presseportale/tests/Feature/Api/V1/PressReleaseSubmitApiTest.php

<?php

use App\Enums\Portal;
use App\Enums\PressReleaseStatus;
use App\Models\Category;
use App\Models\Company;
use App\Models\LegacyInvoice;
use App\Models\Plan;
use App\Models\PressRelease;
use App\Models\PressReleaseStatusLog;
use App\Models\User;
use Illuminate\Support\Facades\Queue;
use Laravel\Sanctum\Sanctum;
use Tests\TestCase;

test('api create always produces a draft and ignores any status input', function () {
    /** @var TestCase $this */
    $user = User::factory()->create();
    $company = Company::factory()->presseecho()->create();
    $category = Category::factory()->withTranslations()->create(['portal' => Portal::Both]);
    $user->companies()->attach($company->id, ['role' => 'owner']);

    apiActingAs($user, ['press-releases:write']);

    $this->postJson('/api/v1/press-releases', [
        'company_id' => $company->id,
        'category_id' => $category->id,
        'language' => 'de',
        'title' => 'API Entwurf',
        'text' => 'Inhalt',
        'status' => 'review', // soll ignoriert werden
    ])
        ->assertCreated()
        ->assertJsonPath('data.status', PressReleaseStatus::Draft->value);
});

test('api submit route raises a draft to review without consuming quota and writes a log', function () {
    /** @var TestCase $this */
    Queue::fake(); // Klassifikations-Routing separat getestet; hier nur der Submit-Übergang.

    $user = User::factory()->create(['press_release_quota_used_this_month' => 0]);
    $pressRelease = PressRelease::factory()->create([
        'user_id' => $user->id,
        'status' => PressReleaseStatus::Draft->value,
        'title' => 'Saubere Pressemitteilung',
        'text' => 'Vollkommen unauffälliger Inhalt.',
    ]);

    apiActingAs($user, ['press-releases:write']);

    $this->postJson("/api/v1/press-releases/{$pressRelease->id}/submit", ['ai_text_declaration' => 'none'])
        ->assertOk()
        ->assertJsonPath('data.status', PressReleaseStatus::Review->value);

    expect($pressRelease->fresh()->status)->toBe(PressReleaseStatus::Review);
    // Slot-Verbrauch erst bei Veröffentlichung (Decision-Update §3.2).
    expect($user->fresh()->press_release_quota_used_this_month)->toBe(0);
    expect(PressReleaseStatusLog::where('press_release_id', $pressRelease->id)
        ->where('to_status', PressReleaseStatus::Review->value)
        ->exists())->toBeTrue();
});

test('api submit responds 402 when the booking gate is enforced', function () {
    /** @var TestCase $this */
    config()->set('billing.enforce_booking', true);

    // API-Zugang ohne Buchung: Altkunde mit bezahlter letzter Legacy-Rechnung
    // (ApiAccessEligibilityService), aber ohne Abo/Zahlungsoption.
    $user = User::factory()->create();
    LegacyInvoice::query()->create([
        'legacy_portal' => 'presseecho',
        'legacy_id' => 8101,
        'user_id' => $user->id,
        'legacy_user_id' => 8101,
        'number' => 'PE-8101',
        'amount_cents' => 9900,
        'total_cents' => 9900,
        'status' => 'paid',
        'invoice_date' => now()->subYear(),
        'imported_at' => now(),
    ]);
    $pressRelease = PressRelease::factory()->create([
        'user_id' => $user->id,
        'status' => PressReleaseStatus::Draft->value,
        'title' => 'Saubere Pressemitteilung',
        'text' => 'Inhalt',
    ]);

    Sanctum::actingAs($user, ['press-releases:write']);

    $this->postJson("/api/v1/press-releases/{$pressRelease->id}/submit", ['ai_text_declaration' => 'none'])
        ->assertStatus(402);

    expect($pressRelease->fresh()->status)->toBe(PressReleaseStatus::Draft);
});

test('api submit responds 422 when the monthly quota is exhausted', function () {
    /** @var TestCase $this */
    config()->set('billing.enforce_booking', true);

    $user = User::factory()->create([
        'press_release_quota_used_this_month' => 3,
    ]);
    $plan = Plan::factory()->create([
        'press_release_quota' => 3,
        'stripe_price_id_monthly' => 'price_test_m_submit',
    ]);
    subscribeUserToPlan($user, $plan);
    $pressRelease = PressRelease::factory()->create([
        'user_id' => $user->id,
        'status' => PressReleaseStatus::Draft->value,
        'title' => 'Saubere Pressemitteilung',
        'text' => 'Inhalt',
    ]);

    // Das Abo gewährt den API-Zugang; eine zusätzliche Zahlungsoption
    // (apiActingAs) würde das Kontingent verfälschen.
    Sanctum::actingAs($user, ['press-releases:write']);

