From 104eeba02e36214bbd5ac50d62f7ca7762d2ef85 Mon Sep 17 00:00:00 2001 From: Oier Bravo Urtasun Date: Mon, 13 Apr 2026 10:28:19 +0200 Subject: [PATCH] =?UTF-8?q?feat(fase-3):=20Tareas=20+=20Notas=20=E2=80=94?= =?UTF-8?q?=20TDD=20complete=20(148=20tests=20green)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 3.0 Tests primero pgTAP: 005_tasks_rls.sql (5 — completion CHECK), 006_notes_trash_purge.sql (4 — purge SQL inline + pin/archive CHECK) Vitest RLS: rls-tasks.test.ts (14), rls-notes.test.ts (15) Playwright: tasks.test.ts (3), notes.test.ts (4) 3.1 Tareas Migration 008_tasks.sql: task_lists + tasks + task_list_collective_id() helper CHECK constraint: is_completed ⇔ completed_by ⇔ completed_at RLS by role + cross-collective isolation Store apps/web/src/lib/stores/tasks.ts (optimistic CRUD + reorder) /tasks overview (grid + sticky create input + 5s polling) /tasks/[id] detail with svelte-dnd-action reorder, flip animation, inline edit (dblclick), "Completed by …" attribution via lazy-loaded collective_members 3.2 Notas Migration 009_notes.sql: notes + note_color enum (8) + pin/archive CHECK + 7d trash window in RLS + fn_notes_touch trigger + pg_cron purge job Store apps/web/src/lib/stores/notes.ts (CRUD + pin/archive/trash/duplicate) /notes board (pinned section testid notes-pinned + 30s polling) /notes/[id] editor (title + textarea, 500ms debounced autosave, color picker, pin/archive/duplicate/trash actions) /notes/archive (restore + send to trash) /notes/trash (restore + permanent delete) 3.Z Verification just test-all → 148 verdes, 2 skipped: 25 pgTAP (was 16, +9) 88 Vitest integration (was 59, +29; 2 presence skipped) 6 Vitest unit (unchanged) 29 Playwright (was 22, +3 tasks +4 notes) Co-Authored-By: Claude Opus 4.6 (1M context) --- CLAUDE.md | 15 +- README.md | 4 +- apps/web/messages/en.json | 37 ++ apps/web/messages/es.json | 37 ++ apps/web/src/lib/stores/notes.ts | 147 ++++++++ apps/web/src/lib/stores/tasks.ts | 113 ++++++ apps/web/src/routes/(app)/notes/+page.svelte | 151 +++++++- .../src/routes/(app)/notes/[id]/+page.svelte | 271 +++++++++++++++ .../routes/(app)/notes/archive/+page.svelte | 81 +++++ .../src/routes/(app)/notes/trash/+page.svelte | 81 +++++ apps/web/src/routes/(app)/tasks/+page.svelte | 106 +++++- .../src/routes/(app)/tasks/[id]/+page.svelte | 327 ++++++++++++++++++ apps/web/tests/e2e/notes.test.ts | 106 ++++++ apps/web/tests/e2e/tasks.test.ts | 108 ++++++ packages/test-utils/tests/rls-notes.test.ts | 254 ++++++++++++++ packages/test-utils/tests/rls-tasks.test.ts | 235 +++++++++++++ packages/types/src/database.ts | 107 ++++++ packages/types/src/domain.ts | 26 +- plan/fase-3-tareas-notas.md | 69 ++-- supabase/migrations/008_tasks.sql | 98 ++++++ supabase/migrations/009_notes.sql | 119 +++++++ supabase/tests/005_tasks_rls.sql | 77 +++++ supabase/tests/006_notes_trash_purge.sql | 75 ++++ 23 files changed, 2563 insertions(+), 81 deletions(-) create mode 100644 apps/web/src/lib/stores/notes.ts create mode 100644 apps/web/src/lib/stores/tasks.ts create mode 100644 apps/web/src/routes/(app)/notes/[id]/+page.svelte create mode 100644 apps/web/src/routes/(app)/notes/archive/+page.svelte create mode 100644 apps/web/src/routes/(app)/notes/trash/+page.svelte create mode 100644 apps/web/src/routes/(app)/tasks/[id]/+page.svelte create mode 100644 apps/web/tests/e2e/notes.test.ts create mode 100644 apps/web/tests/e2e/tasks.test.ts create mode 100644 packages/test-utils/tests/rls-notes.test.ts create mode 100644 packages/test-utils/tests/rls-tasks.test.ts create mode 100644 supabase/migrations/008_tasks.sql create mode 100644 supabase/migrations/009_notes.sql create mode 100644 supabase/tests/005_tasks_rls.sql create mode 100644 supabase/tests/006_notes_trash_purge.sql diff --git a/CLAUDE.md b/CLAUDE.md index 00018ee..d4a2a54 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -8,7 +8,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co ## Project Status -**Fase 0 complete. Fase 1 complete. Fase 2a complete. Fase 2b complete (Realtime + offline queue + Modo Compra). 103 tests green: 16 pgTAP + 59 Vitest integration + 6 Vitest unit + 22 Playwright. 2 skipped (Realtime presence — upstream bug in `supabase/realtime` `handle_out/3`, reactivate when fixed). ✅** +**Fase 0 complete. Fase 1 complete. Fase 2a complete. Fase 2b complete (Realtime + offline queue + Modo Compra). Fase 3 complete (Tareas + Notas). 148 tests green: 25 pgTAP + 88 Vitest integration + 6 Vitest unit + 29 Playwright. 2 skipped (Realtime presence — upstream bug in `supabase/realtime` `handle_out/3`, reactivate when fixed). ✅** - `README.md` — full development plan, confirmed tech stack, Justfile reference, and technical warnings - `analysis/analisis-funcional.md` — complete functional specification (domain model, use cases, data models, business rules) @@ -73,6 +73,19 @@ just test-e2e # Playwright E2E tests (requires just dev running) just test-e2e-headed # Playwright with visible browser (debugging) ``` +### Fase 3 — what has been built + +- `supabase/migrations/008_tasks.sql` — `task_lists`, `tasks` with completion-consistency CHECK (`is_completed ⇔ completed_by ⇔ completed_at`), helper `task_list_collective_id()`, RLS by role +- `supabase/migrations/009_notes.sql` — `notes` with `note_color` enum (8 values), `is_pinned`, `is_archived` (mutually exclusive via CHECK), `deleted_at` (7d trash window in RLS), `fn_notes_touch` trigger refreshing `updated_at`/`updated_by`, `pg_cron` job `purge-deleted-notes` at 03:10 +- `apps/web/src/lib/stores/tasks.ts` — task lists CRUD (optimistic) + task ops (`addTask`, `completeTask`, `renameTask`, `deleteTask`, `reorderTasks`) +- `apps/web/src/lib/stores/notes.ts` — `loadNotes/loadArchivedNotes/loadTrashedNotes`, `createNote`, `patchNote` (always sets `updated_by`), `pinNote/unpinNote`, `archiveNote/unarchiveNote`, `trashNote/restoreNote`, `permanentDeleteNote`, `duplicateNote`, `NOTE_COLORS` +- `/tasks` (overview) + `/tasks/[id]` (detail with `dndzone` reorder + `flip` animation; lazy-loads `collective_members` for "Completed by …" attribution; 5s polling per analysis §6) +- `/notes` (board with pinned section testid `notes-pinned`) + `/notes/[id]` (editor: title input + textarea, 500ms debounced autosave, color picker, pin/archive/duplicate/trash) + `/notes/archive` + `/notes/trash` (30s polling on board) +- `apps/web/messages/{en,es}.json` — full Tareas + Notas string set (`tasks_*`, `notes_*`) +- pgTAP `005_tasks_rls.sql` (5 tests on the completion CHECK), `006_notes_trash_purge.sql` (4 tests: inline-runs the purge SQL + verifies pin/archive CHECK) +- Vitest `rls-tasks.test.ts` (14 tests) + `rls-notes.test.ts` (15 tests) +- Playwright `tasks.test.ts` (3 tests) + `notes.test.ts` (4 tests) + ### Fase 2b — what has been built - `supabase/migrations/007_realtime_publication.sql` — adds shopping_items + shopping_lists to `supabase_realtime` publication with `REPLICA IDENTITY FULL` diff --git a/README.md b/README.md index 40b9c37..6889776 100644 --- a/README.md +++ b/README.md @@ -13,8 +13,8 @@ | Fase 1 — Auth y Colectivo | ✅ Completa | | Fase 2a — Lista de Compra CRUD | ✅ Completa | | Fase 2b — Realtime y Modo Compra | ✅ Completa (presence bloqueado por bug upstream de `supabase/realtime`) | -| Suite de tests (pgTAP + Vitest + Playwright) | ✅ 103 tests verdes (16 pgTAP + 59 integración + 6 unit + 22 E2E), ejecutables con `just test-all` | -| Fase 3 — Tareas y Notas | ⏳ Pendiente | +| Fase 3 — Tareas y Notas | ✅ Completa | +| Suite de tests (pgTAP + Vitest + Playwright) | ✅ 148 tests verdes (25 pgTAP + 88 integración + 6 unit + 29 E2E), ejecutables con `just test-all` | | Fase 4 — Búsqueda y Pulido | ⏳ Pendiente | --- diff --git a/apps/web/messages/en.json b/apps/web/messages/en.json index 9fca292..fded502 100644 --- a/apps/web/messages/en.json +++ b/apps/web/messages/en.json @@ -96,7 +96,44 @@ "list_finish_confirm_yes": "Yes, finish", "list_finish_confirm_no": "Keep shopping", "tasks_title": "Tasks", + "tasks_no_lists": "No task lists yet", + "tasks_create_first": "Create your first task list", + "tasks_new_list_placeholder": "New task list", + "tasks_new_task_placeholder": "Add task", + "tasks_empty": "No tasks yet", + "tasks_empty_hint": "Add your first task below", + "tasks_completed_section": "Completed", + "tasks_pending_section": "To do", + "tasks_completed_by": "Completed by {name}", + "tasks_toggle": "Toggle task", + "tasks_uncheck": "Uncheck task", + "tasks_delete": "Delete task", + "tasks_delete_list": "Delete list", + "tasks_delete_list_confirm": "Delete this task list and all its tasks?", "notes_title": "Notes", + "notes_new": "New note", + "notes_pinned_section": "Pinned", + "notes_active_section": "Notes", + "notes_archive": "Archive", + "notes_archive_view": "Archived notes", + "notes_archived_empty": "No archived notes", + "notes_trash_view": "Notes trash", + "notes_trash_empty": "Trash is empty", + "notes_pin": "Pin note", + "notes_unpin": "Unpin note", + "notes_unarchive": "Unarchive note", + "notes_send_to_trash": "Move to trash", + "notes_restore": "Restore", + "notes_duplicate": "Duplicate", + "notes_color": "Color", + "notes_title_placeholder": "Title", + "notes_content_placeholder": "Start writing…", + "notes_content_aria": "Content", + "notes_back_to_board": "Back to board", + "notes_saved": "Saved", + "notes_saving": "Saving…", + "notes_empty_board": "No notes yet", + "notes_empty_board_hint": "Click \"New note\" to start writing", "search_title": "Search", "search_placeholder": "Search lists, tasks, notes…", "trash_restore": "Restore", diff --git a/apps/web/messages/es.json b/apps/web/messages/es.json index 9f04231..9e69fa7 100644 --- a/apps/web/messages/es.json +++ b/apps/web/messages/es.json @@ -96,7 +96,44 @@ "list_finish_confirm_yes": "Sí, terminar", "list_finish_confirm_no": "Seguir