Void-Homelab/tests/api/pending_changes.test.js

import { describe, it, expect, beforeAll, beforeEach } from 'vitest';
import request from 'supertest';
import { setup } from './helpers.js';
import * as spacesRepo from '../../lib/db/repos/spaces.js';
import * as projectsRepo from '../../lib/db/repos/projects.js';
import * as pagesRepo from '../../lib/db/repos/pages.js';
import * as agentsRepo from '../../lib/db/repos/agents.js';
import * as pendingChanges from '../../lib/db/repos/pending_changes.js';

let app, ownerHeaders, space, project, page;
const owner = { kind: 'user', id: null };

async function mintSuggestAgent(slug) {
  const a = await agentsRepo.create({
    slug, name: slug, kind: 'claude', model: 'sonnet',
    capabilities: { read: true, suggest: true }, scopes: {}
  }, owner);
  const { token } = await agentsRepo.createToken(a.id, 'test');
  return { agent: a, headers: { Authorization: `Bearer ${token}` } };
}

beforeAll(async () => { ({ app, ownerHeaders } = await setup()); });
beforeEach(async () => {
  space = await spacesRepo.create(
    { slug: `s-${Date.now()}-${Math.random().toString(36).slice(2,5)}`, name: 'S' }, owner
  );
  project = await projectsRepo.create(
    { space_id: space.id, slug: 'p', name: 'P' }, owner
  );
  page = await pagesRepo.create(
    { space_id: space.id, slug: 'pg', title: 'PG' }, owner
  );
});

describe('pending_changes routes', () => {
  it('GET returns empty list initially', async () => {
    const res = await request(app).get('/api/pending-changes').set(ownerHeaders);
    expect(res.status).toBe(200);
    expect(res.body).toEqual([]);
  });

  it('agent suggest → row appears in GET list', async () => {
    const { headers } = await mintSuggestAgent(`sug-list-${Date.now()}`);
    await request(app).post(`/api/spaces/${space.id}/pages`).set(headers)
      .send({ slug: 'pp', title: 'Pending Page' });
    const list = await request(app).get('/api/pending-changes').set(ownerHeaders);
    expect(list.body.length).toBe(1);
    expect(list.body[0].entity_type).toBe('page');
    expect(list.body[0].action).toBe('create');
  });

  it('approve happy path: page create through dispatch', async () => {
    const { agent, headers } = await mintSuggestAgent(`sug-approve-${Date.now()}`);
    const sug = await request(app).post(`/api/spaces/${space.id}/pages`).set(headers)
      .send({ slug: 'new-page', title: 'New Page', body_md: 'hello' });
    expect(sug.status).toBe(202);
    const changeId = sug.body.change_id;

    const ap = await request(app).post(`/api/pending-changes/${changeId}/approve`).set(ownerHeaders);
    expect(ap.status).toBe(200);
    expect(ap.body.status).toBe('approved');
    expect(ap.body.entity_id).toBeTruthy();

    const created = await request(app).get(`/api/pages/${ap.body.entity_id}`).set(ownerHeaders);
    expect(created.body.title).toBe('New Page');
    expect(created.body.slug).toBe('new-page');

    const audit = await request(app)
      .get(`/api/audit/entity/page/${ap.body.entity_id}`).set(ownerHeaders);
    const create_entry = audit.body.find(e => e.action === 'create');
    expect(create_entry).toBeDefined();
    expect(create_entry.actor_kind).toBe('user');
    const approve_entry = audit.body.find(e => e.action === 'approve');
    expect(approve_entry).toBeDefined();
    expect(approve_entry.actor_kind).toBe('user');
    expect(approve_entry.diff).toBeTruthy();
    expect(approve_entry.diff.after.original_agent_id).toBe(agent.id);
  });

  it('approve dispatch: project create', async () => {
    const { headers } = await mintSuggestAgent(`sug-proj-${Date.now()}`);
    const sug = await request(app).post(`/api/spaces/${space.id}/projects`).set(headers)
      .send({ slug: 'nproj', name: 'NewProj' });
    const ap = await request(app).post(`/api/pending-changes/${sug.body.change_id}/approve`).set(ownerHeaders);
    expect(ap.status).toBe(200);
    const proj = await request(app).get(`/api/projects/${ap.body.entity_id}`).set(ownerHeaders);
    expect(proj.body.name).toBe('NewProj');
  });