    $this->postJson("/api/v1/press-releases/{$pressRelease->id}/submit", ['ai_text_declaration' => 'none'])
        ->assertStatus(422);

    expect($pressRelease->fresh()->status)->toBe(PressReleaseStatus::Draft);
});

test('api submit auto-rejects a press release containing a banned word', function () {
    /** @var TestCase $this */
    config()->set('blacklist.words', ['penis']);

    $user = User::factory()->create();
    $pressRelease = PressRelease::factory()->create([
        'user_id' => $user->id,
        'status' => PressReleaseStatus::Draft->value,
        'title' => 'Unzulässiger Titel penis',
        'text' => 'Inhalt',
    ]);

    apiActingAs($user, ['press-releases:write']);

    $this->postJson("/api/v1/press-releases/{$pressRelease->id}/submit", ['ai_text_declaration' => 'none'])
        ->assertStatus(422);

    expect($pressRelease->fresh()->status)->toBe(PressReleaseStatus::Rejected);
});

test('api submit requires the write ability', function () {
    /** @var TestCase $this */
    $user = User::factory()->create();
    $pressRelease = PressRelease::factory()->create([
        'user_id' => $user->id,
        'status' => PressReleaseStatus::Draft->value,
    ]);

    apiActingAs($user, ['press-releases:read']);

    $this->postJson("/api/v1/press-releases/{$pressRelease->id}/submit", ['ai_text_declaration' => 'none'])
        ->assertForbidden();
});

test('api submit rejects a press release already in review', function () {
    /** @var TestCase $this */
    $user = User::factory()->create();
    $pressRelease = PressRelease::factory()->inReview()->create([
        'user_id' => $user->id,
    ]);

    apiActingAs($user, ['press-releases:write']);

    $this->postJson("/api/v1/press-releases/{$pressRelease->id}/submit", ['ai_text_declaration' => 'none'])
        ->assertStatus(409);
});

test('api user cannot submit another users press release', function () {
    /** @var TestCase $this */
    $owner = User::factory()->create();
    $otherUser = User::factory()->create();
    $pressRelease = PressRelease::factory()->create([
        'user_id' => $owner->id,
        'status' => PressReleaseStatus::Draft->value,
    ]);

    apiActingAs($otherUser, ['press-releases:write']);

    $this->postJson("/api/v1/press-releases/{$pressRelease->id}/submit", ['ai_text_declaration' => 'none'])
        ->assertForbidden();
});

test('api submit requires the ai text declaration (Art. 50 KI-VO)', function () {
    /** @var TestCase $this */
    Queue::fake();

    $user = User::factory()->create();
    $pressRelease = PressRelease::factory()->aiUndeclared()->create([
        'user_id' => $user->id,
        'status' => PressReleaseStatus::Draft->value,
    ]);

    apiActingAs($user, ['press-releases:write']);

    $this->postJson("/api/v1/press-releases/{$pressRelease->id}/submit")
        ->assertUnprocessable()
        ->assertInvalid(['ai_text_declaration']);

    $this->postJson("/api/v1/press-releases/{$pressRelease->id}/submit", ['ai_text_declaration' => 'erfunden'])
        ->assertUnprocessable()
        ->assertInvalid(['ai_text_declaration']);

    expect($pressRelease->fresh()->status)->toBe(PressReleaseStatus::Draft);
});

test('api submit records the declared ai grade as binding confirmation', function () {
    /** @var TestCase $this */
    Queue::fake();

    $user = User::factory()->create();
    $pressRelease = PressRelease::factory()->aiUndeclared()->create([
        'user_id' => $user->id,
        'status' => PressReleaseStatus::Draft->value,
        'title' => 'Saubere Pressemitteilung',
        'text' => 'Vollkommen unauffälliger Inhalt.',
    ]);

    apiActingAs($user, ['press-releases:write']);

    $this->postJson("/api/v1/press-releases/{$pressRelease->id}/submit", ['ai_text_declaration' => 'assisted'])
        ->assertOk()
        ->assertJsonPath('data.status', PressReleaseStatus::Review->value);

    $fresh = $pressRelease->fresh();
    expect($fresh->ai_text_declaration?->value)->toBe('assisted')
        ->and($fresh->ai_declaration_confirmed_at)->not->toBeNull()
        // Audit-Trail: der Submit protokolliert die Deklaration versioniert.
        ->and($fresh->aiDeclarations()->count())->toBe(1);
});

test('api routes respond 404 instead of 500 for non-numeric press release ids', function () {
    /** @var TestCase $this */
    $user = User::factory()->create();

    apiActingAs($user, ['press-releases:write']);

    // Vergessener Postman-Platzhalter wie „PM_ID" darf nicht als String in
    // die int-typisierten Controller-Parameter laufen (TypeError/500).
    $this->postJson('/api/v1/press-releases/PM_ID/submit', ['ai_text_declaration' => 'none'])
        ->assertNotFound();
    $this->getJson('/api/v1/press-releases/PM_ID')
        ->assertNotFound();
});