import { describe, expect, it } from "vitest"; import { CalendarResponseSchema, MeResponseSchema, PatCreateResponseSchema } from "@/worker/openapi/schemas"; import { completeOidcLogin } from "@tests/worker/helpers/auth"; import { basicPat } from "@tests/worker/helpers/dav"; import { controlRequest, fetchWorker, subjectRequest } from "@tests/worker/helpers/http"; function jsonHeaders(sessionCookie: string): HeadersInit { return { cookie: sessionCookie, origin: "https://dav.example.com", "content-type": "application/json", }; } function propfindBody(props: string): string { return `${props}`; } describe("calendar JSON API", () => { it("manages calendars and exposes API-created calendars over CalDAV", async () => { const login = await completeOidcLogin(); const meResponse = await fetchWorker(controlRequest("/api/v1/me", { headers: { cookie: login.sessionCookie } })); const me = MeResponseSchema.parse(await meResponse.json()); const listDefaultResponse = await fetchWorker( controlRequest("/api/v1/calendars", { headers: { cookie: login.sessionCookie } }), ); expect(listDefaultResponse.status).toBe(200); const initialCalendars = CalendarResponseSchema.array().parse(await listDefaultResponse.json()); const defaultCalendar = initialCalendars.find((calendar) => calendar.name === "default"); expect(defaultCalendar).toBeDefined(); const calendarName = `api-${crypto.randomUUID()}`; const createResponse = await fetchWorker( controlRequest("/api/v1/calendars", { method: "POST", headers: jsonHeaders(login.sessionCookie), body: JSON.stringify({ name: calendarName, display_name: "Team Calendar", description: "Shared team calendar", color: "#2277cc", order_index: 20, }), }), ); expect(createResponse.status).toBe(201); const created = CalendarResponseSchema.parse(await createResponse.json()); expect(created).toMatchObject({ name: calendarName, display_name: "Team Calendar", description: "Shared team calendar", href: `/calendars/${calendarName}/`, color: "#2277cc", order_index: 20, }); const duplicateResponse = await fetchWorker( controlRequest("/api/v1/calendars", { method: "POST", headers: jsonHeaders(login.sessionCookie), body: JSON.stringify({ name: calendarName }), }), ); expect(duplicateResponse.status).toBe(409); const patchResponse = await fetchWorker( controlRequest(`/api/v1/calendars/${created.id}`, { method: "PATCH", headers: jsonHeaders(login.sessionCookie), body: JSON.stringify({ display_name: "Renamed Calendar", description: null, order_index: 5 }), }), ); expect(patchResponse.status).toBe(200); const patched = CalendarResponseSchema.parse(await patchResponse.json()); expect(patched).toMatchObject({ id: created.id, name: calendarName, display_name: "Renamed Calendar", description: null, order_index: 5, }); expect(patched.sync_token).not.toBe(created.sync_token); const patResponse = await fetchWorker( controlRequest("/api/v1/pats", { method: "POST", headers: jsonHeaders(login.sessionCookie), body: JSON.stringify({ name: "caldav api", scopes: ["caldav.full"] }), }), ); expect(patResponse.status).toBe(201); const pat = PatCreateResponseSchema.parse(await patResponse.json()); const propfind = await fetchWorker( subjectRequest(me.host_label, "/calendars/", { method: "PROPFIND", headers: { authorization: basicPat(pat.token), depth: "1", "content-type": "application/xml", }, body: propfindBody(""), }), ); expect(propfind.status).toBe(207); const xml = await propfind.text(); expect(xml).toContain(`/calendars/${calendarName}/`); expect(xml).toContain("Renamed Calendar"); const deleteDefaultResponse = await fetchWorker( controlRequest(`/api/v1/calendars/${defaultCalendar!.id}`, { method: "DELETE", headers: { cookie: login.sessionCookie, origin: "https://dav.example.com", }, }), ); expect(deleteDefaultResponse.status).toBe(403); const deleteResponse = await fetchWorker( controlRequest(`/api/v1/calendars/${created.id}`, { method: "DELETE", headers: { cookie: login.sessionCookie, origin: "https://dav.example.com", }, }), ); expect(deleteResponse.status).toBe(204); const detailAfterDelete = await fetchWorker( controlRequest(`/api/v1/calendars/${created.id}`, { headers: { cookie: login.sessionCookie } }), ); expect(detailAfterDelete.status).toBe(404); }); it("rejects calendar names that cannot be DAV path segments", async () => { const login = await completeOidcLogin(); const response = await fetchWorker( controlRequest("/api/v1/calendars", { method: "POST", headers: jsonHeaders(login.sessionCookie), body: JSON.stringify({ name: "bad/name" }), }), ); expect(response.status).toBe(400); }); });