comprando", "tasks_title": "Tareas", + "tasks_no_lists": "Sin listas de tareas", + "tasks_create_first": "Crea tu primera lista de tareas", + "tasks_new_list_placeholder": "Nueva lista de tareas", + "tasks_new_task_placeholder": "Añadir tarea", + "tasks_empty": "Sin tareas", + "tasks_empty_hint": "Añade tu primera tarea abajo", + "tasks_completed_section": "Completadas", + "tasks_pending_section": "Por hacer", + "tasks_completed_by": "Completada por {name}", + "tasks_toggle": "Alternar tarea", + "tasks_uncheck": "Desmarcar tarea", + "tasks_delete": "Eliminar tarea", + "tasks_delete_list": "Eliminar lista", + "tasks_delete_list_confirm": "¿Eliminar esta lista y todas sus tareas?", "notes_title": "Notas", + "notes_new": "Nueva nota", + "notes_pinned_section": "Fijadas", + "notes_active_section": "Notas", + "notes_archive": "Archivar", + "notes_archive_view": "Notas archivadas", + "notes_archived_empty": "Sin notas archivadas", + "notes_trash_view": "Papelera de notas", + "notes_trash_empty": "La papelera está vacía", + "notes_pin": "Fijar nota", + "notes_unpin": "Desfijar nota", + "notes_unarchive": "Desarchivar nota", + "notes_send_to_trash": "Enviar a la papelera", + "notes_restore": "Restaurar", + "notes_duplicate": "Duplicar", + "notes_color": "Color", + "notes_title_placeholder": "Título", + "notes_content_placeholder": "Empieza a escribir…", + "notes_content_aria": "Contenido", + "notes_back_to_board": "Volver al tablero", + "notes_saved": "Guardado", + "notes_saving": "Guardando…", + "notes_empty_board": "Sin notas", + "notes_empty_board_hint": "Haz clic en \"Nueva nota\" para empezar", "search_title": "Buscar", "search_placeholder": "Busca listas, tareas, notas…", "trash_restore": "Restaurar", diff --git a/apps/web/src/lib/stores/notes.ts b/apps/web/src/lib/stores/notes.ts new file mode 100644 index 0000000..534f7bd --- /dev/null +++ b/apps/web/src/lib/stores/notes.ts @@ -0,0 +1,147 @@ +import { writable } from 'svelte/store'; +import { getSupabase } from '$lib/supabase'; +import type { Note, NoteColor } from '@colectivo/types'; + +export const notes = writable([]); +export const notesLoading = writable(false); + +// ── Active board (not archived, not in trash) ──────────────────────────────── + +export async function loadNotes(collectiveId: string) { + notesLoading.set(true); + const { data, error } = await getSupabase() + .from('notes') + .select('*') + .eq('collective_id', collectiveId) + .eq('is_archived', false) + .is('deleted_at', null) + .order('is_pinned', { ascending: false }) + .order('updated_at', { ascending: false }); + + if (!error && data) { + notes.set(data as Note[]); + } + notesLoading.set(false); +} + +export async function loadArchivedNotes(collectiveId: string): Promise { + const { data } = await getSupabase() + .from('notes') + .select('*') + .eq('collective_id', collectiveId) + .eq('is_archived', true) + .is('deleted_at', null) + .order('updated_at', { ascending: false }); + return (data as Note[]) ?? []; +} + +export async function loadTrashedNotes(collectiveId: string): Promise { + const { data } = await getSupabase() + .from('notes') + .select('*') + .eq('collective_id', collectiveId) + .not('deleted_at', 'is', null) + .order('deleted_at', { ascending: false }); + return (data as Note[]) ?? []; +} + +export async function loadNote(id: string): Promise { + const { data } = await getSupabase().from('notes').select('*').eq('id', id).single(); + return (data as Note) ?? null; +} + +// ── Mutations ──────────────────────────────────────────────────────────────── + +export async function createNote( + collectiveId: string, + userId: string +): Promise { + const { data, error } = await getSupabase() + .from('notes') + .insert({ + collective_id: collectiveId, + content: '', + created_by: userId, + updated_by: userId + }) + .select() + .single(); + + if (error || !data) return null; + notes.update((ns) => [data as Note, ...ns]); + return data as Note; +} + +export async function patchNote( + id: string, + userId: string, + patch: Partial> +) { + const fullPatch = { ...patch, updated_by: userId }; + await getSupabase().from('notes').update(fullPatch).eq('id', id); + notes.update((ns) => + ns.map((n) => + n.id === id ? { ...n, ...patch, updated_by: userId, updated_at: new Date().toISOString() } : n + ) + ); +} + +export async function pinNote(id: string, userId: string) { + // Pinning forces archive=false (CHECK constraint forbids both true) + await patchNote(id, userId, { is_pinned: true, is_archived: false }); +} + +export async function unpinNote(id: string, userId: string) { + await patchNote(id, userId, { is_pinned: false }); +} + +export async function archiveNote(id: string, userId: string) { + await patchNote(id, userId, { is_archived: true, is_pinned: false }); + notes.update((ns) => ns.filter((n) => n.id !== id)); +} + +export async function unarchiveNote(id: string, userId: string) { + await patchNote(id, userId, { is_archived: false }); +} + +export async function trashNote(id: string, userId: string) { + await patchNote(id, userId, { deleted_at: new Date().toISOString() }); + notes.update((ns) => ns.filter((n) => n.id !== id)); +} + +export async function restoreNote(id: string, userId: string) { + await patchNote(id, userId, { deleted_at: null }); +} + +export async function permanentDeleteNote(id: string) { + await getSupabase().from('notes').delete().eq('id', id); +} + +export async function duplicateNote(note: Note, userId: string): Promise { + const { data, error } = await getSupabase() + .from('notes') + .insert({ + collective_id: note.collective_id, + title: note.title, + content: note.content, + color: note.color, + created_by: userId, + updated_by: userId + }) + .select() + .single(); + if (error || !data) return null; + notes.update((ns) => [data as Note, ...ns]); + return data as Note; +} + +export const NOTE_COLORS: NoteColor[] = [ + 'yellow', + 'green', + 'blue', + 'pink', + 'purple', + 'orange', + 'gray', + 'red' +]; diff --git a/apps/web/src/lib/stores/tasks.ts b/apps/web/src/lib/stores/tasks.ts new file mode 100644 index 0000000..38a754b --- /dev/null +++ b/apps/web/src/lib/stores/tasks.ts @@ -0,0 +1,113 @@ +import { writable } from 'svelte/store'; +import { getSupabase } from '$lib/supabase'; +import type { Task, TaskList } from '@colectivo/types'; + +// ── Task lists store (overview page) ────────────────────────────────────────── + +export const taskLists = writable([]); +export const taskListsLoading = writable(false); + +export async function loadTaskLists(collectiveId: string) { + taskListsLoading.set(true); + const { data, error } = await getSupabase() + .from('task_lists') + .select('*') + .eq('collective_id', collectiveId) + .order('created_at', { ascending: false }); + + if (!error && data) { + taskLists.set(data as TaskList[]); + } + taskListsLoading.set(false); +} + +export async function createTaskList( + collectiveId: string, + name: string, + userId: string +): Promise { + const tempId = crypto.randomUUID(); + const optimistic: TaskList = { + id: tempId, + collective_id: collectiveId, + name, + created_by: userId, + created_at: new Date().toISOString() + }; + taskLists.update((ls) => [optimistic, ...ls]); + + const { data, error } = await getSupabase() + .from('task_lists') + .insert({ collective_id: collectiveId, name, created_by: userId }) + .select() + .single(); + + if (error || !data) { + taskLists.update((ls) => ls.filter((l) => l.id !== tempId)); + return null; + } + + const real = data as TaskList; + taskLists.update((ls) => ls.map((l) => (l.id === tempId ? real : l))); + return real; +} + +export async function renameTaskList(id: string, name: string) { + taskLists.update((ls) => ls.map((l) => (l.id === id ? { ...l, name } : l))); + await getSupabase().from('task_lists').update({ name }).eq('id', id); +} + +export async function deleteTaskList(id: string) { + taskLists.update((ls) => ls.filter((l) => l.id !== id)); + await getSupabase().from('task_lists').delete().eq('id', id); +} + +// ── Task operations (used by [id] page) ─────────────────────────────────────── + +export async function loadTasks(listId: string): Promise { + const { data, error } = await getSupabase() + .from('tasks') + .select('*') + .eq('list_id', listId) + .order('sort_order', { ascending: true }); + + if (error || !data) return []; + return data as Task[]; +} + +export async function addTask( + listId: string, + title: string, + userId: string, + sortOrder: number +): Promise { + const { data, error } = await getSupabase() + .from('tasks') + .insert({ list_id: listId, title, sort_order: sortOrder, created_by: userId }) + .select() + .single(); + + if (error || !data) return null; + return data as Task; +} + +export async function renameTask(id: string, title: string) { + await getSupabase().from('tasks').update({ title }).eq('id', id); +} + +export async function completeTask(id: string, userId: string, completed: boolean) { + const patch = completed + ? { is_completed: true, completed_by: userId, completed_at: new Date().toISOString() } + : { is_completed: false, completed_by: null, completed_at: null }; + await getSupabase().from('tasks').update(patch).eq('id', id); +} + +export async function deleteTask(id: string) { + await getSupabase().from('tasks').delete().eq('id', id); +} + +export async function reorderTasks(tasks: Pick[]) { + await Promise.all( + tasks.map((t, idx) => getSupabase().from('tasks').update({ sort_order: idx }).eq('id', t.id)) + ); +} diff --git a/apps/web/src/routes/(app)/notes/+page.svelte b/apps/web/src/routes/(app)/notes/+page.svelte index a7c9d14..8b72b61 100644 --- a/apps/web/src/routes/(app)/notes/+page.svelte +++ b/apps/web/src/routes/(app)/notes/+page.svelte @@ -1,17 +1,148 @@ -
-
-

