RenewCMS/features/article_publishing.qa.md

QA procedure: article_publishing

Package: test (black-box, extending article_test.go).

Setup shared by every case

1. Call validator.InitValidator() once.
2. Reuse mockArticleRepo (test/article_test.go) as-is; its UpdateIsOnline and FindByFilters already support everything this slice needs, no fake changes expected.
3. Wire the real use cases over the fake: useCases.NewCreateArticleUseCase, useCases.NewGetArticleUseCase, useCases.NewListArticlesUseCase, useCases.NewDeleteArticleUseCase, useCases.NewUpdateArticleUseCase. Build article.NewHandler(...) extended to also take the update use case (matching whatever NewHandler signature the coder lands on), exposing the new PublishArticle and UnpublishArticle methods.
4. Build a test jwtauth.New("HS256", []byte("test-secret"), nil).
5. Mount the routes on a fresh chi.NewRouter() mirroring api/router.go's current shape (per public_article_listing.qa.md): GET / under jwtauth.Verifier only; GET /{id}, POST /, DELETE /{id} under jwtauth.Verifier + jwtauth.Authenticator. Add PATCH /{id}/publish and PATCH /{id}/unpublish to that same authenticated group.
6. Mint a valid jwt cookie for user id 1: token.Encode(map[string]any{"user_id": uint32(1)}), set as the jwt cookie on the relevant httptest.NewRequest.
7. Seed the repo directly via the map pattern already used elsewhere, e.g. repo.articles[1] = article.Article{ID: 1, Title: "Backyard Renovation Update", IsOnline: true} and repo.articles[2] = article.Article{ID: 2, Title: "Draft: Kitchen Remodel", IsOnline: false}.

HTTP checks

8. PATCH /v1/article/2/publish with the valid cookie, repo seeded per step 7 -> status 200; decode the JSON body and assert id == 2 and is_online == true; assert repo.articles[2].IsOnline is now true.
9. PATCH /v1/article/1/unpublish with the valid cookie, repo seeded per step 7 -> status 200; decode the JSON body and assert id == 1 and is_online == false; assert repo.articles[1].IsOnline is now false.
10. PATCH /v1/article/1/publish with the valid cookie against an article already seeded IsOnline: true -> status 200, body is_online == true, no error (idempotency).
11. PATCH /v1/article/2/unpublish with the valid cookie against an article already seeded IsOnline: false -> status 200, body is_online == false, no error (idempotency).
12. PATCH /v1/article/9999/publish with the valid cookie, empty repo id 9999 -> status 404, body "Article not found\n". Repeat for PATCH /v1/article/9999/unpublish -> same assertions.
13. PATCH /v1/article/not-a-number/publish with the valid cookie -> status 400, body matching apperr.IdUint32ErrorMessage + "\n". Repeat for .../unpublish.
14. PATCH /v1/article/1/publish with no cookie, repo seeded with article id 1 -> status 401. Repeat for PATCH /v1/article/1/unpublish with no cookie -> status 401.
15. Integration with the public listing: seed repo with an offline article id 2, call PATCH /v1/article/2/publish with the valid cookie (assert 200), then call GET /v1/article/ with no cookie and assert the decoded JSON array contains an element with id 2.
16. Mirror check: seed repo with an online article id 1, call PATCH /v1/article/1/unpublish with the valid cookie (assert 200), then call GET /v1/article/ with no cookie and assert the decoded JSON array does not contain an element with id 1.

Manual verification (not exercised by the Go test)

• SPA-visible behaviour: confirm the back-office article editor exposes a publish/unpublish control that calls the new endpoints and updates the visible online/offline state, against the real embedded frontend and a real SQLite file. Not exercised by task test; requires task dev or a built task build binary. (No such UI exists yet as of this slice — this note applies once the SPA is wired to the new endpoints.)
• No SMTP involvement.