immutable_fields_test.go

package main

import (
	"encoding/json"
	"io"
	"net/http"
	"strings"
	"testing"

	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
)

const (
	unusedID      = "00000000-dead-beef-0000-000000000001"
	forgedCreated = "1999-01-01T00:00:00Z"
	fixtureLogID  = "4f95b0d0-042e-11ed-8253-d8bbc146d165"

	fixtureBundleID = "e1f2a3b4-c5d6-4e7f-8a9b-0c1d2e3f4a5b"

	softwarePath        = "/v1/software/"
	logPath             = "/v1/logs/"
	publisherPath       = "/v1/publishers/"
	catalogPath         = "/v1/catalogs/"
	catalogSoftwarePath = catalogPath + italiaID + "/software/"
	catalogPubPath      = catalogPath + italiaID + "/publishers/"
)

// patchJSON sends a RFC 6902 patch, the content type that skips the DTO
// validation and reaches the entity fields directly.
func patchJSON(t *testing.T, path, body string) (int, []byte) {
	t.Helper()

	return patch(t, path, "application/json-patch+json", body)
}

func patchMerge(t *testing.T, path, body string) (int, []byte) {
	t.Helper()

	return patch(t, path, "application/json", body)
}

func patch(t *testing.T, path, contentType, body string) (int, []byte) {
	t.Helper()

	req, err := newTestRequest(http.MethodPatch, path, strings.NewReader(body))
	require.NoError(t, err)

	req.Header.Set("Content-Type", contentType)
	req.Header.Set("Authorization", goodToken)

	res, err := app.Test(req, -1)
	require.NoError(t, err)
	t.Cleanup(func() { require.NoError(t, res.Body.Close()) })

	out, err := io.ReadAll(res.Body)
	require.NoError(t, err)

	return res.StatusCode, out
}

func problem(title, detail string) string {
	return `{"title":"` + title + `","detail":"` + detail + `","status":422}`
}

// TestPatchRejectsProtectedPaths covers every endpoint that runs an incoming
// patch over the whole entity. An operation on a field the API never lets a
// client choose is refused as a whole: the second, harmless operation in each
// patch must not reach the database either.
func TestPatchRejectsProtectedPaths(t *testing.T) {
	const detail = "operation not allowed on a read-only field: "