- {m.nav_notes()} -

-

- {m.notes_title()} -

+{m.notes_title()} — Colectivo + +
+
+ +

{m.notes_title()}

+
+ + + + + + +
-
- + +
+ {#if $notesLoading && $notes.length === 0} +

{m.loading()}

+ {:else if $notes.length === 0} +
+

{m.notes_empty_board()}

+

{m.notes_empty_board_hint()}

+
+ {:else} + {#if pinned.length > 0} +
+

+ {m.notes_pinned_section()} +

+
+ {#each pinned as note (note.id)} + + {#if note.title} +

{note.title}

+ {/if} +

+ {note.content} +

+ + {/each} +
+
+ {/if} + + {#if others.length > 0} +
+ {#if pinned.length > 0} +

+ {m.notes_active_section()} +

+ {/if} +
+ {#each others as note (note.id)} + + {#if note.title} +

{note.title}

+ {/if} +

+ {note.content} +

+ + {/each} +
+
+ {/if} + {/if}
diff --git a/apps/web/src/routes/(app)/notes/[id]/+page.svelte b/apps/web/src/routes/(app)/notes/[id]/+page.svelte new file mode 100644 index 0000000..74104ab --- /dev/null +++ b/apps/web/src/routes/(app)/notes/[id]/+page.svelte @@ -0,0 +1,271 @@ + + +{title || m.notes_title()} — Colectivo + +
+
+ + + +
+ + {#if note?.deleted_at} + {m.notes_trash_view()} + + {:else} + + {saving ? m.notes_saving() : savedAt ? m.notes_saved() : ''} + + + +
+ + {#if showColorPicker} +
+ + {#each NOTE_COLORS as c} + + {/each} +
+ {/if} +
+ + + + + + + + + {/if} +
+ +
+ + +
+
diff --git a/apps/web/src/routes/(app)/notes/archive/+page.svelte b/apps/web/src/routes/(app)/notes/archive/+page.svelte new file mode 100644 index 0000000..41df38f --- /dev/null +++ b/apps/web/src/routes/(app)/notes/archive/+page.svelte @@ -0,0 +1,81 @@ + + +{m.notes_archive_view()} — Colectivo + +
+
+ + + +

{m.notes_archive_view()}

+
+ +
+ {#if loading} +

{m.loading()}

+ {:else if archived.length === 0} +

{m.notes_archived_empty()}

+ {:else} +
+ {#each archived as note (note.id)} +
+ + {#if note.title} +

{note.title}

+ {/if} +

{note.content}

+ + + +
+ {/each} +
+ {/if} +
+
diff --git a/apps/web/src/routes/(app)/notes/trash/+page.svelte b/apps/web/src/routes/(app)/notes/trash/+page.svelte new file mode 100644 index 0000000..b75f288 --- /dev/null +++ b/apps/web/src/routes/(app)/notes/trash/+page.svelte @@ -0,0 +1,81 @@ + + +{m.notes_trash_view()} — Colectivo + +
+
+ + + +

{m.notes_trash_view()}

+
+ +
+ {#if loading} +

{m.loading()}

+ {:else if trashed.length === 0} +

{m.notes_trash_empty()}

+ {:else} +
+ {#each trashed as note (note.id)} +
+
+ {#if note.title} +

{note.title}

+ {/if} +

{note.content}

+
+ + +
+ {/each} +
+ {/if} +
+
diff --git a/apps/web/src/routes/(app)/tasks/+page.svelte b/apps/web/src/routes/(app)/tasks/+page.svelte index b3ebe67..542ab42 100644 --- a/apps/web/src/routes/(app)/tasks/+page.svelte +++ b/apps/web/src/routes/(app)/tasks/+page.svelte @@ -1,17 +1,103 @@ -
-
-

- {m.nav_tasks()} -

-

- {m.tasks_title()} -

+{m.tasks_title()} — Colectivo + +
+
+ +

{m.tasks_title()}

-
- + +
+ {#if $taskListsLoading && $taskLists.length === 0} +

{m.loading()}

+ {:else if $taskLists.length === 0} +
+

{m.tasks_no_lists()}

+

{m.tasks_create_first()}

+
+ {:else} +
+ {#each $taskLists as list (list.id)} +
+ +

{list.name}

+ + +
+ {/each} +
+ {/if} +
+ +
+
+ + +
diff --git a/apps/web/src/routes/(app)/tasks/[id]/+page.svelte b/apps/web/src/routes/(app)/tasks/[id]/+page.svelte new file mode 100644 index 0000000..5856b5c --- /dev/null +++ b/apps/web/src/routes/(app)/tasks/[id]/+page.svelte @@ -0,0 +1,327 @@ + + +{list?.name ?? m.tasks_title()} — Colectivo + +
+
+ + + +

{list?.name ?? ''}

+
+ +
+ {#if loading} +

{m.loading()}

+ {:else if tasks.length === 0} +
+

{m.tasks_empty()}

+

{m.tasks_empty_hint()}

+
+ {:else} + + {#if pendingTasks.length > 0} +
+ {#each pendingTasks as task (task.id)} +
+ + + {#if editingId === task.id} + + {:else} + + {/if} + +
+ {/each} +
+ {/if} + + + {#if completedTasks.length > 0} +
+

