Edit of links and database versioning

backend/tests/test_api.py

@@ -111,6 +111,47 @@ def test_submit_link_stores_cleaned_url_and_public_feed():
     assert 'alice' in users_response.json()
 
 
+def test_only_link_owner_can_edit_link():
+    owner_headers = login_headers('alice')
+    response = client.post('/api/links', headers=owner_headers, json={
+        'title': 'Editable link',
+        'url': 'https://example.com/editable?utm_source=test',
+        'comment': 'Before edit',
+    })
+    assert response.status_code == 201
+    link_id = response.json()['id']
+
+    unauthenticated = client.put(f'/api/links/{link_id}', json={
+        'title': 'Not allowed',
+        'url': 'https://example.com/not-allowed',
+    })
+    assert unauthenticated.status_code == 401
+
+    anonymous_feed = client.get('/api/public/feed').json()
+    anonymous_link = next(item for item in anonymous_feed if item['id'] == link_id)
+    assert anonymous_link['is_owner'] is False
+    assert anonymous_link['can_edit'] is False
+
+    owner_feed = client.get('/api/public/feed', headers=owner_headers).json()
+    owner_link = next(item for item in owner_feed if item['id'] == link_id)
+    assert owner_link['is_owner'] is True
+    assert owner_link['can_edit'] is True
+
+    edited = client.put(f'/api/links/{link_id}', headers=owner_headers, json={
+        'title': 'Edited link',
+        'url': 'https://example.com/edited',
+        'comment': 'After edit',
+    })
+    assert edited.status_code == 200
+    assert edited.json()['title'] == 'Edited link'
+
+    denied = client.put(f'/api/links/{link_id}', headers=login_headers('bob'), json={
+        'title': 'Not allowed',
+        'url': 'https://example.com/not-allowed',
+    })
+    assert denied.status_code == 404
+
+
 def test_logout_revokes_token_and_admin_can_list_plugins():
     headers = login_headers()
     token = headers['Authorization'].removeprefix('Bearer ')
@@ -149,6 +190,8 @@ def test_public_and_admin_pages_render_html():
     assert 'id="admin-auth-notice" class="auth-notice hidden"' in admin_page
     assert 'id="admin-login-button" class="login-button" href="/login"' in admin_page
     assert 'id="logout-button" class="logout-button hidden"' in admin_page
+    feed_script = client.get('/static/feed.js?v=5').text
+    assert 'if (item.is_owner)' in feed_script
 
 
 def test_link_submission_posts_to_enabled_mastodon_plugin():

backend/tests/test_database.py

@@ -0,0 +1,22 @@
+import sqlite3
+
+from backend.app.database import apply_migrations, get_schema_version
+
+
+def test_database_migrations_are_versioned_and_idempotent():
+    connection = sqlite3.connect(':memory:')
+
+    apply_migrations(connection)
+    assert get_schema_version(connection) == 1
+    tables = {
+        row[0]
+        for row in connection.execute(
+            "SELECT name FROM sqlite_master WHERE type = 'table'"
+        )
+    }
+    assert {'users', 'tokens', 'links', 'plugins', 'user_plugin_config'} <= tables
+
+    apply_migrations(connection)
+    assert get_schema_version(connection) == 1
+
+    connection.close()