.createWebTask(sql, U1, { listId: "L", title: "c", description: null }); expect(await repo.consume(sql, U1, t.id)).toBe(true); expect(await repo.getUnconsumed(sql, U1)).toEqual([]); }); it("consume on unknown id returns false", async () => { expect(await repo.consume(sql, U1, "nope")).toBe(false); }); it("deleteTask is idempotent", async () => { const t = await repo.createWebTask(sql, U1, { listId: "L", title: "c", description: null }); await repo.deleteTask(sql, U1, t.id); await repo.deleteTask(sql, U1, t.id); // no throw on absent expect(await repo.getTasksForList(sql, U1, "L")).toEqual([]); }); }); describe("mirrorDesktopTasks (desktop Idle full-replace)", () => { beforeEach(async () => { await repo.replaceLists(sql, U1, [ { id: "L", name: "List" }, { id: "L2", name: "List 2" }, ]); }); it("inserts items as desktop-owned (consumed=true, source=desktop, stamped owner)", async () => { await repo.mirrorDesktopTasks(sql, U1, [ { id: "m1", listId: "L", title: "one", description: "d1" }, { id: "m2", listId: "L2", title: "two" }, ]); const t = await repo.getTasksForList(sql, U1, "L"); expect(t).toHaveLength(1); expect(t[0]).toMatchObject({ id: "m1", title: "one", description: "d1", source: "desktop", consumed: true, owner_id: U1 }); expect(await repo.getTasksForList(sql, U1, "L2")).toHaveLength(1); }); it("upserts existing items by id (title/listId/description)", async () => { await repo.mirrorDesktopTasks(sql, U1, [{ id: "m1", listId: "L", title: "one" }]); await repo.mirrorDesktopTasks(sql, U1, [{ id: "m1", listId: "L2", title: "renamed", description: "x" }]); const onL = await repo.getTasksForList(sql, U1, "L"); const onL2 = await repo.getTasksForList(sql, U1, "L2"); expect(onL).toHaveLength(0); expect(onL2).toHaveLength(1); expect(onL2[0]).toMatchObject({ title: "renamed", description: "x" }); }); it("deletes desktop tasks whose id is not in the array", async () => { await repo.mirrorDesktopTasks(sql, U1, [ { id: "m1", listId: "L", title: "one" }, { id: "m2", listId: "L", title: "two" }, ]); await repo.mirrorDesktopTasks(sql, U1, [{ id: "m1", listId: "L", title: "one" }]); // m2 dropped const t = await repo.getTasksForList(sql, U1, "L"); expect(t.map((x) => x.id)).toEqual(["m1"]); }); it("empty array deletes all my desktop tasks", async () => { await repo.mirrorDesktopTasks(sql, U1, [{ id: "m1", listId: "L", title: "one" }]); await repo.mirrorDesktopTasks(sql, U1, []); expect(await repo.getTasksForList(sql, U1, "L")).toEqual([]); }); it("does NOT touch web-created tasks awaiting pull (consumed=false)", async () => { const web = await repo.createWebTask(sql, U1, { listId: "L", title: "web", description: null }); await repo.mirrorDesktopTasks(sql, U1, [{ id: "m1", listId: "L", title: "desk" }]); const unconsumed = await repo.getUnconsumed(sql, U1); expect(unconsumed.map((x) => x.id)).toEqual([web.id]); expect((await repo.getTasksForList(sql, U1, "L")).map((x) => x.id).sort()).toEqual([web.id, "m1"].sort()); }); it("claims a web task when its id is mirrored (becomes consumed=true)", async () => { const web = await repo.createWebTask(sql, U1, { listId: "L", title: "web", description: null }); await repo.mirrorDesktopTasks(sql, U1, [{ id: web.id, listId: "L", title: "web (imported)" }]); expect(await repo.getUnconsumed(sql, U1)).toEqual([]); // no longer awaiting pull const t = await repo.getTasksForList(sql, U1, "L"); expect(t[0]).toMatchObject({ id: web.id, title: "web (imported)", consumed: true }); }); }); describe("owner isolation", () => { it("lists are invisible to other users; legacy (NULL owner) lists visible to everyone", async () => { await repo.replaceLists(sql, U1, [{ id: "mine", name: "Mine" }]); await sql`insert into lists (id, name) values ('legacy', 'Old')`; // pre-multi-user row expect((await repo.getLists(sql, U1)).map((l) => l.id).sort()).toEqual(["legacy", "mine"]); expect((await