lific 2.4.0

Local-first, lightweight issue tracker. Single binary, SQLite-backed, MCP-native.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155

//! LIF-240: `GET /api/projects/{id}/insights` — the Insights tab's single
//! read endpoint. All aggregation happens in SQL (`db::queries::insights`);
//! this module is just the Viewer-gated HTTP wrapper, mirroring the shape
//! of `api::activity`'s project-scoped read handlers.

use axum::{
    Extension,
    extract::{Json, Path, Query, State},
};

use crate::authz;
use crate::db::queries::insights::{clamp_weeks, get_insights};
use crate::db::{
    DbPool,
    models::{AuthUser, InsightsPayload, Role},
};
use crate::error::LificError;

use super::with_read;

#[derive(Debug, serde::Deserialize)]
pub(super) struct InsightsQuery {
    /// Trend-line window in weeks. Clamped to 1..=52, defaults to 12 —
    /// see `queries::insights::clamp_weeks`.
    pub weeks: Option<i64>,
}

/// GET /api/projects/{id}/insights?weeks=N
pub(super) async fn project_insights(
    State(db): State<DbPool>,
    Extension(auth_user): Extension<Option<AuthUser>>,
    Path(id): Path<i64>,
    Query(q): Query<InsightsQuery>,
) -> Result<Json<InsightsPayload>, LificError> {
    authz::require_role(&db, &auth_user, id, Role::Viewer)?;
    let weeks = clamp_weeks(q.weeks);
    with_read(&db, |conn| get_insights(conn, id, weeks)).map(Json)
}

#[cfg(test)]
mod tests {
    use crate::api::test_helpers::*;
    use axum::http::StatusCode;

    #[tokio::test]
    async fn insights_returns_full_shape_for_a_seeded_project() {
        let app = test_app();
        let (project_id, _) = seed_project(&app).await;

        json_post(
            &app,
            "/api/issues",
            serde_json::json!({ "project_id": project_id, "title": "Seed 1", "priority": "high" }),
        )
        .await;
        let issue = parse_json(
            json_post(
                &app,
                "/api/issues",
                serde_json::json!({ "project_id": project_id, "title": "Seed 2" }),
            )
            .await,
        )
        .await;
        let issue_id = issue["id"].as_i64().unwrap();
        json_put(
            &app,
            &format!("/api/issues/{issue_id}"),
            serde_json::json!({ "status": "done" }),
        )
        .await;

        let resp = json_get(
            &app,
            &format!("/api/projects/{project_id}/insights?weeks=6"),
        )
        .await;
        assert_eq!(resp.status(), StatusCode::OK);
        let body = parse_json(resp).await;

        assert_eq!(body["weeks"], 6);
        assert_eq!(body["created_per_week"].as_array().unwrap().len(), 6);
        assert_eq!(body["closed_per_week"].as_array().unwrap().len(), 6);
        assert_eq!(body["status_counts"]["total"], 2);
        assert_eq!(body["status_counts"]["done"], 1);
        assert_eq!(body["priority_counts"]["total"], 2);
        assert_eq!(body["priority_counts"]["high"], 1);
        assert!(!body["module_counts"].as_array().unwrap().is_empty());
        assert!(body["top_actors"].is_array());

        // Trend-line dense buckets: every point has both keys.
        let first_point = &body["created_per_week"][0];
        assert!(first_point["week_start"].is_string());
        assert!(first_point["count"].is_i64());
    }

    #[tokio::test]
    async fn insights_defaults_weeks_to_twelve_and_clamps_out_of_range() {
        let app = test_app();
        let (project_id, _) = seed_project(&app).await;

        let resp = json_get(&app, &format!("/api/projects/{project_id}/insights")).await;
        assert_eq!(resp.status(), StatusCode::OK);
        let body = parse_json(resp).await;
        assert_eq!(body["weeks"], 12);
        assert_eq!(body["created_per_week"].as_array().unwrap().len(), 12);

        let resp = json_get(
            &app,
            &format!("/api/projects/{project_id}/insights?weeks=999"),
        )
        .await;
        let body = parse_json(resp).await;
        assert_eq!(body["weeks"], 52);
    }
}

/// LIF-197/LIF-201: Viewer-gated like every sibling read handler in
/// `api::activity`; a non-member with the flag on must get 403, a viewer
/// must get 200.
#[cfg(test)]
mod authz_gating_tests {
    use crate::api::test_helpers::*;
    use axum::http::StatusCode;

    #[tokio::test]
    async fn insights_denies_non_member_allows_viewer() {
        let (db, _admin, lead, _maintainer, viewer, non_member, project_id) =
            setup_membership_test();
        let lead_app = app_as_user(db.clone(), &lead);
        json_post(
            &lead_app,
            "/api/issues",
            serde_json::json!({ "project_id": project_id, "title": "Gated" }),
        )
        .await;

        let non_member_app = app_as_user(db.clone(), &non_member);
        assert_eq!(
            json_get(
                &non_member_app,
                &format!("/api/projects/{project_id}/insights")
            )
            .await
            .status(),
            StatusCode::FORBIDDEN
        );

        let viewer_app = app_as_user(db, &viewer);
        let resp = json_get(&viewer_app, &format!("/api/projects/{project_id}/insights")).await;
        assert_eq!(resp.status(), StatusCode::OK);
        let body = parse_json(resp).await;
        assert_eq!(body["status_counts"]["total"], 1);
    }
}