initial commit on Federted servers

internal/http/sharing_test.go

@@ -0,0 +1,68 @@
+package http
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/cookiejar"
+	"testing"
+)
+
+func TestRevocationAndForeignRelations(t *testing.T) {
+	srv := testServer(t)
+	newClient := func() apiClient { jar, _ := cookiejar.New(nil); return apiClient{t, &http.Client{Jar: jar}, srv.URL} }
+	a, b := newClient(), newClient()
+	account := func(c apiClient, email string) string {
+		body := map[string]any{"email": email, "password": "test-password"}
+		c.request("POST", "/api/signup", body, 201)
+		c.request("POST", "/api/auth/login", body, 200)
+		// Review CR-03: the id comes from the authenticated session, not the
+		// uniform signup body.
+		return meID(c)
+	}
+	account(a, "owner@computer.test")
+	bid := account(b, "recipient@computer.test")
+	tag := a.request("POST", "/api/tags", map[string]any{"name": "Shared"}, 201)["id"].(string)
+	id := a.request("POST", "/api/bookmarks", map[string]any{"url": "https://127.0.0.1/test", "tagIds": []string{tag}, "dueDate": "2026-10-07"}, 201)["id"].(string)
+	a.request("POST", "/api/bookmarks/"+id+"/share", map[string]any{"userIds": []string{bid}}, 200)
+	b.request("GET", "/api/bookmarks/"+id, nil, 200)
+	b.request("DELETE", "/api/bookmarks/"+id+"/share/"+bid, nil, 404)
+	a.request("DELETE", "/api/bookmarks/"+id+"/share/"+bid, nil, 200)
+	b.request("GET", "/api/bookmarks/"+id, nil, 404)
+	a.request("PUT", "/api/tags/"+tag, map[string]any{"shareUserIds": []string{bid}}, 200)
+	b.request("GET", "/api/bookmarks/"+id, nil, 200)
+	a.request("DELETE", "/api/tags/"+tag+"/share/"+bid, nil, 200)
+	b.request("GET", "/api/bookmarks/"+id, nil, 404)
+	// Unsharing a tag must remove every discovery surface, not just the
+	// detail path (review recheck): list and search share the single
+	// BookmarkVisible predicate, so prove it holds end-to-end.
+	for _, q := range []string{"", "?search=127.0.0.1"} {
+		var list []map[string]any
+		res, e := b.c.Get(srv.URL + "/api/bookmarks" + q)
+		if e != nil {
+			t.Fatal(e)
+		}
+		json.NewDecoder(res.Body).Decode(&list)
+		res.Body.Close()
+		for _, item := range list {
+			if item["id"] == id {
+				t.Fatalf("revoked bookmark still visible in list %q", q)
+			}
+		}
+	}
+	a.request("POST", "/api/shared-dates", map[string]any{"date": "2026-10-07", "recipientIds": []string{bid}}, 201)
+	response, e := a.c.Get(srv.URL + "/api/shared-dates")
+	if e != nil {
+		t.Fatal(e)
+	}
+	var dates []map[string]any
+	if e = json.NewDecoder(response.Body).Decode(&dates); e != nil {
+		t.Fatal(e)
+	}
+	response.Body.Close()
+	b.request("GET", "/api/bookmarks/"+id, nil, 200)
+	a.request("DELETE", "/api/shared-dates/"+dates[0]["id"].(string), nil, 200)
+	b.request("GET", "/api/bookmarks/"+id, nil, 404)
+	foreign := b.request("POST", "/api/kanban/columns", map[string]any{"label": "Private"}, 201)["id"].(string)
+	putBookmark(a, id, map[string]any{"kanbanColumnId": foreign}, 400)
+	putBookmark(a, id, map[string]any{"dueDate": map[string]any{}}, 400)
+}