	tests := []struct {
		description string
		prefix      string
		id          string
		ops         string
		title       string
		table       string
		column      string
		want        string
	}{
		{
			"software id", softwarePath, italiaSoftwareID,
			`{"op": "replace", "path": "/id", "value": "` + unusedID + `"},
			 {"op": "replace", "path": "/publiccodeYml", "value": "patched"}`,
			"can't update Software", "software", "publiccode_yml", "-",
		},
		{
			"software createdAt", softwarePath, italiaSoftwareID,
			`{"op": "replace", "path": "/createdAt", "value": "` + forgedCreated + `"},
			 {"op": "replace", "path": "/publiccodeYml", "value": "patched"}`,
			"can't update Software", "software", "publiccode_yml", "-",
		},
		{
			"software updatedAt", softwarePath, italiaSoftwareID,
			`{"op": "replace", "path": "/updatedAt", "value": "` + forgedCreated + `"},
			 {"op": "replace", "path": "/publiccodeYml", "value": "patched"}`,
			"can't update Software", "software", "publiccode_yml", "-",
		},
		{
			"software catalogId", softwarePath, italiaSoftwareID,
			`{"op": "replace", "path": "/catalogId", "value": "` + swissID + `"},
			 {"op": "replace", "path": "/publiccodeYml", "value": "patched"}`,
			"can't update Software", "software", "publiccode_yml", "-",
		},
		{
			"software add id", softwarePath, italiaSoftwareID,
			`{"op": "add", "path": "/id", "value": "` + unusedID + `"},
			 {"op": "replace", "path": "/publiccodeYml", "value": "patched"}`,
			"can't update Software", "software", "publiccode_yml", "-",
		},
		{
			"software remove createdAt", softwarePath, italiaSoftwareID,
			`{"op": "remove", "path": "/createdAt"},
			 {"op": "replace", "path": "/publiccodeYml", "value": "patched"}`,
			"can't update Software", "software", "publiccode_yml", "-",
		},
		{
			"software move from createdAt", softwarePath, italiaSoftwareID,
			`{"op": "move", "from": "/createdAt", "path": "/publiccodeYml"}`,
			"can't update Software", "software", "publiccode_yml", "-",
		},
		{
			"software copy from id", softwarePath, italiaSoftwareID,
			`{"op": "copy", "from": "/id", "path": "/publiccodeYml"}`,
			"can't update Software", "software", "publiccode_yml", "-",
		},
		{
			"catalog software id", catalogSoftwarePath, italiaSoftwareID,
			`{"op": "replace", "path": "/id", "value": "` + unusedID + `"},
			 {"op": "replace", "path": "/publiccodeYml", "value": "patched"}`,
			"can't update Software", "software", "publiccode_yml", "-",
		},
		{
			"catalog software createdAt", catalogSoftwarePath, italiaSoftwareID,
			`{"op": "replace", "path": "/createdAt", "value": "` + forgedCreated + `"},
			 {"op": "replace", "path": "/publiccodeYml", "value": "patched"}`,
			"can't update Software", "software", "publiccode_yml", "-",
		},
		{
			"catalog software catalogId", catalogSoftwarePath, italiaSoftwareID,
			`{"op": "replace", "path": "/catalogId", "value": "` + swissID + `"},
			 {"op": "replace", "path": "/publiccodeYml", "value": "patched"}`,
			"can't update Software", "software", "publiccode_yml", "-",
		},
		{
			"publisher id", publisherPath, italiaPublisherID,
			`{"op": "replace", "path": "/id", "value": "` + unusedID + `"},
			 {"op": "replace", "path": "/description", "value": "patched"}`,
			"can't update Publisher", "publishers", "description", "Publisher description 1",
		},
		{
			"publisher createdAt", publisherPath, italiaPublisherID,
			`{"op": "replace", "path": "/createdAt", "value": "` + forgedCreated + `"},
			 {"op": "replace", "path": "/description", "value": "patched"}`,
			"can't update Publisher", "publishers", "description", "Publisher description 1",
		},
		{
			"publisher updatedAt", publisherPath, italiaPublisherID,
			`{"op": "replace", "path": "/updatedAt", "value": "` + forgedCreated + `"},
			 {"op": "replace", "path": "/description", "value": "patched"}`,
			"can't update Publisher", "publishers", "description", "Publisher description 1",
		},
		{
			"publisher catalogId", publisherPath, italiaPublisherID,
			`{"op": "replace", "path": "/catalogId", "value": "` + swissID + `"},
			 {"op": "replace", "path": "/description", "value": "patched"}`,
			"can't update Publisher", "publishers", "description", "Publisher description 1",
		},
		{
			"publisher nested createdAt", publisherPath, italiaPublisherID,
			`{"op": "replace", "path": "/codeHosting/0/createdAt", "value": "` + forgedCreated + `"},
			 {"op": "replace", "path": "/description", "value": "patched"}`,
			"can't update Publisher", "publishers", "description", "Publisher description 1",
		},
		{
			"publisher nested updatedAt", publisherPath, italiaPublisherID,
			`{"op": "replace", "path": "/codeHosting/0/updatedAt", "value": "` + forgedCreated + `"},
			 {"op": "replace", "path": "/description", "value": "patched"}`,
			"can't update Publisher", "publishers", "description", "Publisher description 1",
		},
		{
			"catalog publisher id", catalogPubPath, italiaPublisherID,
			`{"op": "replace", "path": "/id", "value": "` + unusedID + `"},
			 {"op": "replace", "path": "/description", "value": "patched"}`,
			"can't update Publisher", "publishers", "description", "Publisher description 1",
		},
		{
			"catalog publisher createdAt", catalogPubPath, italiaPublisherID,
			`{"op": "replace", "path": "/createdAt", "value": "` + forgedCreated + `"},
			 {"op": "replace", "path": "/description", "value": "patched"}`,
			"can't update Publisher", "publishers", "description", "Publisher description 1",
		},
		{
			"catalog publisher catalogId", catalogPubPath, italiaPublisherID,
			`{"op": "replace", "path": "/catalogId", "value": "` + swissID + `"},
			 {"op": "replace", "path": "/description", "value": "patched"}`,
			"can't update Publisher", "publishers", "description", "Publisher description 1",
		},
		{
			"catalog id", catalogPath, italiaID,
			`{"op": "replace", "path": "/id", "value": "` + unusedID + `"},
			 {"op": "replace", "path": "/name", "value": "patched"}`,
			"can't update Catalog", "catalogs", "name", "Italian Catalog",
		},
		{
			"catalog createdAt", catalogPath, italiaID,
			`{"op": "replace", "path": "/createdAt", "value": "` + forgedCreated + `"},
			 {"op": "replace", "path": "/name", "value": "patched"}`,
			"can't update Catalog", "catalogs", "name", "Italian Catalog",
		},
		{
			"catalog updatedAt", catalogPath, italiaID,
			`{"op": "replace", "path": "/updatedAt", "value": "` + forgedCreated + `"},
			 {"op": "replace", "path": "/name", "value": "patched"}`,
			"can't update Catalog", "catalogs", "name", "Italian Catalog",
		},
	}

