feat(webhook): ensure webhook source badge displays for triage thoughts and tasks

internal/api/server_test.go

@@ -747,3 +747,94 @@ func TestWorkspaceTagsAPI(t *testing.T) {
 		t.Fatalf("expected 200 OK from DELETE /api/v1/folders, got %d", rec.Code)
 	}
 }
+
+func TestWebhookTriageBadgeAndIngestion(t *testing.T) {
+	dbPath := filepath.Join(t.TempDir(), "test_webhook.db")
+	store, err := storage.NewStore(dbPath)
+	if err != nil {
+		t.Fatalf("failed to init store: %v", err)
+	}
+	defer store.Close()
+
+	cfg := &config.Config{
+		JWTSecret:         "test-jwt-secret-key",
+		AllowRegistration: false,
+	}
+	srv := NewServer(cfg, store, ws.NewHub(), nil)
+	router := srv.Router()
+
+	// 1. Setup user
+	setupBody := []byte(`{
+		"email": "smarthome_owner@example.com",
+		"password": "secretpassword",
+		"displayName": "Home User",
+		"instanceName": "MindSift Home",
+		"allowRegistration": false,
+		"seedSampleData": false
+	}`)
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/auth/setup", bytes.NewReader(setupBody))
+	req.Header.Set("Content-Type", "application/json")
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+	if rec.Code != http.StatusCreated {
+		t.Fatalf("setup failed: %s", rec.Body.String())
+	}
+	var authResp struct {
+		Token string       `json:"token"`
+		User  *domain.User `json:"user"`
+	}
+	_ = json.Unmarshal(rec.Body.Bytes(), &authResp)
+
+	// 2. Create API key for user
+	apiKey, err := store.CreateAPIKey(authResp.User.ID, "Home Assistant Webhook")
+	if err != nil || apiKey == nil || apiKey.RawKey == "" {
+		t.Fatalf("failed to create API key: %v", err)
+	}
+	plainKey := apiKey.RawKey
+
+	// 3. Post to /api/v1/inbox using X-API-Key without passing "source"
+	inboxBody := []byte(`{
+		"content": "Kellerfeuchtigkeit über 68% gestiegen – Entfeuchter prüfen #smarthome #alarm",
+		"priority": "urgent"
+	}`)
+	req = httptest.NewRequest(http.MethodPost, "/api/v1/inbox", bytes.NewReader(inboxBody))
+	req.Header.Set("X-API-Key", plainKey)
+	req.Header.Set("Content-Type", "application/json")
+	rec = httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusCreated {
+		t.Fatalf("expected 201 Created from /api/v1/inbox with API key, got %d: %s", rec.Code, rec.Body.String())
+	}
+	var createdThought domain.Thought
+	_ = json.Unmarshal(rec.Body.Bytes(), &createdThought)
+	if createdThought.Source != "webhook" {
+		t.Fatalf("expected created thought to have source='webhook' when called with API key, got '%s'", createdThought.Source)
+	}
+
+	// 4. Post to /api/v1/webhooks/ingest using ?token=... with message alias
+	webhookBody := []byte(`{
+		"message": "Waschmaschine im Keller fertig",
+		"priority": "high",
+		"tags": ["automation"]
+	}`)
+	req = httptest.NewRequest(http.MethodPost, "/api/v1/webhooks/ingest?token="+plainKey, bytes.NewReader(webhookBody))
+	req.Header.Set("Content-Type", "application/json")
+	rec = httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusCreated {
+		t.Fatalf("expected 201 Created from /api/v1/webhooks/ingest, got %d: %s", rec.Code, rec.Body.String())
+	}
+	var ingestResp struct {
+		Status  string         `json:"status"`
+		Thought domain.Thought `json:"thought"`
+	}
+	_ = json.Unmarshal(rec.Body.Bytes(), &ingestResp)
+	if ingestResp.Thought.Source != "webhook" {
+		t.Fatalf("expected ingested webhook thought to have source='webhook', got '%s'", ingestResp.Thought.Source)
+	}
+	if !strings.Contains(ingestResp.Thought.Content, "Waschmaschine") {
+		t.Fatalf("expected thought content to contain 'Waschmaschine', got '%s'", ingestResp.Thought.Content)
+	}
+}