newznab-tmux/tests/Feature/ApiRequestMatrixTest.php

<?php

declare(strict_types=1);

namespace Tests\Feature;

use App\Http\Controllers\Api\ApiController;
use App\Models\Category;
use App\Services\Releases\ReleaseBrowseService;
use App\Services\Releases\ReleaseSearchService;
use Illuminate\Database\Schema\Blueprint;
use Illuminate\Http\Request;
use Illuminate\Support\Collection;
use Illuminate\Support\Facades\Cache;
use Illuminate\Support\Facades\DB;
use Illuminate\Support\Facades\Schema;
use Illuminate\Support\Str;
use Mockery;
use ReflectionClass;
use Tests\TestCase;

class ApiRequestMatrixTest extends TestCase
{
    protected function setUp(): void
    {
        parent::setUp();

        config([
            'database.default' => 'sqlite',
            'database.connections.sqlite.database' => ':memory:',
            'mail.from.address' => 'api-matrix@example.test',
            'app.key' => 'base64:'.base64_encode(random_bytes(32)),
        ]);

        DB::purge();
        DB::reconnect();
        Cache::flush();

        $this->createSchema();
        $this->seedData();
    }

    public function test_v1_invalid_sort_returns_xml_201_error(): void
    {
        $token = (string) DB::table('users')->value('api_token');

        $response = $this->get('/api/v1/api?t=search&apikey='.$token.'&q=test&sort=bad_value');

        $response->assertBadRequest();
        $response->assertSee('<error code="201"', false);
        $response->assertSee('Incorrect parameter (sort', false);
    }

    public function test_v1_invalid_maxage_returns_xml_201_error(): void
    {
        $token = (string) DB::table('users')->value('api_token');

        $response = $this->get('/api/v1/api?t=search&apikey='.$token.'&q=test&maxage=abc');

        $response->assertBadRequest();
        $response->assertSee('<error code="201"', false);
        $response->assertSee('maxage must be numeric', false);
    }

    public function test_v1_invalid_apikey_returns_xml_401_error(): void
    {
        $response = $this->get('/api/v1/api?t=search&apikey=invalid-token&q=test');

        $response->assertUnauthorized();
        $response->assertSee('<error code="100" description="Incorrect user credentials (wrong API key)"/>', false);
    }

    public function test_v2_invalid_api_token_returns_json_401_error(): void
    {
        $this->getJson('/api/v2/search?api_token=invalid-token&id=test')
            ->assertUnauthorized()
            ->assertJsonPath('error', 'Incorrect user credentials');
    }

    public function test_v2_disabled_user_is_rejected_before_request_is_recorded(): void
    {
        DB::table('users')->insert([
            'username' => 'disabled_matrix_user',
            'email' => 'disabled-matrix@example.test',
            'password' => bcrypt('secret'),
            'roles_id' => 3,
            'api_token' => 'disabled-matrix-token',
            'verified' => 1,
            'email_verified_at' => now(),
            'rate_limit' => 60,
            'created_at' => now(),
            'updated_at' => now(),
        ]);

        $this->getJson('/api/v2/search?api_token=disabled-matrix-token&id=test')
            ->assertForbidden()
            ->assertJsonPath('error', 'Account suspended');

        $this->assertSame(0, DB::table('user_requests')->count());
    }

    public function test_v2_invalid_sort_returns_json_400_error(): void
    {
        $token = (string) DB::table('users')->value('api_token');

        $this->getJson('/api/v2/search?api_token='.$token.'&id=test&sort=bad_value')
            ->assertStatus(400)
            ->assertJsonPath('error', 'Incorrect parameter (sort must be one of: cat_asc/desc, name_asc/desc, size_asc/desc, files_asc/desc, stats_asc/desc, posted_asc/desc)');
    }

    public function test_v2_invalid_maxage_returns_json_400_error(): void
    {
        $token = (string) DB::table('users')->value('api_token');

        $this->getJson('/api/v2/search?api_token='.$token.'&id=test&maxage=abc')
            ->assertStatus(400)
            ->assertJsonPath('error', 'Incorrect parameter (maxage must be numeric)');
    }

    public function test_v1_movie_without_search_params_returns_recent_movie_feed(): void
    {
        $token = (string) DB::table('users')->value('api_token');
        $request = Request::create('/api/v1/api', 'GET', [
            't' => 'm',
            'apikey' => $token,
        ]);

        $releaseSearchService = Mockery::mock(ReleaseSearchService::class);
        $releaseBrowseService = Mockery::mock(ReleaseBrowseService::class);
        $releaseBrowseService->shouldReceive('getBrowseRangeForApi')
            ->once()
            ->andReturn(collect());