	for _, test := range tests {
		t.Run(test.description, func(t *testing.T) {
			loadFixtures(t)

			code, body := patchJSON(t, test.prefix+test.id, "["+test.ops+"]")

			assert.Equal(t, http.StatusUnprocessableEntity, code)
			assert.Contains(t, string(body), `"detail":"`+detail)

			assert.Equal(t, test.want, dbValue(t, test.table, test.column, "id", test.id))
			assert.Equal(t, 0, dbCount(t, test.table, "id", unusedID))
		})
	}
}

// TestJSONPatchValidatesPatchedEntity proves that RFC 6902 patches cannot
// bypass the field validation normally applied to merge-patch request DTOs.
// Each patch includes a valid change as well, which must remain uncommitted
// when another operation leaves the entity invalid.
func TestJSONPatchValidatesPatchedEntity(t *testing.T) {
	tests := []struct {
		description string
		path        string
		ops         string
		table       string
		column      string
		id          string
		want        string
	}{
		{
			"software URL", softwarePath + italiaSoftwareID,
			`{"op": "replace", "path": "/publiccodeYml", "value": "patched"},
			 {"op": "replace", "path": "/url", "value": "not-a-url"}`,
			"software", "publiccode_yml", italiaSoftwareID, "-",
		},
		{
			"catalog software alias", catalogSoftwarePath + italiaSoftwareID,
			`{"op": "replace", "path": "/publiccodeYml", "value": "patched"},
			 {"op": "add", "path": "/aliases/-", "value": "not-a-url"}`,
			"software", "publiccode_yml", italiaSoftwareID, "-",
		},
		{
			"publisher email", publisherPath + italiaPublisherID,
			`{"op": "replace", "path": "/description", "value": "patched"},
			 {"op": "replace", "path": "/email", "value": "not-an-email"}`,
			"publishers", "description", italiaPublisherID, "Publisher description 1",
		},
		{
			"catalog publisher code hosting URL", catalogPubPath + italiaPublisherID,
			`{"op": "replace", "path": "/description", "value": "patched"},
			 {"op": "replace", "path": "/codeHosting/0/url", "value": "not-a-url"}`,
			"publishers", "description", italiaPublisherID, "Publisher description 1",
		},
		{
			"catalog source URL", catalogPath + italiaID,
			`{"op": "replace", "path": "/name", "value": "patched"},
			 {"op": "replace", "path": "/sources/0/url", "value": "not-a-url"}`,
			"catalogs", "name", italiaID, "Italian Catalog",
		},
		{
			"bundle name", "/v1/bundles/" + fixtureBundleID,
			`{"op": "replace", "path": "/description", "value": "patched"},
			 {"op": "replace", "path": "/name", "value": ""}`,
			"bundles", "name", fixtureBundleID, "Bundle for municipalities",
		},
		{
			"log message", logPath + fixtureLogID,
			`{"op": "replace", "path": "/message", "value": "x"}`,
			"logs", "message", fixtureLogID, "A log message",
		},
	}

