RenewCMS/features/upload_article_image.qa.md

QA procedure: upload_article_image

Package: test (black-box, extending article_test.go / image_test.go).

Setup shared by every case

1. Call validator.InitValidator() once.
2. Reuse mockArticleRepo (test/article_test.go) and mockImageRepo (test/image_test.go) as-is; both already implement AddImage / Create returning article.ErrArticleNotFound / image.ErrImageNotFound for an unknown id, per features/write_not_found_errors.feature.
3. Wire the real use cases over the fakes: useCases.NewCreateArticleUseCase, useCases.NewGetArticleUseCase, useCases.NewListArticlesUseCase, useCases.NewUpdateArticleUseCase(articleRepo), useCases.NewDeleteArticleUseCase(articleRepo, imageRepo), useCases.NewCreateImageUseCase(imageRepo).
4. Build article.NewHandler(...) with its existing constructor shape, and image.NewHandler(createImageUseCase, updateArticleUseCase) (api/handlers/image).
5. Build a test jwtauth.New("HS256", []byte("test-secret"), nil).
6. Mount the routes on a fresh chi.NewRouter() mirroring api/router.go's shape after this slice: GET / under jwtauth.Verifier only; GET /{id}, POST /, DELETE /{id}, PATCH /{id}, PATCH /{id}/publish, PATCH /{id}/unpublish and the new POST /{id}/image (routed to imageHandler.PostImage) under jwtauth.Verifier + jwtauth.Authenticator.
7. Mint a valid jwt cookie for user id 1: token.Encode(map[string]any{"user_id": uint32(1)}), set as the jwt cookie on the relevant httptest.NewRequest.
8. Build multipart request bodies with mime/multipart.Writer, field name "file", setting the part's Content-Type header explicitly (Go's multipart writer defaults to sniffing otherwise, so set it via CreatePart with an explicit MIME header rather than CreateFormFile), and set the request's Content-Type header to the writer's FormDataContentType().

HTTP checks

9. Seed articleRepo.articles[1] = article.Article{ID: 1, Title: "Backyard Renovation Update"}. Send POST /v1/article/1/image with the valid cookie and a multipart "file" part named "before.png", content type "image/png", some non-empty byte content. Assert status 201; decode the JSON body and assert location equals "/static/uploadedImages/before.png"; assert imageRepo.images gained exactly one entry whose Path matches that location; assert articleRepo.articles[1].Images now contains that image's id.
10. Empty articleRepo, empty imageRepo. Send POST /v1/article/9999/image with the valid cookie and the same "before.png" / "image/png" part. Assert status 404, body "Article not found\n"; assert imageRepo.images is still empty (the article's existence is confirmed before any image is created, so nothing is left orphaned).
11. Seed articleRepo.articles[1] = article.Article{ID: 1, Title: "Backyard Renovation Update"} with an empty Images slice. Send POST /v1/article/1/image with the valid cookie and a multipart "file" part named "notes.pdf", content type "application/pdf". Assert status 400, body "the file must be a PNG, JPEG, WEBP, or SVG image\n"; assert imageRepo.images is still empty; assert articleRepo.articles[1].Images is still empty.
12. Seed the same article id 1 as step 11. Send POST /v1/article/1/image with no cookie and the "before.png" / "image/png" part. Assert status 401; assert imageRepo.images is still empty; assert articleRepo.articles[1].Images is still empty.

Manual verification (not exercised by the Go test)

• Real upload against a real SQLite file and real UPLOAD_DIR: confirm that after POST /v1/article/{id}/image on a real running instance, the file actually lands on disk under UPLOAD_DIR, the images row's path resolves to a URL the SPA can load, and the article_images join table gets the new row. Not exercised by task test (fakes only); requires task dev or a built task build binary with a scratch DB/upload dir.
• SPA-visible behaviour: confirm the back-office article editor (if/when an image-upload UI exists) shows the uploaded image at that location. No such UI exists yet as of this slice.
• No SMTP involvement.