        $controller = new class($releaseSearchService, $releaseBrowseService) extends ApiController
        {
            /**
             * @var array{data:mixed,params:array<string,mixed>,xml:bool,offset:int,type:string}|null
             */
            public ?array $capturedOutput = null;

            public function output(mixed $data, array $params, bool $xml, int $offset, string $type = '')
            {
                $this->capturedOutput = [
                    'data' => $data,
                    'params' => $params,
                    'xml' => $xml,
                    'offset' => $offset,
                    'type' => $type,
                ];
            }
        };

        $controller->api($request);
        $this->assertNotNull($controller->capturedOutput);
        $this->assertSame('api', $controller->capturedOutput['type']);
        $this->assertInstanceOf(Collection::class, $controller->capturedOutput['data']);
    }

    public function test_v1_tv_without_search_params_returns_recent_tv_feed(): void
    {
        $token = (string) DB::table('users')->value('api_token');
        $request = Request::create('/api/v1/api', 'GET', [
            't' => 'tv',
            'apikey' => $token,
        ]);

        $releaseSearchService = Mockery::mock(ReleaseSearchService::class);
        $releaseBrowseService = Mockery::mock(ReleaseBrowseService::class);
        $releaseBrowseService->shouldReceive('getBrowseRangeForApi')
            ->once()
            ->andReturn(collect());

        $controller = new class($releaseSearchService, $releaseBrowseService) extends ApiController
        {
            /**
             * @var array{data:mixed,params:array<string,mixed>,xml:bool,offset:int,type:string}|null
             */
            public ?array $capturedOutput = null;

            public function output(mixed $data, array $params, bool $xml, int $offset, string $type = '')
            {
                $this->capturedOutput = [
                    'data' => $data,
                    'params' => $params,
                    'xml' => $xml,
                    'offset' => $offset,
                    'type' => $type,
                ];
            }
        };

        $controller->api($request);
        $this->assertNotNull($controller->capturedOutput);
        $this->assertSame('api', $controller->capturedOutput['type']);
        $this->assertInstanceOf(Collection::class, $controller->capturedOutput['data']);
    }

    public function test_v1_music_without_query_browses_requested_categories(): void
    {
        $token = (string) DB::table('users')->value('api_token');
        $request = Request::create('/api/v1/api', 'GET', [
            't' => 'music',
            'cat' => '3000,3010,3020,3030,3040,3050,3060,3999',
            'extended' => '1',
            'apikey' => $token,
        ]);

        $releaseSearchService = Mockery::mock(ReleaseSearchService::class);
        $releaseSearchService->shouldNotReceive('apiMusicSearch');
        $releaseBrowseService = Mockery::mock(ReleaseBrowseService::class);
        $releaseBrowseService->shouldReceive('getBrowseRangeForApi')
            ->once()
            ->with(
                1,
                ['3000', '3010', '3020', '3030', '3040', '3050', '3060', '3999'],
                0,
                100,
                'posted_desc',
                -1,
                [5030],
                -1,
                0
            )
            ->andReturn(collect());

        $controller = new class($releaseSearchService, $releaseBrowseService) extends ApiController
        {
            /**
             * @var array{data:mixed,params:array<string,mixed>,xml:bool,offset:int,type:string}|null
             */
            public ?array $capturedOutput = null;

            public function output(mixed $data, array $params, bool $xml, int $offset, string $type = '')
            {
                $this->capturedOutput = [
                    'data' => $data,
                    'params' => $params,
                    'xml' => $xml,
                    'offset' => $offset,
                    'type' => $type,
                ];
            }
        };

        $controller->api($request);
        $this->assertNotNull($controller->capturedOutput);
        $this->assertSame('api', $controller->capturedOutput['type']);
        $this->assertInstanceOf(Collection::class, $controller->capturedOutput['data']);
    }

    public function test_v1_book_without_query_browses_requested_categories(): void
    {
        $token = (string) DB::table('users')->value('api_token');
        $request = Request::create('/api/v1/api', 'GET', [
            't' => 'book',
            'cat' => '3030,7020,8010',
            'extended' => '1',
            'apikey' => $token,
        ]);

        $releaseSearchService = Mockery::mock(ReleaseSearchService::class);
        $releaseSearchService->shouldNotReceive('apiBookSearch');
        $releaseBrowseService = Mockery::mock(ReleaseBrowseService::class);
        $releaseBrowseService->shouldReceive('getBrowseRangeForApi')
            ->once()
            ->with(
                1,
                ['3030', '7020', '8010'],
                0,
                100,
                'posted_desc',
                -1,
                [5030],
                -1,
                0
            )
            ->andReturn(collect());