	for _, test := range tests {
		t.Run(test.description, func(t *testing.T) {
			loadFixtures(t)

			code, body := patchJSON(t, test.path, "["+test.ops+"]")

			assert.Equal(t, http.StatusUnprocessableEntity, code, "body: %s", body)
			assert.Contains(t, string(body), `"validationErrors"`)
			assert.Equal(t, test.want, dbValue(t, test.table, test.column, "id", test.id))
		})
	}
}

// TestMergePatchValidatesPatchedEntity covers the null case of a merge
// patch. The request DTO decodes a null into a nil pointer, the same as an
// absent field, so it cannot refuse it, while the merge clears the field on
// the entity. Each body carries a valid change as well, which must stay
// uncommitted.
func TestMergePatchValidatesPatchedEntity(t *testing.T) {
	tests := []struct {
		description string
		path        string
		body        string
		table       string
		column      string
		id          string
		want        string
	}{
		{
			"software url", softwarePath + italiaSoftwareID,
			`{"publiccodeYml": "patched", "url": null}`,
			"software", "publiccode_yml", italiaSoftwareID, "-",
		},
		{
			"catalog software url", catalogSoftwarePath + italiaSoftwareID,
			`{"publiccodeYml": "patched", "url": null}`,
			"software", "publiccode_yml", italiaSoftwareID, "-",
		},
		{
			"publisher code hosting", publisherPath + italiaPublisherID,
			`{"description": "patched", "codeHosting": null}`,
			"publishers", "description", italiaPublisherID, "Publisher description 1",
		},
		{
			"catalog publisher code hosting", catalogPubPath + italiaPublisherID,
			`{"description": "patched", "codeHosting": null}`,
			"publishers", "description", italiaPublisherID, "Publisher description 1",
		},
		{
			"catalog name", catalogPath + italiaID,
			`{"active": false, "name": null}`,
			"catalogs", "name", italiaID, "Italian Catalog",
		},
		{
			"log message", logPath + fixtureLogID,
			`{"message": null}`,
			"logs", "message", fixtureLogID, "A log message",
		},
		{
			"bundle name", "/v1/bundles/" + fixtureBundleID,
			`{"description": "patched", "name": null}`,
			"bundles", "name", fixtureBundleID, "Bundle for municipalities",
		},
	}

	for _, test := range tests {
		t.Run(test.description, func(t *testing.T) {
			loadFixtures(t)

			code, body := patchMerge(t, test.path, test.body)

			assert.Equal(t, http.StatusUnprocessableEntity, code, "body: %s", body)
			assert.Contains(t, string(body), `"validationErrors"`)
			assert.Equal(t, test.want, dbValue(t, test.table, test.column, "id", test.id))
		})
	}
}

// TestMergePatchRefusesNullActive covers a merge patch nulling active. The
// column is NOT NULL with a database default, so the write would fail deep
// in the database instead of telling the client what is wrong. Each body
// carries a valid change as well, which must stay uncommitted.
func TestMergePatchRefusesNullActive(t *testing.T) {
	tests := []struct {
		description string
		path        string
		body        string
		table       string
		column      string
		id          string
		want        string
	}{
		{
			"publisher", publisherPath + italiaPublisherID,
			`{"description": "patched", "active": null}`,
			"publishers", "description", italiaPublisherID, "Publisher description 1",
		},
		{
			"software", softwarePath + italiaSoftwareID,
			`{"publiccodeYml": "patched", "active": null}`,
			"software", "publiccode_yml", italiaSoftwareID, "-",
		},
		{
			"catalog", catalogPath + italiaID,
			`{"name": "patched", "active": null}`,
			"catalogs", "name", italiaID, "Italian Catalog",
		},
		{
			"bundle", "/v1/bundles/" + fixtureBundleID,
			`{"description": "patched", "active": null}`,
			"bundles", "description", fixtureBundleID, "Recommended software for municipalities",
		},
	}

	for _, test := range tests {
		t.Run(test.description, func(t *testing.T) {
			loadFixtures(t)

			code, body := patchMerge(t, test.path, test.body)

			assert.Equal(t, http.StatusUnprocessableEntity, code, "body: %s", body)
			assert.Contains(t, string(body), "active cannot be null")
			assert.Equal(t, test.want, dbValue(t, test.table, test.column, "id", test.id))
		})
	}
}

