feat(collab): redesign note collaboration with REST auto-save, opt-in live session, and block locking

internal/api/server_test.go

@@ -1295,6 +1295,127 @@ func TestTokenBlacklistingAndTokenVersionRevocation(t *testing.T) {
 	}
 }
 
+func TestBlockLockingAndLiveSessionGuards(t *testing.T) {
+	srv, store, _ := setupTestServer(t)
+	router := srv.Router()
+
+	userA, _ := store.CreateUser("user_a_lock@example.com", "hash", "User A", "member")
+	tokenA, _ := auth.GenerateToken(srv.cfg.JWTSecret, userA.ID, userA.Email, userA.DisplayName, userA.TokenVersion)
+
+	userB, _ := store.CreateUser("user_b_lock@example.com", "hash", "User B", "member")
+	tokenB, _ := auth.GenerateToken(srv.cfg.JWTSecret, userB.ID, userB.Email, userB.DisplayName, userB.TokenVersion)
+
+	// Create document owned by User A, shared with User B
+	blocks := []domain.DocumentBlock{
+		{ID: "b1", Type: "bullet", Content: "Row 1", Level: 0},
+		{ID: "b2", Type: "bullet", Content: "Row 2", Level: 0},
+	}
+	doc, err := store.CreateDocument(userA.ID, "", "Lock Test Doc", "📝", "", blocks, nil, false)
+	if err != nil {
+		t.Fatalf("CreateDocument failed: %v", err)
+	}
+	_, _ = store.CreateDocShare(userA.ID, doc.ID, userB.ID, "write")
+
+	// 1. Initial locks should be empty
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/documents/"+doc.ID+"/locks", nil)
+	req.Header.Set("Authorization", "Bearer "+tokenA)
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("get locks failed: %d", rec.Code)
+	}
+	var locksResp domain.DocLocksResponse
+	_ = json.Unmarshal(rec.Body.Bytes(), &locksResp)
+	if len(locksResp.BlockLocks) != 0 || locksResp.LiveSession != nil {
+		t.Fatalf("expected 0 locks initially, got %v", locksResp)
+	}
+
+	// 2. User A locks block b1
+	req = httptest.NewRequest(http.MethodPost, "/api/v1/documents/"+doc.ID+"/blocks/b1/lock", bytes.NewReader([]byte(`{"ttlSeconds": 30}`)))
+	req.Header.Set("Authorization", "Bearer "+tokenA)
+	req.Header.Set("Content-Type", "application/json")
+	rec = httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("user A lock b1 failed: %d, body: %s", rec.Code, rec.Body.String())
+	}
+
+	// 3. User B tries to lock b1 -> must receive 409 Conflict
+	req = httptest.NewRequest(http.MethodPost, "/api/v1/documents/"+doc.ID+"/blocks/b1/lock", bytes.NewReader([]byte(`{"ttlSeconds": 30}`)))
+	req.Header.Set("Authorization", "Bearer "+tokenB)
+	req.Header.Set("Content-Type", "application/json")
+	rec = httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+	if rec.Code != http.StatusConflict {
+		t.Fatalf("expected 409 Conflict for user B on b1, got %d", rec.Code)
+	}
+
+	// 4. User A unlocks b1
+	req = httptest.NewRequest(http.MethodPost, "/api/v1/documents/"+doc.ID+"/blocks/b1/unlock", nil)
+	req.Header.Set("Authorization", "Bearer "+tokenA)
+	rec = httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("user A unlock b1 failed: %d", rec.Code)
+	}
+
+	// 5. User B can now lock b1
+	req = httptest.NewRequest(http.MethodPost, "/api/v1/documents/"+doc.ID+"/blocks/b1/lock", bytes.NewReader([]byte(`{"ttlSeconds": 30}`)))
+	req.Header.Set("Authorization", "Bearer "+tokenB)
+	rec = httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("user B lock b1 should succeed now, got %d", rec.Code)
+	}
+	// User B unlocks b1
+	req = httptest.NewRequest(http.MethodPost, "/api/v1/documents/"+doc.ID+"/blocks/b1/unlock", nil)
+	req.Header.Set("Authorization", "Bearer "+tokenB)
+	rec = httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	// 6. User A starts a Live-Session on doc
+	req = httptest.NewRequest(http.MethodPost, "/api/v1/documents/"+doc.ID+"/live/start", nil)
+	req.Header.Set("Authorization", "Bearer "+tokenA)
+	rec = httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("user A start live session failed: %d, body: %s", rec.Code, rec.Body.String())
+	}
+
+	// 7. User B tries to patch document blocks while User A's live session is active -> must receive 423 Locked!
+	patchBody, _ := json.Marshal(domain.DocBlocksPatchRequest{
+		Upserted: []domain.DocumentBlock{{ID: "b2", Content: "Hacked by User B"}},
+	})
+	req = httptest.NewRequest(http.MethodPatch, "/api/v1/documents/"+doc.ID+"/blocks", bytes.NewReader(patchBody))
+	req.Header.Set("Authorization", "Bearer "+tokenB)
+	req.Header.Set("Content-Type", "application/json")
+	rec = httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+	if rec.Code != http.StatusLocked {
+		t.Fatalf("expected 423 Locked for User B while live session is active, got %d, body: %s", rec.Code, rec.Body.String())
+	}
+
+	// 8. User A ends the Live-Session
+	req = httptest.NewRequest(http.MethodPost, "/api/v1/documents/"+doc.ID+"/live/end", nil)
+	req.Header.Set("Authorization", "Bearer "+tokenA)
+	rec = httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("user A end live session failed: %d", rec.Code)
+	}
+
+	// 9. User B can now edit again
+	req = httptest.NewRequest(http.MethodPatch, "/api/v1/documents/"+doc.ID+"/blocks", bytes.NewReader(patchBody))
+	req.Header.Set("Authorization", "Bearer "+tokenB)
+	req.Header.Set("Content-Type", "application/json")
+	rec = httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("User B edit should succeed after live session ended, got %d, body: %s", rec.Code, rec.Body.String())
+	}
+}
+
+