        $controller = new class($releaseSearchService, $releaseBrowseService) extends ApiController
        {
            /**
             * @var array{data:mixed,params:array<string,mixed>,xml:bool,offset:int,type:string}|null
             */
            public ?array $capturedOutput = null;

            public function output(mixed $data, array $params, bool $xml, int $offset, string $type = '')
            {
                $this->capturedOutput = [
                    'data' => $data,
                    'params' => $params,
                    'xml' => $xml,
                    'offset' => $offset,
                    'type' => $type,
                ];
            }
        };

        $controller->api($request);
        $this->assertNotNull($controller->capturedOutput);
        $this->assertSame('api', $controller->capturedOutput['type']);
        $this->assertInstanceOf(Collection::class, $controller->capturedOutput['data']);
    }

    public function test_v1_music_and_book_without_query_default_to_their_root_categories(): void
    {
        $token = (string) DB::table('users')->value('api_token');

        foreach ([
            'music' => [Category::MUSIC_ROOT],
            'book' => [Category::BOOKS_ROOT],
        ] as $type => $expectedCategory) {
            $request = Request::create('/api/v1/api', 'GET', [
                't' => $type,
                'apikey' => $token,
            ]);

            $releaseSearchService = Mockery::mock(ReleaseSearchService::class);
            $releaseBrowseService = Mockery::mock(ReleaseBrowseService::class);
            $releaseBrowseService->shouldReceive('getBrowseRangeForApi')
                ->once()
                ->with(
                    1,
                    $expectedCategory,
                    0,
                    100,
                    'posted_desc',
                    -1,
                    [5030],
                    -1,
                    0
                )
                ->andReturn(collect());

            $controller = new class($releaseSearchService, $releaseBrowseService) extends ApiController
            {
                public ?array $capturedOutput = null;

                public function output(mixed $data, array $params, bool $xml, int $offset, string $type = '')
                {
                    $this->capturedOutput = compact('data', 'params', 'xml', 'offset', 'type');
                }
            };

            $controller->api($request);
            $this->assertNotNull($controller->capturedOutput);
            $this->assertSame('api', $controller->capturedOutput['type']);
        }
    }

    public function test_v2_movie_requires_query_or_external_id(): void
    {
        $token = (string) DB::table('users')->value('api_token');

        $this->getJson('/api/v2/movies?api_token='.$token)
            ->assertStatus(400)
            ->assertJsonPath('error', 'Specify id (query), imdbid, tmdbid, or traktid');
    }

    public function test_v2_tv_requires_query_or_external_id(): void
    {
        $token = (string) DB::table('users')->value('api_token');

        $this->getJson('/api/v2/tv?api_token='.$token)
            ->assertStatus(400)
            ->assertJsonPath('error', 'Specify id (query), vid, tvdbid, traktid, rid, tvmazeid, imdbid, or tmdbid');
    }

    public function test_v1_caps_menu_data_includes_groups_and_genres(): void
    {
        $apiController = app(ApiController::class);
        $reflection = new ReflectionClass($apiController);
        $typeProperty = $reflection->getProperty('type');
        $typeProperty->setAccessible(true);
        $typeProperty->setValue($apiController, 'caps');

        $menu = $apiController->getForMenu();

        $this->assertSame('alt.binaries.test', $menu['groups'][0]['name']);
        $this->assertSame('Test Genre', $menu['genres'][0]['name']);
    }

    public function test_v2_capabilities_includes_groups_and_genres(): void
    {
        $this->getJson('/api/v2/capabilities')
            ->assertOk()
            ->assertJsonPath('groups.0.name', 'alt.binaries.test')
            ->assertJsonPath('genres.0.name', 'Test Genre');
    }

    private function createSchema(): void
    {
        Schema::create('roles', function (Blueprint $table): void {
            $table->increments('id');
            $table->string('name');
            $table->string('guard_name')->default('web');
            $table->integer('rate_limit')->default(60);
            $table->integer('apirequests')->default(1000);
            $table->integer('downloadrequests')->default(100);
            $table->integer('addyears')->default(0);
            $table->timestamps();
        });

        Schema::create('users', function (Blueprint $table): void {
            $table->increments('id');
            $table->string('username')->unique();
            $table->string('email')->unique();
            $table->string('password');
            $table->unsignedInteger('roles_id')->default(1);
            $table->string('api_token')->nullable()->index();
            $table->string('host')->nullable();
            $table->timestamp('apiaccess')->nullable();
            $table->boolean('verified')->default(true);
            $table->timestamp('email_verified_at')->nullable();
            $table->integer('rate_limit')->default(60);
            $table->timestamps();
            $table->softDeletes();
        });

        Schema::create('permissions', function (Blueprint $table): void {
            $table->increments('id');
            $table->string('name');
            $table->string('guard_name')->default('web');
            $table->timestamps();
        });

        Schema::create('model_has_roles', function (Blueprint $table): void {
            $table->unsignedInteger('role_id');
            $table->string('model_type');
            $table->unsignedInteger('model_id');
            $table->primary(['role_id', 'model_id', 'model_type']);
        });