// TestPatchTestOpOnProtectedPathIsAllowed pins that a read-only field can
// still be named in a test operation, which reads it and changes nothing.
func TestPatchTestOpOnProtectedPathIsAllowed(t *testing.T) {
	tests := []struct {
		description string
		prefix      string
		id          string
		ops         string
		table       string
		column      string
		want        string
	}{
		{
			"software", softwarePath, italiaSoftwareID,
			`{"op": "test", "path": "/id", "value": "` + italiaSoftwareID + `"},
			 {"op": "replace", "path": "/publiccodeYml", "value": "patched"}`,
			"software", "publiccode_yml", "patched",
		},
		{
			"publisher", publisherPath, italiaPublisherID,
			`{"op": "test", "path": "/catalogId", "value": "` + italiaID + `"},
			 {"op": "replace", "path": "/description", "value": "patched"}`,
			"publishers", "description", "patched",
		},
		{
			"catalog", catalogPath, italiaID,
			`{"op": "test", "path": "/id", "value": "` + italiaID + `"},
			 {"op": "replace", "path": "/name", "value": "patched"}`,
			"catalogs", "name", "patched",
		},
	}

	for _, test := range tests {
		t.Run(test.description, func(t *testing.T) {
			loadFixtures(t)

			code, body := patchJSON(t, test.prefix+test.id, "["+test.ops+"]")

			assert.Equal(t, http.StatusOK, code, "body: %s", body)

			var response map[string]interface{}
			require.NoError(t, json.Unmarshal(body, &response))
			assert.Equal(t, test.id, response["id"])

			assert.Equal(t, test.want, dbValue(t, test.table, test.column, "id", test.id))
		})
	}
}

// TestPatchWithAFailingTestOpWritesNothing pins the atomicity of the patch
// past the protected path check: a test that fails refuses the whole patch.
func TestPatchWithAFailingTestOpWritesNothing(t *testing.T) {
	loadFixtures(t)

	ops := `[
		{"op": "replace", "path": "/publiccodeYml", "value": "patched"},
		{"op": "test", "path": "/id", "value": "` + unusedID + `"}
	]`

	code, _ := patchJSON(t, softwarePath+italiaSoftwareID, ops)

	assert.Equal(t, http.StatusUnprocessableEntity, code)

	assert.Equal(t, "-", dbValue(t, "software", "publiccode_yml", "id", italiaSoftwareID))
}

