refac: authenticated user can edit an article's body; an unknown id returns 404

features/edit_article_body.qa.md

@@ -0,0 +1,58 @@
+# QA procedure: edit_article_body
+
+Package: `test` (black-box, extending `article_test.go`).
+
+## Setup shared by every case
+1. Call `validator.InitValidator()` once.
+2. Reuse `mockArticleRepo` (`test/article_test.go`) as-is; its `UpdateBody` already
+   supports everything this slice needs, no fake changes expected.
+3. Wire the real use cases over the fake: `useCases.NewCreateArticleUseCase`,
+   `useCases.NewGetArticleUseCase`, `useCases.NewListArticlesUseCase`,
+   `useCases.NewDeleteArticleUseCase`, `useCases.NewUpdateArticleUseCase`. Build
+   `article.NewHandler(...)` (existing signature, already takes the update use case),
+   exposing the new `UpdateArticleBody` method.
+4. Build a test `jwtauth.New("HS256", []byte("test-secret"), nil)`.
+5. Mount the routes on a fresh `chi.NewRouter()` mirroring `api/router.go`'s current
+   shape (per `article_publishing.qa.md`): `GET /` under `jwtauth.Verifier` only;
+   `GET /{id}`, `POST /`, `DELETE /{id}`, `PATCH /{id}/publish`,
+   `PATCH /{id}/unpublish` under `jwtauth.Verifier` + `jwtauth.Authenticator`. Add
+   `PATCH /{id}` to that same authenticated group.
+6. Mint a valid jwt cookie for user id 1: `token.Encode(map[string]any{"user_id": uint32(1)})`,
+   set as the `jwt` cookie on the relevant `httptest.NewRequest`.
+7. Seed the repo directly via the map pattern already used elsewhere, e.g.
+   `repo.articles[1] = article.Article{ID: 1, Title: "Backyard Renovation Update", Body: "Old body text", IsOnline: true}`
+   and `repo.articles[2] = article.Article{ID: 2, Title: "Draft: Kitchen Remodel", Body: "Draft notes", IsOnline: false}`.
+
+## HTTP checks
+8. `PATCH /v1/article/1` with the valid cookie and JSON body `{"body": "New body text"}`,
+   repo seeded per step 7 -> status `200`; decode the JSON response and assert
+   `id == 1`, `body == "New body text"`, `title == "Backyard Renovation Update"`,
+   `is_online == true`; assert `repo.articles[1].Body` is now `"New body text"` and
+   `repo.articles[1].Title`/`IsOnline` are unchanged.
+9. `PATCH /v1/article/2` with the valid cookie and JSON body
+   `{"body": "Revised draft notes"}`, repo seeded per step 7 -> status `200`; decode
+   the JSON response and assert `id == 2`, `body == "Revised draft notes"`,
+   `is_online == false`.
+10. `PATCH /v1/article/9999` with the valid cookie and a valid JSON body, empty repo
+    id `9999` -> status `404`, body `"Article not found\n"`.
+11. `PATCH /v1/article/not-a-number` with the valid cookie and a valid JSON body ->
+    status `400`, body matching `apperr.IdUint32ErrorMessage + "\n"`.
+12. `PATCH /v1/article/1` with the valid cookie and a malformed JSON body (e.g. raw
+    string `not-json`), repo seeded with article id 1 -> status `400`, body matching
+    `apperr.BodyErrorMessage + "\n"`.
+13. `PATCH /v1/article/1` with the valid cookie and JSON body `{"body": ""}`, repo
+    seeded with article id 1 -> status `400`; assert `repo.articles[1].Body` is
+    unchanged (nothing stored).
+14. `PATCH /v1/article/1` with the valid cookie and JSON body `{"body": "<10001-char
+    string>"}`, repo seeded with article id 1 -> status `400`; assert
+    `repo.articles[1].Body` is unchanged.
+15. `PATCH /v1/article/1` with **no** cookie, repo seeded with article id 1 -> status
+    `401`.
+
+## Manual verification (not exercised by the Go test)
+- SPA-visible behaviour: confirm the back-office article editor exposes a body-editing
+  control that calls `PATCH /v1/article/{id}` and reflects the updated body, against
+  the real embedded frontend and a real SQLite file. Not exercised by `task test`;
+  requires `task dev` or a built `task build` binary. (No such UI exists yet as of this
+  slice.)
+- No SMTP involvement.