        Schema::create('model_has_permissions', function (Blueprint $table): void {
            $table->unsignedInteger('permission_id');
            $table->string('model_type');
            $table->unsignedInteger('model_id');
            $table->primary(['permission_id', 'model_id', 'model_type']);
        });

        Schema::create('role_has_permissions', function (Blueprint $table): void {
            $table->unsignedInteger('permission_id');
            $table->unsignedInteger('role_id');
            $table->primary(['permission_id', 'role_id']);
        });

        Schema::create('settings', function (Blueprint $table): void {
            $table->string('name')->primary();
            $table->text('value')->nullable();
        });

        Schema::create('root_categories', function (Blueprint $table): void {
            $table->increments('id');
            $table->string('title')->default('');
            $table->integer('status')->default(1);
        });

        Schema::create('categories', function (Blueprint $table): void {
            $table->increments('id');
            $table->string('title')->default('');
            $table->unsignedInteger('root_categories_id')->nullable();
            $table->integer('status')->default(1);
            $table->text('description')->nullable();
        });

        Schema::create('user_excluded_categories', function (Blueprint $table): void {
            $table->increments('id');
            $table->unsignedInteger('users_id');
            $table->unsignedInteger('categories_id');
        });

        Schema::create('user_requests', function (Blueprint $table): void {
            $table->increments('id');
            $table->unsignedInteger('users_id');
            $table->text('request')->nullable();
            $table->timestamp('timestamp')->nullable();
        });

        Schema::create('user_downloads', function (Blueprint $table): void {
            $table->increments('id');
            $table->unsignedInteger('users_id');
            $table->timestamp('timestamp')->nullable();
        });

        Schema::create('usenet_groups', function (Blueprint $table): void {
            $table->increments('id');
            $table->string('name');
            $table->boolean('active')->default(true);
            $table->string('description')->nullable();
            $table->timestamp('last_updated')->nullable();
        });

        Schema::create('genres', function (Blueprint $table): void {
            $table->increments('id');
            $table->string('title');
            $table->integer('type')->default(3000);
            $table->boolean('disabled')->default(false);
        });

        Schema::create('registration_periods', function (Blueprint $table): void {
            $table->increments('id');
            $table->string('name');
            $table->dateTime('starts_at');
            $table->dateTime('ends_at');
            $table->boolean('is_enabled')->default(true);
            $table->text('notes')->nullable();
            $table->unsignedInteger('created_by')->nullable();
            $table->unsignedInteger('updated_by')->nullable();
            $table->timestamps();
        });
    }

    private function seedData(): void
    {
        DB::table('settings')->insert([
            ['name' => 'strapline', 'value' => 'Test strapline'],
            ['name' => 'metakeywords', 'value' => 'test,api'],
            ['name' => 'registerstatus', 'value' => '0'],
            ['name' => 'catwebdl', 'value' => '0'],
            ['name' => 'title', 'value' => 'NNTmux Test'],
            ['name' => 'home_link', 'value' => '/'],
        ]);

        DB::table('roles')->insert([
            [
                'id' => 1,
                'name' => 'User',
                'guard_name' => 'web',
                'rate_limit' => 60,
                'apirequests' => 1000,
                'downloadrequests' => 100,
                'addyears' => 0,
                'created_at' => now(),
                'updated_at' => now(),
            ],
            [
                'id' => 3,
                'name' => 'Disabled',
                'guard_name' => 'web',
                'rate_limit' => 60,
                'apirequests' => 0,
                'downloadrequests' => 0,
                'addyears' => 0,
                'created_at' => now(),
                'updated_at' => now(),
            ],
        ]);

        DB::table('users')->insert([
            'username' => 'matrix_user',
            'email' => 'matrix@example.test',
            'password' => bcrypt('secret'),
            'roles_id' => 1,
            'api_token' => Str::random(32),
            'verified' => 1,
            'email_verified_at' => now(),
            'rate_limit' => 60,
            'created_at' => now(),
            'updated_at' => now(),
        ]);

        DB::table('root_categories')->insert([
            'id' => 5000,
            'title' => 'TV',
            'status' => 1,
        ]);

        DB::table('categories')->insert([
            'id' => 5030,
            'title' => 'SD',
            'root_categories_id' => 5000,
            'status' => 1,
            'description' => 'TV SD',
        ]);

        DB::table('usenet_groups')->insert([
            'name' => 'alt.binaries.test',
            'active' => 1,
            'description' => 'Test usenet group',
            'last_updated' => now(),
        ]);

        DB::table('genres')->insert([
            'id' => 1,
            'title' => 'Test Genre',
            'type' => 3000,
            'disabled' => 0,
        ]);
    }
}