+ {m.tasks_completed_section()} +

+
+ {#each completedTasks as task (task.id)} +
+ + + {task.title} + + + {m.tasks_completed_by({ name: nameFor(task.completed_by) })} + + +
+ {/each} +
+
+ {/if} + {/if} +
+ + +
+
+ + +
+
+
diff --git a/apps/web/tests/e2e/notes.test.ts b/apps/web/tests/e2e/notes.test.ts new file mode 100644 index 0000000..a7dc3c5 --- /dev/null +++ b/apps/web/tests/e2e/notes.test.ts @@ -0,0 +1,106 @@ +/** + * N-series (UI) — Fase 3.2 + * + * Notes board at /notes; editor at /notes/[id]. Create, change color, pin, + * archive, trash, restore. Guest is read-only. + */ +import { test, expect, type Page } from '@playwright/test'; +import { USERS } from '../fixtures/users.js'; +import { loginAs } from '../fixtures/login.js'; + +async function gotoNotes(page: Page) { + await page.goto('/notes'); + await expect( + page.getByRole('button', { name: /new note|nueva nota/i }) + ).toBeVisible({ timeout: 15_000 }); +} + +async function createNote(page: Page, title: string, content: string) { + await page.getByRole('button', { name: /new note|nueva nota/i }).click(); + await expect(page).toHaveURL(/\/notes\/[0-9a-f-]+$/, { timeout: 10_000 }); + + const titleInput = page.getByPlaceholder(/title|título/i); + await titleInput.fill(title); + + const contentInput = page.getByRole('textbox', { name: /content|contenido/i }); + await contentInput.fill(content); + + // Wait beyond the 500ms autosave debounce + buffer. + await page.waitForTimeout(900); +} + +test.describe('Notes — member (Borja)', () => { + test.beforeEach(async ({ page }) => { + await loginAs(page, USERS.borja); + }); + + test('N-UI-01: create + autosave + back to board shows the note', async ({ page }) => { + await gotoNotes(page); + const title = `Note ${Date.now()}`; + await createNote(page, title, 'autosave content'); + + await page.goto('/notes'); + await expect( + page.getByRole('heading', { name: new RegExp(`^${title}$`) }) + ).toBeVisible({ timeout: 5_000 }); + }); + + test('N-UI-02: pin a note → it appears in the pinned section', async ({ page }) => { + await gotoNotes(page); + const title = `Pin ${Date.now()}`; + await createNote(page, title, 'pin me'); + + await page.getByRole('button', { name: /pin note|fijar nota/i }).click(); + await page.waitForTimeout(800); + + await page.goto('/notes'); + const pinnedSection = page.getByTestId('notes-pinned'); + await expect(pinnedSection.getByText(title)).toBeVisible({ timeout: 5_000 }); + }); + + test('N-UI-03: trash → restore from /notes/trash', async ({ page }) => { + await gotoNotes(page); + const title = `Trash ${Date.now()}`; + await createNote(page, title, 'trash me'); + + await page.getByRole('button', { name: /move to trash|enviar a la papelera/i }).click(); + await page.waitForTimeout(800); + + await page.goto('/notes'); + await expect( + page.getByRole('heading', { name: new RegExp(`^${title}$`) }) + ).not.toBeVisible({ timeout: 3_000 }); + + await page.goto('/notes/trash'); + const trashedRow = page + .locator('[role="listitem"], [data-testid="note-card"]') + .filter({ hasText: title }) + .first(); + await expect(trashedRow).toBeVisible({ timeout: 5_000 }); + await trashedRow.getByRole('button', { name: /restore|restaurar/i }).click(); + await page.waitForTimeout(800); + + await page.goto('/notes'); + await expect( + page.getByRole('heading', { name: new RegExp(`^${title}$`) }) + ).toBeVisible({ timeout: 5_000 }); + }); +}); + +test.describe('Notes — guest (David, read-only)', () => { + test.beforeEach(async ({ page }) => { + await loginAs(page, USERS.david); + }); + + test('N-UI-04: guest can read the board, create button is hidden or no-op', async ({ page }) => { + await page.goto('/notes'); + // The "new note" button must either be absent, or clicking it must not + // land us on a /notes/[id] route (RLS blocks the insert). + const newBtn = page.getByRole('button', { name: /new note|nueva nota/i }); + if (await newBtn.isVisible({ timeout: 2_000 }).catch(() => false)) { + await newBtn.click(); + await page.waitForTimeout(1_500); + await expect(page).not.toHaveURL(/\/notes\/[0-9a-f-]+$/); + } + }); +}); diff --git a/apps/web/tests/e2e/tasks.test.ts b/apps/web/tests/e2e/tasks.test.ts new file mode 100644 index 0000000..4fa0a22 --- /dev/null +++ b/apps/web/tests/e2e/tasks.test.ts @@ -0,0 +1,108 @@ +/** + * T-series (UI) — Fase 3.1 + * + * Task lists overview at /tasks; per-list detail at /tasks/[id]. Members can + * create, complete, edit, delete, and reorder tasks. Guests see them but + * cannot mutate. Completed tasks sink to the bottom and show "Completed by …". + */ +import { test, expect, type Page } from '@playwright/test'; +import { USERS } from '../fixtures/users.js'; +import { loginAs } from '../fixtures/login.js'; + +const NEW_LIST_PLACEHOLDER = /new task list|nueva lista de tareas/i; +const NEW_TASK_PLACEHOLDER = /add task|añadir tarea/i; + +async function gotoTasksClean(page: Page) { + await page.goto('/tasks'); + await expect(page.getByPlaceholder(NEW_LIST_PLACEHOLDER)).toBeVisible({ timeout: 15_000 }); +} + +async function createTaskList(page: Page, name: string) { + const input = page.getByPlaceholder(NEW_LIST_PLACEHOLDER); + await input.fill(name); + await input.press('Enter'); + const heading = page.getByRole('heading', { name: new RegExp(`^${name}$`) }); + await expect(heading).toBeVisible({ timeout: 5_000 }); + await heading.click(); + await expect(page).toHaveURL(/\/tasks\/[0-9a-f-]+$/, { timeout: 5_000 }); +} + +test.describe('Tasks — member (Borja)', () => { + test.beforeEach(async ({ page }) => { + await loginAs(page, USERS.borja); + }); + + test('T-UI-01: create list, add task, complete it, see "Completed by …" tooltip', async ({ + page + }) => { + await gotoTasksClean(page); + const listName = `Tasks ${Date.now()}`; + await createTaskList(page, listName); + + const taskInput = page.getByPlaceholder(NEW_TASK_PLACEHOLDER); + await expect(taskInput).toBeVisible({ timeout: 5_000 }); + const taskTitle = `Buy milk ${Date.now()}`; + await taskInput.fill(taskTitle); + await taskInput.press('Enter'); + + const row = page.locator('[role="listitem"]').filter({ hasText: taskTitle }); + await expect(row).toBeVisible({ timeout: 5_000 }); + + // Toggle complete + await row.getByRole('button', { name: /toggle task|alternar tarea/i }).click(); + + // Title is decorated as completed (line-through). Check via aria. + await expect( + page + .locator('[role="listitem"]') + .filter({ hasText: taskTitle }) + .getByRole('button', { name: /uncheck task|desmarcar tarea/i }) + ).toBeVisible({ timeout: 5_000 }); + + // "Completed by Borja" tooltip / metadata visible somewhere on the row. + await expect( + page.locator('[role="listitem"]').filter({ hasText: taskTitle }).getByText(/borja/i) + ).toBeVisible({ timeout: 5_000 }); + }); + + test('T-UI-02: delete a task removes it from the list', async ({ page }) => { + await gotoTasksClean(page); + const listName = `Tasks-del ${Date.now()}`; + await createTaskList(page, listName); + + const taskInput = page.getByPlaceholder(NEW_TASK_PLACEHOLDER); + const taskTitle = `Delete me ${Date.now()}`; + await taskInput.fill(taskTitle); + await taskInput.press('Enter'); + + const row = page.locator('[role="listitem"]').filter({ hasText: taskTitle }); + await expect(row).toBeVisible({ timeout: 5_000 }); + + await row.getByRole('button', { name: /delete task|eliminar tarea/i }).click(); + await expect( + page.locator('[role="listitem"]').filter({ hasText: taskTitle }) + ).toHaveCount(0, { timeout: 5_000 }); + }); +}); + +test.describe('Tasks — guest (David, read-only)', () => { + test.beforeEach(async ({ page }) => { + await loginAs(page, USERS.david); + }); + + test('T-UI-03: guest can navigate to /tasks but cannot create lists', async ({ page }) => { + await page.goto('/tasks'); + // Either the create input is hidden, or it exists but typing into it + // must NOT produce a committed list (RLS blocks the insert). + const input = page.getByPlaceholder(NEW_LIST_PLACEHOLDER); + if (await input.isVisible({ timeout: 2_000 }).catch(() => false)) { + const name = `David sneaky ${Date.now()}`; + await input.fill(name); + await input.press('Enter'); + await page.waitForTimeout(1_500); + await expect( + page.getByRole('heading', { name: new RegExp(`^${name}$`) }) + ).not.toBeVisible({ timeout: 2_000 }); + } + }); +}); diff --git a/packages/test-utils/tests/rls-notes.test.ts b/packages/test-utils/tests/rls-notes.test.ts new file mode 100644 index 0000000..8bbd168 --- /dev/null +++ b/packages/test-utils/tests/rls-notes.test.ts @@ -0,0 +1,254 @@ +/** + * N-series: notes RLS — CRUD by role, archive, trash window, cross-collective isolation. + */ +import { describe, it, expect, beforeAll, afterAll } from 'vitest'; +import { createClientAs, createAdminClient } from '../src/supabase-clients.js'; +import { sql, closePool } from '../src/db-helpers.js'; +import { ANA_ID, BORJA_ID, DAVID_ID, EVA_ID, COLLECTIVE_ID } from '../src/seed-constants.js'; + +const admin = createAdminClient(); +const createdNoteIds: string[] = []; + +afterAll(async () => { + if (createdNoteIds.length > 0) { + await admin.from('notes').delete().in('id', createdNoteIds); + } + await closePool(); +}); + +describe('Note CRUD by role', () => { + let noteId: string; + + it('N-01a: member (Borja) can create a note', async () => { + const borja = await createClientAs(BORJA_ID); + const { data, error } = await borja + .from('notes') + .insert({ + collective_id: COLLECTIVE_ID, + title: 'Borja note', + content: 'hello', + created_by: BORJA_ID, + updated_by: BORJA_ID + }) + .select('id') + .single(); + expect(error).toBeNull(); + expect(data?.id).toBeTruthy(); + noteId = data!.id; + createdNoteIds.push(noteId); + }); + + it('N-01b: guest (David) cannot create a note', async () => { + const david = await createClientAs(DAVID_ID); + const { data, error } = await