  it('approve dispatch: page update', async () => {
    const { headers } = await mintSuggestAgent(`sug-upd-${Date.now()}`);
    const sug = await request(app).patch(`/api/pages/${page.id}`).set(headers)
      .send({ title: 'Renamed' });
    expect(sug.status).toBe(202);
    const ap = await request(app).post(`/api/pending-changes/${sug.body.change_id}/approve`).set(ownerHeaders);
    expect(ap.status).toBe(200);
    expect(ap.body.entity_id).toBe(page.id);
    const after = await request(app).get(`/api/pages/${page.id}`).set(ownerHeaders);
    expect(after.body.title).toBe('Renamed');
  });

  it('approve dispatch: page delete', async () => {
    const { headers } = await mintSuggestAgent(`sug-del-${Date.now()}`);
    const sug = await request(app).delete(`/api/pages/${page.id}`).set(headers);
    expect(sug.status).toBe(202);
    const ap = await request(app).post(`/api/pending-changes/${sug.body.change_id}/approve`).set(ownerHeaders);
    expect(ap.status).toBe(200);
    const after = await request(app).get(`/api/pages/${page.id}`).set(ownerHeaders);
    expect(after.status).toBe(404);
  });

  it('reject leaves entity untouched and marks row rejected', async () => {
    const { headers } = await mintSuggestAgent(`sug-rej-${Date.now()}`);
    const sug = await request(app).post(`/api/spaces/${space.id}/pages`).set(headers)
      .send({ slug: 'rej', title: 'Rejected' });
    const rj = await request(app).post(`/api/pending-changes/${sug.body.change_id}/reject`).set(ownerHeaders);
    expect(rj.status).toBe(200);
    expect(rj.body.status).toBe('rejected');
    const audit = await request(app)
      .get(`/api/audit/actor?actor_kind=user`).set(ownerHeaders);
    expect(audit.body.some(e => e.action === 'reject')).toBe(true);
  });

  it('approve missing → 404', async () => {
    const res = await request(app)
      .post('/api/pending-changes/00000000-0000-0000-0000-000000000000/approve')
      .set(ownerHeaders);
    expect(res.status).toBe(404);
  });

  it('reject missing → 404', async () => {
    const res = await request(app)
      .post('/api/pending-changes/00000000-0000-0000-0000-000000000000/reject')
      .set(ownerHeaders);
    expect(res.status).toBe(404);
  });

  it('double-approve → 409', async () => {
    const { headers } = await mintSuggestAgent(`sug-dup-${Date.now()}`);
    const sug = await request(app).post(`/api/spaces/${space.id}/pages`).set(headers)
      .send({ slug: 'dup', title: 'Dup' });
    await request(app).post(`/api/pending-changes/${sug.body.change_id}/approve`).set(ownerHeaders);
    const second = await request(app)
      .post(`/api/pending-changes/${sug.body.change_id}/approve`).set(ownerHeaders);
    expect(second.status).toBe(409);
  });

  it('apply failure reopens the change to pending (Q5 — no claimed-but-unapplied)', async () => {
    const { agent } = await mintSuggestAgent(`sug-fail-${Date.now()}`);
    // A page-create whose apply will FK-fail: space_id points at no space.
    const change = await pendingChanges.create({
      agent_id: agent.id, entity_type: 'page', action: 'create',
      payload: { space_id: '00000000-0000-0000-0000-000000000000', slug: 'x', title: 'X' },
      reason: 'test'
    });
    const ap = await request(app)
      .post(`/api/pending-changes/${change.id}/approve`).set(ownerHeaders);
    expect(ap.status).toBe(500);                 // apply threw (FK violation)
    const after = await pendingChanges.getById(change.id);
    expect(after.status).toBe('pending');        // claimed-then-reopened, retryable
    expect(after.resolved_at).toBeNull();
  });

  it('reject-then-approve → 409', async () => {
    const { headers } = await mintSuggestAgent(`sug-ra-${Date.now()}`);
    const sug = await request(app).post(`/api/spaces/${space.id}/pages`).set(headers)
      .send({ slug: 'ra', title: 'RA' });
    await request(app).post(`/api/pending-changes/${sug.body.change_id}/reject`).set(ownerHeaders);
    const ap = await request(app).post(`/api/pending-changes/${sug.body.change_id}/approve`).set(ownerHeaders);
    expect(ap.status).toBe(409);
  });

  it('agent token → 403 on pending-changes endpoints (owner-only)', async () => {
    const { headers } = await mintSuggestAgent(`sug-403-${Date.now()}`);
    const list = await request(app).get('/api/pending-changes').set(headers);
    expect(list.status).toBe(403);
    const ap = await request(app)
      .post('/api/pending-changes/00000000-0000-0000-0000-000000000000/approve').set(headers);
    expect(ap.status).toBe(403);
    const rj = await request(app)
      .post('/api/pending-changes/00000000-0000-0000-0000-000000000000/reject').set(headers);
    expect(rj.status).toBe(403);
  });
});