repo.getLists(sql, U2)).map((l) => l.id)).toEqual(["legacy"]); }); it("replaceLists never deletes or renames another user's lists", async () => { await repo.replaceLists(sql, U1, [{ id: "a", name: "A" }]); await repo.replaceLists(sql, U2, [{ id: "b", name: "B" }]); // U2's full catalog: just b expect((await repo.getLists(sql, U1)).map((l) => l.id)).toEqual(["a"]); expect((await repo.getLists(sql, U2)).map((l) => l.id)).toEqual(["b"]); // U2 upserting U1's id must not steal/rename it await repo.replaceLists(sql, U2, [{ id: "a", name: "stolen" }, { id: "b", name: "B" }]); const u1Lists = await repo.getLists(sql, U1); expect(u1Lists).toEqual([{ id: "a", name: "A", owner_id: U1 }]); }); it("replaceLists adopts legacy lists (stamps the caller as owner)", async () => { await sql`insert into lists (id, name) values ('legacy', 'Old')`; await repo.replaceLists(sql, U1, [{ id: "legacy", name: "Old" }]); expect((await repo.getLists(sql, U2)).map((l) => l.id)).toEqual([]); // no longer legacy expect((await repo.getLists(sql, U1))[0]).toMatchObject({ id: "legacy", owner_id: U1 }); }); it("tasks are invisible to other users; legacy tasks visible to everyone", async () => { await repo.replaceLists(sql, U1, [{ id: "L", name: "List" }]); await repo.createWebTask(sql, U1, { listId: "L", title: "mine", description: null }); await sql`insert into tasks (id, list_id, title, source) values ('legacy-t', 'L', 'old', 'web')`; expect((await repo.getUnconsumed(sql, U2)).map((t) => t.id)).toEqual(["legacy-t"]); expect((await repo.getTasksForList(sql, U2, "L")).map((t) => t.id)).toEqual(["legacy-t"]); expect(await repo.getUnconsumed(sql, U1)).toHaveLength(2); }); it("one user's mirror never deletes another user's desktop tasks", async () => { await repo.replaceLists(sql, U1, [{ id: "L1", name: "U1 List" }]); await repo.replaceLists(sql, U2, [{ id: "L2", name: "U2 List" }]); await repo.mirrorDesktopTasks(sql, U1, [{ id: "m1", listId: "L1", title: "u1 task" }]); await repo.mirrorDesktopTasks(sql, U2, [{ id: "m2", listId: "L2", title: "u2 task" }]); // U2's full-replace (only m2) must not have wiped U1's m1: expect((await repo.getTasksForList(sql, U1, "L1")).map((t) => t.id)).toEqual(["m1"]); // and an empty mirror from U2 clears only U2's partition: await repo.mirrorDesktopTasks(sql, U2, []); expect((await repo.getTasksForList(sql, U1, "L1")).map((t) => t.id)).toEqual(["m1"]); expect(await repo.getTasksForList(sql, U2, "L2")).toEqual([]); }); it("mirror upsert cannot claim another user's task by id", async () => { await repo.replaceLists(sql, U1, [{ id: "L1", name: "U1 List" }]); await repo.replaceLists(sql, U2, [{ id: "L2", name: "U2 List" }]); const web = await repo.createWebTask(sql, U1, { listId: "L1", title: "u1 web", description: null }); await repo.mirrorDesktopTasks(sql, U2, [{ id: web.id, listId: "L2", title: "hijack" }]); // U1's web task is untouched and still awaiting pull: const u1 = await repo.getUnconsumed(sql, U1); expect(u1.map((t) => t.id)).toEqual([web.id]); expect(u1[0].title).toBe("u1 web"); }); it("upsertDesktopTask cannot overwrite another user's task", async () => { await repo.replaceLists(sql, U1, [{ id: "L", name: "List" }]); await repo.upsertDesktopTask(sql, U1, "shared-id", { listId: "L", title: "u1 owns this" }); const res = await repo.upsertDesktopTask(sql, U2, "shared-id", { listId: "L", title: "u2 steal" }); expect(res.created).toBe(false); expect((await repo.getTasksForList(sql, U1, "L"))[0].title).toBe("u1 owns this"); }); it("consume and delete are scoped to the caller", async () => { await repo.replaceLists(sql, U1, [{ id: "L", name: "List" }]); const t = await repo.createWebTask(sql, U1, { listId: "L", title: "w", description: null }); expect(await repo.consume(sql, U2, t.id)).toBe(false); await repo.deleteTask(sql, U2, t.id); // no-op for U2 expect((await repo.getUnconsumed(sql, U1)).map((x) => x.id)).toEqual([t.id]); }); });