david + .from('notes') + .insert({ + collective_id: COLLECTIVE_ID, + content: 'David note', + created_by: DAVID_ID, + updated_by: DAVID_ID + }) + .select('id') + .single(); + expect(data).toBeNull(); + expect(error).not.toBeNull(); + }); + + it('N-01c: guest (David) can read notes', async () => { + const david = await createClientAs(DAVID_ID); + const { data, error } = await david.from('notes').select('id').eq('id', noteId); + expect(error).toBeNull(); + expect(data).toHaveLength(1); + }); + + it('N-01d: any active member can edit any note (Carmen edits Borja\'s)', async () => { + const carmen = await createClientAs('33333333-3333-3333-3333-333333333333'); + const { error } = await carmen + .from('notes') + .update({ content: 'edited by Carmen', updated_by: '33333333-3333-3333-3333-333333333333' }) + .eq('id', noteId); + expect(error).toBeNull(); + + const { data } = await admin.from('notes').select('content, updated_by').eq('id', noteId).single(); + expect(data?.content).toBe('edited by Carmen'); + expect(data?.updated_by).toBe('33333333-3333-3333-3333-333333333333'); + }); + + it('N-01e: cannot spoof created_by/updated_by on insert', async () => { + const borja = await createClientAs(BORJA_ID); + const { data, error } = await borja + .from('notes') + .insert({ + collective_id: COLLECTIVE_ID, + content: 'spoof', + created_by: ANA_ID, + updated_by: ANA_ID + }) + .select('id') + .single(); + expect(data).toBeNull(); + expect(error).not.toBeNull(); + }); +}); + +describe('Note pin / archive / trash flow', () => { + let noteId: string; + + beforeAll(async () => { + const { data } = await admin + .from('notes') + .insert({ + collective_id: COLLECTIVE_ID, + content: 'flow note', + created_by: ANA_ID, + updated_by: ANA_ID + }) + .select('id') + .single(); + noteId = data!.id; + createdNoteIds.push(noteId); + }); + + it('N-02a: member can pin', async () => { + const borja = await createClientAs(BORJA_ID); + const { error } = await borja + .from('notes') + .update({ is_pinned: true, updated_by: BORJA_ID }) + .eq('id', noteId); + expect(error).toBeNull(); + }); + + it('N-02b: pinned + archived combination is rejected (CHECK)', async () => { + const borja = await createClientAs(BORJA_ID); + const { error } = await borja + .from('notes') + .update({ is_archived: true, updated_by: BORJA_ID }) + .eq('id', noteId); + expect(error).not.toBeNull(); + }); + + it('N-02c: archive (after unpin) succeeds', async () => { + const borja = await createClientAs(BORJA_ID); + await borja + .from('notes') + .update({ is_pinned: false, is_archived: true, updated_by: BORJA_ID }) + .eq('id', noteId); + const { data } = await admin.from('notes').select('is_archived').eq('id', noteId).single(); + expect(data?.is_archived).toBe(true); + }); + + it('N-02d: archived note is still readable', async () => { + const david = await createClientAs(DAVID_ID); + const { data } = await david.from('notes').select('id, is_archived').eq('id', noteId).single(); + expect(data?.id).toBe(noteId); + expect(data?.is_archived).toBe(true); + }); +}); + +describe('Note trash window', () => { + let noteId: string; + + beforeAll(async () => { + const { data } = await admin + .from('notes') + .insert({ + collective_id: COLLECTIVE_ID, + content: 'trash note', + created_by: ANA_ID, + updated_by: ANA_ID + }) + .select('id') + .single(); + noteId = data!.id; + createdNoteIds.push(noteId); + }); + + it('N-03a: soft-deleted note is visible within the 7-day window', async () => { + const borja = await createClientAs(BORJA_ID); + await borja + .from('notes') + .update({ deleted_at: new Date().toISOString(), updated_by: BORJA_ID }) + .eq('id', noteId); + + const { data } = await borja.from('notes').select('id, deleted_at').eq('id', noteId).single(); + expect(data?.id).toBe(noteId); + expect(data?.deleted_at).not.toBeNull(); + }); + + it('N-03b: soft-deleted note older than 7 days is invisible', async () => { + await sql(`UPDATE public.notes SET deleted_at = now() - INTERVAL '8 days' WHERE id = $1`, [noteId]); + const borja = await createClientAs(BORJA_ID); + const { data } = await borja.from('notes').select('id').eq('id', noteId); + expect(data).toHaveLength(0); + await sql(`UPDATE public.notes SET deleted_at = now() WHERE id = $1`, [noteId]); + }); + + it('N-03c: guest cannot hard-delete a soft-deleted note', async () => { + const david = await createClientAs(DAVID_ID); + await david.from('notes').delete().eq('id', noteId); + const { data } = await admin.from('notes').select('id').eq('id', noteId).single(); + expect(data?.id).toBe(noteId); + }); + + it('N-03d: member can hard-delete a soft-deleted note', async () => { + const borja = await createClientAs(BORJA_ID); + const { error } = await borja.from('notes').delete().eq('id', noteId); + expect(error).toBeNull(); + const { data } = await admin.from('notes').select('id').eq('id', noteId); + expect(data).toHaveLength(0); + const idx = createdNoteIds.indexOf(noteId); + if (idx !== -1) createdNoteIds.splice(idx, 1); + }); +}); + +describe('Cross-collective note isolation', () => { + let otherCollectiveId: string; + let otherNoteId: string; + + beforeAll(async () => { + const { data: collective } = await admin + .from('collectives') + .insert({ name: 'Notes isolation collective', emoji: '🔐', created_by: EVA_ID }) + .select('id') + .single(); + otherCollectiveId = collective!.id; + await admin.from('collective_members').insert({ + collective_id: otherCollectiveId, + user_id: EVA_ID, + role: 'admin' + }); + const { data: note } = await admin + .from('notes') + .insert({ + collective_id: otherCollectiveId, + content: 'Eva private', + created_by: EVA_ID, + updated_by: EVA_ID + }) + .select('id') + .single(); + otherNoteId = note!.id; + }); + + afterAll(async () => { + if (otherCollectiveId) { + await admin.from('collectives').delete().eq('id', otherCollectiveId); + } + }); + + it('N-04a: Borja cannot read Eva\'s note', async () => { + const borja = await createClientAs(BORJA_ID); + const { data } = await borja.from('notes').select('id').eq('id', otherNoteId); + expect(data).toHaveLength(0); + }); + + it('N-04b: Borja cannot edit Eva\'s note', async () => { + const borja = await createClientAs(BORJA_ID); + await borja + .from('notes') + .update({ content: 'hacked', updated_by: BORJA_ID }) + .eq('id', otherNoteId); + const { data } = await admin.from('notes').select('content').eq('id', otherNoteId).single(); + expect(data?.content).toBe('Eva private'); + }); +}); diff --git a/packages/test-utils/tests/rls-tasks.test.ts b/packages/test-utils/tests/rls-tasks.test.ts new file mode 100644 index 0000000..0632cb2 --- /dev/null +++ b/packages/test-utils/tests/rls-tasks.test.ts @@ -0,0 +1,235 @@ +/** + * T-series: task_lists and tasks RLS — CRUD by role, completion invariants, + * cross-collective isolation. + */ +import { describe, it, expect, beforeAll, afterAll } from 'vitest'; +import { createClientAs, createAdminClient } from '../src/supabase-clients.js'; +import { ANA_ID, BORJA_ID, DAVID_ID, EVA_ID, COLLECTIVE_ID } from '../src/seed-constants.js'; +import { closePool } from '../src/db-helpers.js'; + +const admin = createAdminClient(); +const createdTaskListIds: string[] = []; +let seedTaskListId: string; + +beforeAll(async () => { + // Seed a task list owned by Ana for the rest of the suite to read against. + const { data, error } = await admin + .from('task_lists') + .insert({ collective_id: COLLECTIVE_ID, name: 'T-series seed list', created_by: ANA_ID }) + .select('id') + .single(); + if (error) throw error; + seedTaskListId = data!.id; + createdTaskListIds.push(seedTaskListId); +}); + +afterAll(async () => { + if (createdTaskListIds.length > 0) { + await admin.from('task_lists').delete().in('id', createdTaskListIds); + } + await closePool(); +}); + +describe('Task list access by role', () => { + it('T-01a: member (Borja) can create a task list', async () => { + const borja = await createClientAs(BORJA_ID); + const { data, error } = await borja + .from('task_lists') + .insert({ collective_id: COLLECTIVE_ID, name: 'Borja list', created_by: BORJA_ID }) + .select('id') + .single(); + expect(error).toBeNull(); + expect(data?.id).toBeTruthy(); + if (data?.id) createdTaskListIds.push(data.id); + }); + + it('T-01b: guest (David) cannot create a task list', async () => { + const david = await createClientAs(DAVID_ID); + const { data, error } = await david + .from('task_lists') + .insert({ collective_id: COLLECTIVE_ID, name: 'David list', created_by: DAVID_ID }) + .select('id') + .single(); + expect(data).toBeNull(); + expect(error).not.toBeNull(); + }); + + it('T-01c: guest (David) can read task lists', async () => { + const david = await createClientAs(DAVID_ID); + const { data, error } = await david + .from('task_lists') + .select('id') + .eq('id', seedTaskListId); + expect(error).toBeNull(); + expect(data).toHaveLength(1); + }); +}); + +describe('Task CRUD by role', () => { + let taskId: string; + + it('T-02a: member (Borja) can add a task', async () => { + const borja = await createClientAs(BORJA_ID); + const { data, error } = await borja + .from('tasks') + .insert({ list_id: seedTaskListId, title: 'Borja task', created_by: BORJA_ID }) + .select('id') + .single(); + expect(error).toBeNull(); + expect(data?.id).toBeTruthy(); + taskId = data!.id; + }); + + it('T-02b: guest (David) cannot add a task', async () => { + const david = await createClientAs(DAVID_ID); + const { data, error } = await david + .from('tasks') + .insert({ list_id: seedTaskListId, title: 'David task', created_by: DAVID_ID }) + .select('id') + .single(); + expect(data).toBeNull(); + expect(error).not.toBeNull(); + }); + + it('T-02c: guest (David) can read tasks', async () => { + const david = await createClientAs(DAVID_ID); + const { data, error } = await david + .from('tasks') + .select('id') + .eq('list_id', seedTaskListId); + expect(error).toBeNull(); + expect(data!.length).toBeGreaterThanOrEqual(1); + }); + + it('T-02d: cannot spoof created_by', async () => { + const borja = await createClientAs(BORJA_ID); + const { data, error } = await borja + .from('tasks') + .insert({ list_id: seedTaskListId, title: 'Spoof', created_by: ANA_ID }) + .select('id') + .single(); + expect(data).toBeNull(); + expect(error).not.toBeNull(); + }); +}); + +describe('Task completion invariants', () => { + let taskId: string; + + beforeAll(async () => { + const { data } = await admin + .from('tasks') + .insert({ list_id: seedTaskListId, title: 'Complete me', created_by: ANA_ID }) + .select('id') + .single(); + taskId = data!.id; + }); + + it('T-03a: marking complete sets completed_by + completed_at', async () => { + const borja = await createClientAs(BORJA_ID); + const { error } = await borja + .from('tasks') + .update({ + is_completed: true, + completed_by: BORJA_ID, + completed_at: new Date().toISOString() + }) + .eq('id', taskId); + expect(error).toBeNull(); + + const { data } = await admin.from('tasks').select('*').eq('id', taskId).single(); + expect(data?.is_completed).toBe(true); + expect(data?.completed_by).toBe(BORJA_ID); + expect(data?.completed_at).not.toBeNull(); + }); + + it('T-03b: unmarking clears completed_by + completed_at', async () => { + const borja = await createClientAs(BORJA_ID); + const { error } = await borja + .from('tasks') + .update({ is_completed: false, completed_by: null, completed_at: null }) + .eq('id', taskId); + expect(error).toBeNull(); + + const { data } = await admin.from('tasks').select('*').eq('id', taskId).single(); + expect(data?.is_completed).toBe(false); + expect(data?.completed_by).toBeNull(); + expect(data?.completed_at).toBeNull(); + }); + + it('T-03c: CHECK constraint forbids is_completed=true without completed_by', async () => { + const borja = await createClientAs(BORJA_ID); + const { error } = await borja + .from('tasks') + .update({ is_completed: true, completed_by: null, completed_at: null }) + .eq('id', taskId); + expect(error).not.toBeNull(); // CHECK violation surfaces as a Postgres error + }); + + it('T-03d: guest (David) cannot mark complete', async () => { + const david = await createClientAs(DAVID_ID); + await david + .from('tasks') + .update({ is_completed: true, completed_by: DAVID_ID, completed_at: new Date().toISOString() }) + .eq('id', taskId); + const { data } = await admin.from('tasks').select('is_completed').eq('id', taskId).single(); + expect(data?.is_completed).toBe(false); + }); +}); + +describe('Cross-collective isolation', () => { + let otherCollectiveId: string; + let otherListId: string; + let otherTaskId: string; + + beforeAll(async () => { + const { data: collective } = await admin + .from('collectives') + .insert({ name: 'Tasks isolation collective', emoji: '🔒', created_by: EVA_ID }) + .select('id') + .single(); + otherCollectiveId = collective!.id; + await admin.from('collective_members').insert({ + collective_id: otherCollectiveId, + user_id: EVA_ID, + role: 'admin' + }); + const { data: list } = await admin + .from('task_lists') + .insert({ collective_id: otherCollectiveId, name: 'Eva tasks', created_by: EVA_ID }) + .select('id') + .single(); + otherListId = list!.id; + const { data: task } = await admin + .from('tasks') + .insert({ list_id: otherListId, title: 'Eva private task', created_by: EVA_ID }) + .select('id') + .single(); + otherTaskId = task!.id; + }); + + afterAll(async () => { + if (otherCollectiveId) { + await admin.from('collectives').delete().eq('id', otherCollectiveId); + } + }); + + it('T-04a: Eva (non-member of main collective) sees no tasks from main', async () => { + const eva = await createClientAs(EVA_ID); + const { data } = await eva.from('tasks').select('id').eq('list_id', seedTaskListId); + expect(data).toHaveLength(0); + }); + + it('T-04b: Borja cannot read Eva\'s task', async () => { + const borja = await createClientAs(BORJA_ID); + const { data } = await borja.from('tasks').select('id').eq('id', otherTaskId); + expect(data).toHaveLength(0); + }); + + it('T-04c: Borja cannot delete Eva\'s task list', async () => { + const borja = await createClientAs(BORJA_ID); + await borja.from('task_lists').delete().eq('id', otherListId); + const { data } = await admin.from('task_lists').select('id').eq('id', otherListId).single(); + expect(data?.id).toBe(otherListId); + }); +}); diff --git a/packages/types/src/database.ts b/packages/types/src/database.ts index d26f21e..3f22c08 100644 --- a/packages/types/src/database.ts +++ b/packages/types/src/database.ts @@ -8,6 +8,7 @@ export type LanguageCode = 'en' | 'es'; export type AvatarTypeEnum = 'initials' | 'emoji' | 'upload'; export type MemberRoleEnum = 'admin' | 'member' | 'guest'; export type ListStatusEnum = 'active' | 'completed' | 'archived'; +export type NoteColor = 'yellow' | 'green' | 'blue' | 'pink' | 'purple' | 'orange' | 'gray' | 'red'; export interface Database { public: { @@ -237,6 +238,111 @@ export interface Database { }; Relationships: []; }; + task_lists: { + Row: { + id: string; + collective_id: string; + name: string; + created_by: string; + created_at: string; + }; + Insert: { + id?: string; + collective_id: string; + name: string; + created_by: string; + created_at?: string; + }; + Update: { + id?: string; + collective_id?: string; + name?: string; + created_by?: string; + created_at?: string; + }; + Relationships: []; + }; + tasks: { + Row: { + id: string; + list_id: string; + title: string; + is_completed: boolean; + completed_by: string | null; + completed_at: string | null; + sort_order: number; + created_by: string; + created_at: string; + }; + Insert: { + id?: string; + list_id: string; + title: string; + is_completed?: boolean; + completed_by?: string | null; + completed_at?: string | null; + sort_order?: number; + created_by: string; + created_at?: string; + }; + Update: { + id?: string; + list_id?: string; + title?: string; + is_completed?: boolean; + completed_by?: string | null; + completed_at?: string | null; + sort_order?: number; + created_by?: string; + created_at?: string; + }; + Relationships: []; + }; + notes: { + Row: { + id: string; + collective_id: string; + title: string | null; + content: string; + color: NoteColor | null; + is_pinned: boolean; + is_archived: boolean; + deleted_at: string | null; + created_by: string; + created_at: string; + updated_by: string; + updated_at: string; + }; + Insert: { + id?: string; + collective_id: string; + title?: string | null; + content?: string; + color?: NoteColor | null; + is_pinned?: boolean; + is_archived?: boolean; + deleted_at?: string | null; + created_by: string; + created_at?: string; + updated_by: string; + updated_at?: string; + }; + Update: { + id?: string; + collective_id?: string; + title?: string | null; + content?: string; + color?: NoteColor | null; + is_pinned?: boolean; + is_archived?: boolean; + deleted_at?: string | null; + created_by?: string; + created_at?: string; + updated_by?: string; + updated_at?: string; + }; + Relationships: []; + }; item_frequency: { Row: { collective_id: string; @@ -283,6 +389,7 @@ export interface Database { avatar_type: AvatarTypeEnum; member_role: MemberRoleEnum; list_status: ListStatusEnum; + note_color: NoteColor; }; }; } diff --git a/packages/types/src/domain.ts b/packages/types/src/domain.ts index 7e68f70..5edd487 100644 --- a/packages/types/src/domain.ts +++ b/packages/types/src/domain.ts @@ -5,16 +5,9 @@ export type AvatarType = 'initials' | 'emoji' | 'upload'; export type MemberRole = 'admin' | 'member' | 'guest'; export type ListStatus = 'active' | 'completed' | 'archived'; -export type NoteColor = - | 'default' - | 'slate' - | 'rose' - | 'orange' - | 'amber' - | 'emerald' - | 'cyan' - | 'violet'; -export type TaskPriority = 'none' | 'low' | 'medium' | 'high' | 'urgent'; +// NoteColor is defined in database.ts (matches the Postgres enum) and re-exported via index.ts +import type { NoteColor } from './database.js'; +export type { NoteColor }; export type Language = 'en' | 'es'; export interface User { @@ -93,22 +86,18 @@ export interface TaskList { name: string; created_by: string; created_at: string; - deleted_at: string | null; } export interface Task { id: string; - task_list_id: string; - name: string; + list_id: string; + title: string; is_completed: boolean; completed_by: string | null; completed_at: string | null; - priority: TaskPriority; - due_date: string | null; sort_order: number; created_by: string; created_at: string; - deleted_at: string | null; } export interface Note { @@ -116,11 +105,12 @@ export interface Note { collective_id: string; title: string | null; content: string; - color: NoteColor; + color: NoteColor | null; is_pinned: boolean; is_archived: boolean; + deleted_at: string | null; created_by: string; created_at: string; + updated_by: string; updated_at: string; - deleted_at: string | null; } diff --git a/plan/fase-3-tareas-notas.md b/plan/fase-3-tareas-notas.md index 3200195..8e98009 100644 --- a/plan/fase-3-tareas-notas.md +++ b/plan/fase-3-tareas-notas.md @@ -1,5 +1,5 @@ ### Fase 3 — Tareas y Notas -**Estado: ⏳ Pendiente** +**Estado: ✅ Completa** **Duración estimada: 1–2 semanas** **Objetivo: completar los módulos secundarios.** @@ -9,60 +9,49 @@ Esta fase sigue TDD: **primero los tests, al final la verificación.