// TestPatchRejectsImmutableFieldsInMergePatch covers the other content type,
// where the request is decoded into a patch struct that has no such field.
func TestPatchRejectsImmutableFieldsInMergePatch(t *testing.T) {
	tests := []TestCase{
		{
			description:         "PATCH software with an id",
			query:               "PATCH /v1/software/" + italiaSoftwareID,
			body:                `{"id": "` + unusedID + `"}`,
			headers:             patchHeaders(),
			expectedCode:        422,
			expectedContentType: "application/problem+json",
			expectedBody:        `{"title":"can't update Software","detail":"unknown field in JSON input","status":422}`,
		},
		{
			description:         "PATCH software with a createdAt",
			query:               "PATCH /v1/software/" + italiaSoftwareID,
			body:                `{"createdAt": "` + forgedCreated + `"}`,
			headers:             patchHeaders(),
			expectedCode:        422,
			expectedContentType: "application/problem+json",
			expectedBody:        `{"title":"can't update Software","detail":"unknown field in JSON input","status":422}`,
		},
		{
			description:         "PATCH publisher with an id",
			query:               "PATCH /v1/publishers/" + italiaPublisherID,
			body:                `{"id": "` + unusedID + `"}`,
			headers:             patchHeaders(),
			expectedCode:        422,
			expectedContentType: "application/problem+json",
			expectedBody:        `{"title":"can't update Publisher","detail":"unknown field in JSON input","status":422}`,
		},
		{
			description:         "PATCH catalog with an id",
			query:               "PATCH /v1/catalogs/" + italiaID,
			body:                `{"id": "` + unusedID + `"}`,
			headers:             patchHeaders(),
			expectedCode:        422,
			expectedContentType: "application/problem+json",
			expectedBody:        `{"title":"can't update Catalog","detail":"unknown field in JSON input","status":422}`,
		},
		{
			description:         "PATCH log with an id",
			query:               "PATCH /v1/logs/2dfb2bc2-042d-11ed-9338-d8bbc146d165",
			body:                `{"id": "` + unusedID + `", "message": "patched"}`,
			headers:             patchHeaders(),
			expectedCode:        422,
			expectedContentType: "application/problem+json",
			expectedBody:        `{"title":"can't update Log","detail":"unknown field in JSON input","status":422}`,
		},
	}