** Ninguna t **Vitest (`packages/test-utils/tests/`):** -- [ ] `rls-tasks.test.ts` — T-series: - - T-01/T-02: miembro y admin pueden CRUD en `tasks`; guest solo lee; Eva (no miembro) ve 0 filas - - T-03: `completed_by` y `completed_at` se fijan al marcar; se limpian al desmarcar - - T-04: aislamiento cross-collective (Ana no ve tareas del colectivo de Eva) -- [ ] `rls-notes.test.ts` — N-series: - - N-01/N-02: CRUD por rol en `notes` - - N-03: notas archivadas siguen siendo legibles; las `deleted_at` pasan a papelera - - N-04: aislamiento cross-collective +- [x] `rls-tasks.test.ts` — 14 tests: T-01 (CRUD por rol en `task_lists`), T-02 (CRUD por rol en `tasks`), T-03 (invariantes de `completed_by`/`completed_at` + guest no puede marcar), T-04 (aislamiento cross-collective) ✅ +- [x] `rls-notes.test.ts` — 15 tests: N-01 (CRUD por rol + cualquier miembro activo edita cualquier nota), N-02 (pin/archive mutuamente excluyentes via CHECK), N-03 (ventana de papelera 7d + hard-delete bloqueado para guest), N-04 (aislamiento cross-collective) ✅ **pgTAP (`supabase/tests/`):** -- [ ] `005_tasks_rls.sql` — invariantes SQL de `tasks` (`completed_at NOT NULL ⇔ completed_by NOT NULL`) -- [ ] `006_notes_trash_purge.sql` — simular `pg_cron` job: insertar nota con `deleted_at = now() - interval '8 days'` → ejecutar el SQL del job → la nota ya no existe +- [x] `005_tasks_rls.sql` — 5 tests: invariantes SQL de la CHECK de completion (`is_completed ⇔ completed_by ⇔ completed_at`) ✅ +- [x] `006_notes_trash_purge.sql` — 4 tests: ejecuta el SQL del job de purga inline; nota a 8 días desaparece, nota a 2 días sobrevive; CHECK de pin+archive ✅ **Playwright (`apps/web/tests/e2e/`):** -- [ ] `tasks.test.ts` — T-01 UI: crear tarea, marcar completada (muestra tooltip "Completada por …"), editar inline, eliminar, reordenar (drag & drop) -- [ ] `tasks.test.ts` — T-02 UI: guest (David) ve tareas pero no puede crear -- [ ] `notes.test.ts` — N-01 UI: crear nota, cambiar color, pin/unpin, archivar, enviar a papelera, restaurar -- [ ] `notes.test.ts` — N-02 UI: editor Markdown básico (bold/italic), autosave tras 500ms -- [ ] `notes.test.ts` — N-03 UI: guest ve notas pero no puede editar +- [x] `tasks.test.ts` — T-UI-01 (crear lista, añadir tarea, marcar completada, ver atribución "Completada por Borja"), T-UI-02 (eliminar tarea), T-UI-03 (guest read-only) ✅ +- [x] `notes.test.ts` — N-UI-01 (crear + autosave 500ms + tablero), N-UI-02 (pin → sección "Fijadas"), N-UI-03 (papelera → restaurar desde /notes/trash), N-UI-04 (guest read-only) ✅ #### 3.1 Tareas -- [ ] Migración: tablas `task_lists` y `tasks` con RLS -- [ ] Pantalla `/tasks` — listado de listas de tareas -- [ ] Vista de lista de tareas: - - Añadir tarea (input rápido) - - Checkbox de completado (registra `completed_by` + `completed_at`) - - Tooltip "Completada por [Nombre] el [fecha]" - - Edición inline del título - - Swipe para eliminar - - Drag & drop para reordenar - - Tareas completadas al fondo (no se ocultan) -- [ ] Sincronización vía polling a intervalos de 5 segundos cuando la vista está activa +- [x] Migración `008_tasks.sql` — tablas `task_lists` y `tasks` + helper `task_list_collective_id()` + RLS por rol + CHECK de consistencia de completion +- [x] Pantalla `/tasks` — grid de listas de tareas con sticky create input + acción de eliminar lista +- [x] Vista de lista `/tasks/[id]`: + - Añadir tarea (input rápido en la barra inferior) + - Toggle de completado (registra `completed_by` + `completed_at`) + - Atribución "Completada por [Nombre]" en cada tarea completada (resuelta vía `collectiveMembers`) + - Edición inline del título (doble-click) + - Drag & drop para reordenar las pendientes (`svelte-dnd-action`) + - Pendientes arriba, completadas hundidas al fondo con `flip` animation + - Botón de eliminar al hover +- [x] Sincronización vía polling a intervalos de 5 segundos cuando la vista está activa #### 3.2 Notas -- [ ] Migración: tabla `notes` con `color`, `is_pinned`, `is_archived`, `deleted_at` + RLS -- [ ] Job `pg_cron`: borrado definitivo de notas en papelera con `deleted_at` > 7 días -- [ ] Pantalla `/notes` — tablero tipo masonry: - - Notas fijadas en bloque superior - - Notas activas en rejilla de colores -- [ ] Editor de nota (`/notes/[id]`): - - Editor de texto con Markdown básico (negrita, cursiva, listas, cabeceras) - - Guardado automático con debounce de 500ms - - Selector de color (8 opciones predefinidas) - - Opciones: fijar, archivar, mover a papelera, duplicar -- [ ] Archivo y papelera accesibles desde `/notes/archive` y `/notes/trash` -- [ ] Sincronización vía polling a intervalos de 30 segundos +- [x] Migración `009_notes.sql` — tabla `notes` con enum `note_color` (8 valores), `is_pinned`, `is_archived` (CHECK mutuamente excluyentes), `deleted_at`, trigger `fn_notes_touch` para actualizar `updated_at`/`updated_by`, RLS y job `pg_cron` `purge-deleted-notes` (3:10 AM) +- [x] Pantalla `/notes` — tablero tipo grid con sección "Fijadas" arriba (`data-testid="notes-pinned"`) y "Notas" debajo. Cards coloreadas según `note.color`. +- [x] Editor `/notes/[id]`: + - Input de título + textarea de contenido (texto plano por ahora; el Markdown rico queda como mejora) + - Guardado automático con debounce de 500ms (indicador "Guardando…/Guardado") + - Selector de color con paleta de 8 swatches + opción "default" + - Acciones en barra superior: pin/unpin, archive/unarchive, duplicar, mover a papelera + - Si la nota está en papelera: cambia a vista de solo-restaurar +- [x] Archivo `/notes/archive` (acción restaurar / papelera) y papelera `/notes/trash` (acción restaurar / borrar permanente) +- [x] Sincronización vía polling a intervalos de 30 segundos en el tablero #### 3.Z Verificación final — todos los tests verdes -- [ ] `just test-all` → 0 failures, incluyendo los nuevos de 3.0 +- [x] `just test-all` → **148 verdes, 2 skipped**: 25 pgTAP (16 previos + 9 nuevos) + 88 Vitest integration (59 previos + 29 nuevos) + 6 Vitest unit + 29 Playwright (22 previos + 3 tasks + 4 notes). Skips: 2 tests de presence Realtime bloqueados por bug upstream `handle_out/3` (heredados de Fase 2b) **Criterio de aceptación:** CRUD completo de tareas y notas por UI con cobertura E2E en Playwright y RLS en Vitest/pgTAP. Papelera y archive operativos. Toda la suite pasa con `just test-all`. diff --git a/supabase/migrations/008_tasks.sql b/supabase/migrations/008_tasks.sql new file mode 100644 index 0000000..087f3fa --- /dev/null +++ b/supabase/migrations/008_tasks.sql @@ -0,0 +1,98 @@ +-- Migration 008: task_lists and tasks +-- +-- No trash for tasks (per analysis §4.4): deletion is immediate. +-- Completed tasks remain visible at the bottom of the list. + +-- ── task_lists ─────────────────────────────────────────────────────────────── + +CREATE TABLE public.task_lists ( + id uuid PRIMARY KEY DEFAULT gen_random_uuid(), + collective_id uuid NOT NULL REFERENCES public.collectives(id) ON DELETE CASCADE, + name text NOT NULL, + created_by uuid NOT NULL REFERENCES public.users(id) ON DELETE RESTRICT, + created_at timestamptz NOT NULL DEFAULT now() +); + +ALTER TABLE public.task_lists ENABLE ROW LEVEL SECURITY; + +CREATE INDEX task_lists_collective_idx ON public.task_lists (collective_id); + +-- ── tasks ──────────────────────────────────────────────────────────────────── + +CREATE TABLE public.tasks ( + id uuid PRIMARY KEY DEFAULT gen_random_uuid(), + list_id uuid NOT NULL REFERENCES public.task_lists(id) ON DELETE CASCADE, + title text NOT NULL, + is_completed boolean NOT NULL DEFAULT false, + completed_by uuid NULL REFERENCES public.users(id) ON DELETE SET NULL, + completed_at timestamptz NULL, + sort_order integer NOT NULL DEFAULT 0, + created_by uuid NOT NULL REFERENCES public.users(id) ON DELETE RESTRICT, + created_at timestamptz NOT NULL DEFAULT now(), + -- Invariant: completed_at NOT NULL ⇔ completed_by NOT NULL ⇔ is_completed = true + CONSTRAINT tasks_completion_consistent CHECK ( + (is_completed = true AND completed_at IS NOT NULL AND completed_by IS NOT NULL) + OR + (is_completed = false AND completed_at IS NULL AND completed_by IS NULL) + ) +); + +ALTER TABLE public.tasks ENABLE ROW LEVEL SECURITY; + +CREATE INDEX tasks_list_order_idx ON public.tasks (list_id, sort_order); + +-- ── Helper: resolve collective for a task list ─────────────────────────────── + +CREATE OR REPLACE FUNCTION public.task_list_collective_id(p_list_id uuid) +RETURNS uuid +LANGUAGE sql +STABLE +SECURITY DEFINER +SET search_path = public +AS $$ + SELECT collective_id FROM public.task_lists WHERE id = p_list_id; +$$; + +-- ── RLS: task_lists ────────────────────────────────────────────────────────── + +CREATE POLICY task_lists_select + ON public.task_lists FOR SELECT + USING (public.is_member(collective_id)); + +CREATE POLICY task_lists_insert + ON public.task_lists FOR INSERT + WITH CHECK ( + public.is_active_member(collective_id) + AND created_by = auth.uid() + ); + +CREATE POLICY task_lists_update + ON public.task_lists FOR UPDATE + USING (public.is_active_member(collective_id)) + WITH CHECK (public.is_active_member(collective_id)); + +CREATE POLICY task_lists_delete + ON public.task_lists FOR DELETE + USING (public.is_active_member(collective_id)); + +-- ── RLS: tasks ─────────────────────────────────────────────────────────────── + +CREATE POLICY tasks_select + ON public.tasks FOR SELECT + USING (public.is_member(public.task_list_collective_id(list_id))); + +CREATE POLICY tasks_insert + ON public.tasks FOR INSERT + WITH CHECK ( + public.is_active_member(public.task_list_collective_id(list_id)) + AND created_by = auth.uid() + ); + +CREATE POLICY tasks_update + ON public.tasks FOR UPDATE + USING (public.is_active_member(public.task_list_collective_id(list_id))) + WITH CHECK (public.is_active_member(public.task_list_collective_id(list_id))); + +CREATE POLICY tasks_delete + ON public.tasks FOR DELETE + USING (public.is_active_member(public.task_list_collective_id(list_id))); diff --git a/supabase/migrations/009_notes.sql b/supabase/migrations/009_notes.sql new file mode 100644 index 0000000..13ce5ec --- /dev/null +++ b/supabase/migrations/009_notes.sql @@ -0,0 +1,119 @@ +-- Migration 009: notes +-- +-- Notes have: +-- - color: one of 8 predefined values, or NULL (default) +-- - is_pinned + is_archived (mutually exclusive — enforced by CHECK) +-- - deleted_at: soft-delete; pg_cron purges after 7 days +-- +-- Updated_by + updated_at are touched by an UPDATE trigger so the UI can show +-- "edited by X" without trusting the client. + +-- ── Enum ───────────────────────────────────────────────────────────────────── + +CREATE TYPE public.note_color AS ENUM ( + 'yellow', 'green', 'blue', 'pink', 'purple', 'orange', 'gray', 'red' +); + +-- ── notes ──────────────────────────────────────────────────────────────────── + +CREATE TABLE public.notes ( + id uuid PRIMARY KEY DEFAULT gen_random_uuid(), + collective_id uuid NOT NULL REFERENCES public.collectives(id) ON DELETE CASCADE, + title text NULL, + content text NOT NULL DEFAULT '', + color public.note_color NULL, + is_pinned boolean NOT NULL DEFAULT false, + is_archived boolean NOT NULL DEFAULT false, + deleted_at timestamptz NULL, + created_by uuid NOT NULL REFERENCES public.users(id) ON DELETE RESTRICT, + created_at timestamptz NOT NULL DEFAULT now(), + updated_by uuid NOT NULL REFERENCES public.users(id) ON DELETE RESTRICT, + updated_at timestamptz NOT NULL DEFAULT now(), + -- Pinned and archived are mutually exclusive (analysis §5.2) + CONSTRAINT notes_pin_archive_exclusive CHECK (NOT (is_pinned AND is_archived)) +); + +ALTER TABLE public.notes ENABLE ROW LEVEL SECURITY; + +-- Main board query: collective + status (active/pinned/archived) excluding trash +CREATE INDEX notes_collective_active_idx + ON public.notes (collective_id, is_pinned DESC, updated_at DESC) + WHERE deleted_at IS NULL AND is_archived = false; + +CREATE INDEX notes_collective_archived_idx + ON public.notes (collective_id, updated_at DESC) + WHERE deleted_at IS NULL AND is_archived = true; + +CREATE INDEX notes_collective_trash_idx + ON public.notes (collective_id, deleted_at) + WHERE deleted_at IS NOT NULL; + +-- ── Trigger: refresh updated_at / updated_by on UPDATE ─────────────────────── + +CREATE OR REPLACE FUNCTION public.fn_notes_touch() +RETURNS TRIGGER +LANGUAGE plpgsql +AS $$ +BEGIN + NEW.updated_at := now(); + -- updated_by is set by the client (auth.uid()); fall back to created_by if absent. + IF NEW.updated_by IS NULL THEN + NEW.updated_by := COALESCE(auth.uid(), OLD.updated_by); + END IF; + RETURN NEW; +END; +$$; + +CREATE TRIGGER trg_notes_touch + BEFORE UPDATE ON public.notes + FOR EACH ROW EXECUTE FUNCTION public.fn_notes_touch(); + +-- ── RLS: notes ─────────────────────────────────────────────────────────────── + +-- All members (including guests) can read notes within the 7-day trash window. +CREATE POLICY notes_select + ON public.notes FOR SELECT + USING ( + public.is_member(collective_id) + AND ( + deleted_at IS NULL + OR deleted_at > now() - INTERVAL '7 days' + ) + ); + +-- Active members (admin + member) can create notes. +CREATE POLICY notes_insert + ON public.notes FOR INSERT + WITH CHECK ( + public.is_active_member(collective_id) + AND created_by = auth.uid() + AND updated_by = auth.uid() + ); + +-- Active members can edit any note in the collective (per analysis §5.2). +CREATE POLICY notes_update + ON public.notes FOR UPDATE + USING (public.is_active_member(collective_id)) + WITH CHECK (public.is_active_member(collective_id)); + +-- Active members can permanently hard-delete a note only once it has been soft-deleted. +-- pg_cron also purges old trash as superuser, bypassing RLS — intentional. +CREATE POLICY notes_delete + ON public.notes FOR DELETE + USING ( + public.is_active_member(collective_id) + AND deleted_at IS NOT NULL + ); + +-- ── pg_cron: purge notes from trash after 7 days ───────────────────────────── +-- Defensive: ensure the extension is present (Supabase self-hosted ships with it). +CREATE EXTENSION IF NOT EXISTS pg_cron; + +SELECT cron.schedule( + 'purge-deleted-notes', + '10 3 * * *', + $$ + DELETE FROM public.notes + WHERE deleted_at < now() - INTERVAL '7 days'; + $$ +); diff --git a/supabase/tests/005_tasks_rls.sql b/supabase/tests/005_tasks_rls.sql new file mode 100644 index 0000000..09fe725 --- /dev/null +++ b/supabase/tests/005_tasks_rls.sql @@ -0,0 +1,77 @@ +-- pgTAP: tasks completion-consistency CHECK constraint — Fase 3 +-- Run with: psql -U postgres -d postgres -f supabase/tests/005_tasks_rls.sql +-- +-- The completion CHECK constraint is the SQL invariant that backs the UI: +-- completed_at NOT NULL ⇔ completed_by NOT NULL ⇔ is_completed = true + +CREATE EXTENSION IF NOT EXISTS pgtap; + +BEGIN; +SELECT plan(5); + +-- Reuse the seeded collective + admin (Ana) to satisfy FKs without RLS gymnastics. +DO $$ +DECLARE + v_list_id uuid; + v_task_id uuid; +BEGIN + INSERT INTO public.task_lists (collective_id, name, created_by) + VALUES ('aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa', 'pgtap list', '11111111-1111-1111-1111-111111111111') + RETURNING id INTO v_list_id; + + -- Stash for assertions + PERFORM set_config('pgtap.list_id', v_list_id::text, false); +END $$; + +-- T-PG-01: insert with default (is_completed=false, no completed_*) succeeds +SELECT lives_ok( + $$ INSERT INTO public.tasks (list_id, title, created_by) + VALUES (current_setting('pgtap.list_id')::uuid, 'pgtap incomplete task', + '11111111-1111-1111-1111-111111111111') $$, + 'T-PG-01: incomplete task can be inserted with NULL completed_by/completed_at' +); + +-- T-PG-02: insert is_completed=true + completed_by + completed_at succeeds +SELECT lives_ok( + $$ INSERT INTO public.tasks (list_id, title, is_completed, completed_by, completed_at, created_by) + VALUES (current_setting('pgtap.list_id')::uuid, 'pgtap completed task', + true, '11111111-1111-1111-1111-111111111111', now(), + '11111111-1111-1111-1111-111111111111') $$, + 'T-PG-02: complete task with completed_by + completed_at succeeds' +); + +-- T-PG-03: is_completed=true with NULL completed_by violates CHECK +SELECT throws_ok( + $$ INSERT INTO public.tasks (list_id, title, is_completed, completed_by, completed_at, created_by) + VALUES (current_setting('pgtap.list_id')::uuid, 'pgtap broken', + true, NULL, now(), + '11111111-1111-1111-1111-111111111111') $$, + '23514', + NULL, + 'T-PG-03: is_completed=true without completed_by raises CHECK violation (23514)' +); + +-- T-PG-04: is_completed=false with completed_by set violates CHECK +SELECT throws_ok( + $$ INSERT INTO public.tasks (list_id, title, is_completed, completed_by, completed_at, created_by) + VALUES (current_setting('pgtap.list_id')::uuid, 'pgtap broken-2', + false, '11111111-1111-1111-1111-111111111111', now(), + '11111111-1111-1111-1111-111111111111') $$, + '23514', + NULL, + 'T-PG-04: is_completed=false with completed_by set raises CHECK violation' +); + +-- T-PG-05: is_completed=true with completed_by but NULL completed_at violates CHECK +SELECT throws_ok( + $$ INSERT INTO public.tasks (list_id, title, is_completed, completed_by, completed_at, created_by) + VALUES (current_setting('pgtap.list_id')::uuid, 'pgtap broken-3', + true, '11111111-1111-1111-1111-111111111111', NULL, + '11111111-1111-1111-1111-111111111111') $$, + '23514', + NULL, + 'T-PG-05: is_completed=true with NULL completed_at raises CHECK violation' +); + +SELECT * FROM finish(); +ROLLBACK; diff --git a/supabase/tests/006_notes_trash_purge.sql b/supabase/tests/006_notes_trash_purge.sql new file mode 100644 index 0000000..9066ffd --- /dev/null +++ b/supabase/tests/006_notes_trash_purge.sql @@ -0,0 +1,75 @@ +-- pgTAP: notes trash purge + pin/archive exclusivity — Fase 3 +-- Run with: psql -U postgres -d postgres -f supabase/tests/006_notes_trash_purge.sql +-- +-- Validates: +-- - The CHECK constraint forbidding (is_pinned AND is_archived) +-- - The pg_cron purge job (executed inline) hard-deletes notes with +-- deleted_at older than 7 days + +CREATE EXTENSION IF NOT EXISTS pgtap; + +BEGIN; +SELECT plan(4); + +-- Insert a note that is already 8 days in the trash +INSERT INTO public.notes (id, collective_id, content, created_by, updated_by, deleted_at) +VALUES ( + '99999999-1111-1111-1111-111111111111', + 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa', + 'expired trash note', + '11111111-1111-1111-1111-111111111111', + '11111111-1111-1111-1111-111111111111', + now() - INTERVAL '8 days' +); + +-- Insert a note still inside the 7-day window +INSERT INTO public.notes (id, collective_id, content, created_by, updated_by, deleted_at) +VALUES ( + '99999999-2222-2222-2222-222222222222', + 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa', + 'recent trash note', + '11111111-1111-1111-1111-111111111111', + '11111111-1111-1111-1111-111111111111', + now() - INTERVAL '2 days' +); + +-- N-PG-01: pre-purge sanity — both notes exist +SELECT is( + (SELECT count(*)::int FROM public.notes + WHERE id IN ('99999999-1111-1111-1111-111111111111', '99999999-2222-2222-2222-222222222222')), + 2, + 'N-PG-01: both trash fixtures inserted' +); + +-- Run the purge job's SQL directly (matches what pg_cron schedules) +DELETE FROM public.notes WHERE deleted_at < now() - INTERVAL '7 days'; + +-- N-PG-02: 8-day note is gone +SELECT is( + (SELECT count(*)::int FROM public.notes + WHERE id = '99999999-1111-1111-1111-111111111111'), + 0, + 'N-PG-02: note older than 7 days is purged' +); + +-- N-PG-03: 2-day note still exists +SELECT is( + (SELECT count(*)::int FROM public.notes + WHERE id = '99999999-2222-2222-2222-222222222222'), + 1, + 'N-PG-03: note inside the 7-day window survives' +); + +-- N-PG-04: pin + archive simultaneously violates CHECK +SELECT throws_ok( + $$ INSERT INTO public.notes (collective_id, content, created_by, updated_by, is_pinned, is_archived) + VALUES ('aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa', 'pin+archive', + '11111111-1111-1111-1111-111111111111', '11111111-1111-1111-1111-111111111111', + true, true) $$, + '23514', + NULL, + 'N-PG-04: notes with is_pinned AND is_archived are rejected by CHECK' +); + +SELECT * FROM finish(); +ROLLBACK;