	runTestCases(t, tests)
}

// TestPostRejectsServerOwnedFields covers the create side. The request is
// decoded into a struct that carries no id, no timestamps and no catalog
// assignment, so naming one has to be refused rather than quietly dropped.
func TestPostRejectsServerOwnedFields(t *testing.T) {
	tests := []TestCase{
		{
			description:         "POST publisher with an id",
			query:               "POST /v1/publishers",
			body:                `{"id": "` + unusedID + `", "description": "new", "codeHosting": [{"url": "https://post-1.example.org"}], "email": "post-1@example.org"}`,
			headers:             patchHeaders(),
			expectedCode:        422,
			expectedContentType: "application/problem+json",
			expectedBody:        `{"title":"can't create Publisher","detail":"unknown field in JSON input","status":422}`,
		},
		{
			description:         "POST publisher with a createdAt",
			query:               "POST /v1/publishers",
			body:                `{"createdAt": "` + forgedCreated + `", "description": "new", "codeHosting": [{"url": "https://post-2.example.org"}], "email": "post-2@example.org"}`,
			headers:             patchHeaders(),
			expectedCode:        422,
			expectedContentType: "application/problem+json",
			expectedBody:        `{"title":"can't create Publisher","detail":"unknown field in JSON input","status":422}`,
		},
		{
			description:         "POST publisher with a catalogId",
			query:               "POST /v1/publishers",
			body:                `{"catalogId": "` + swissID + `", "description": "new", "codeHosting": [{"url": "https://post-3.example.org"}], "email": "post-3@example.org"}`,
			headers:             patchHeaders(),
			expectedCode:        422,
			expectedContentType: "application/problem+json",
			expectedBody:        `{"title":"can't create Publisher","detail":"unknown field in JSON input","status":422}`,
		},
		{
			description:         "POST software with an id",
			query:               "POST /v1/software",
			body:                `{"id": "` + unusedID + `", "publiccodeYml": "-", "url": "https://post-4.example.org"}`,
			headers:             patchHeaders(),
			expectedCode:        422,
			expectedContentType: "application/problem+json",
			expectedBody:        `{"title":"can't create Software","detail":"unknown field in JSON input","status":422}`,
		},
		{
			description:         "POST software with a createdAt",
			query:               "POST /v1/software",
			body:                `{"createdAt": "` + forgedCreated + `", "publiccodeYml": "-", "url": "https://post-5.example.org"}`,
			headers:             patchHeaders(),
			expectedCode:        422,
			expectedContentType: "application/problem+json",
			expectedBody:        `{"title":"can't create Software","detail":"unknown field in JSON input","status":422}`,
		},
		{
			description:         "POST software with a catalogId",
			query:               "POST /v1/software",
			body:                `{"catalogId": "` + swissID + `", "publiccodeYml": "-", "url": "https://post-6.example.org"}`,
			headers:             patchHeaders(),
			expectedCode:        422,
			expectedContentType: "application/problem+json",
			expectedBody:        `{"title":"can't create Software","detail":"unknown field in JSON input","status":422}`,
		},
		{
			description:         "POST catalog with an id",
			query:               "POST /v1/catalogs",
			body:                `{"id": "` + unusedID + `", "name": "New Catalog", "sources": [{"url": "https://github.com/example/post-7"}]}`,
			headers:             patchHeaders(),
			expectedCode:        422,
			expectedContentType: "application/problem+json",
			expectedBody:        `{"title":"can't create Catalog","detail":"unknown field in JSON input","status":422}`,
		},
		{
			description:         "POST catalog with a createdAt",
			query:               "POST /v1/catalogs",
			body:                `{"createdAt": "` + forgedCreated + `", "name": "New Catalog", "sources": [{"url": "https://github.com/example/post-8"}]}`,
			headers:             patchHeaders(),
			expectedCode:        422,
			expectedContentType: "application/problem+json",
			expectedBody:        `{"title":"can't create Catalog","detail":"unknown field in JSON input","status":422}`,
		},
		{
			description:         "POST catalog publisher with a catalogId",
			query:               "POST /v1/catalogs/" + italiaID + "/publishers",
			body:                `{"catalogId": "` + swissID + `", "description": "new", "codeHosting": [{"url": "https://post-9.example.org"}], "email": "post-9@example.org"}`,
			headers:             patchHeaders(),
			expectedCode:        422,
			expectedContentType: "application/problem+json",
			expectedBody:        `{"title":"can't create Publisher","detail":"unknown field in JSON input","status":422}`,
		},
		{
			description:         "POST catalog software with a catalogId",
			query:               "POST /v1/catalogs/" + italiaID + "/software",
			body:                `{"catalogId": "` + swissID + `", "publiccodeYml": "-", "url": "https://post-10.example.org"}`,
			headers:             patchHeaders(),
			expectedCode:        422,
			expectedContentType: "application/problem+json",
			expectedBody:        `{"title":"can't create Software","detail":"unknown field in JSON input","status":422}`,
		},
		{
			description:         "POST log with an id",
			query:               "POST /v1/logs",
			body:                `{"id": "` + unusedID + `", "message": "new"}`,
			headers:             patchHeaders(),
			expectedCode:        422,
			expectedContentType: "application/problem+json",
			expectedBody:        `{"title":"can't create Log","detail":"unknown field in JSON input","status":422}`,
		},
		{
			description:         "POST webhook with an id",
			query:               "POST /v1/software/" + italiaSoftwareID + "/webhooks",
			body:                `{"id": "` + unusedID + `", "url": "https://post-11.example.org/hook"}`,
			headers:             patchHeaders(),
			expectedCode:        422,
			expectedContentType: "application/problem+json",
			expectedBody:        `{"title":"can't create Webhook","detail":"unknown field in JSON input","status":422}`,
		},
	}

	runTestCases(t, tests)
}

// TestPostAssignsItsOwnIdentifiers pins that a create answers with a server
// generated id and with timestamps of its own, so nothing a client sends can
// end up in those columns.
func TestPostAssignsItsOwnIdentifiers(t *testing.T) {
	tests := []TestCase{
		{
			description:         "POST publisher",
			query:               "POST /v1/publishers",
			body:                `{"description": "new", "codeHosting": [{"url": "https://post-12.example.org"}], "email": "post-12@example.org"}`,
			headers:             patchHeaders(),
			expectedCode:        200,
			expectedContentType: "application/json",
			validateFunc: func(t *testing.T, response map[string]interface{}) {
				t.Helper()

				assertUUID(t, response["id"])
				assert.NotEqual(t, unusedID, response["id"])
				assertTimestamps(t, response)
			},
		},
		{
			description:         "POST software",
			query:               "POST /v1/software",
			body:                `{"publiccodeYml": "-", "url": "https://post-13.example.org"}`,
			headers:             patchHeaders(),
			expectedCode:        200,
			expectedContentType: "application/json",
			validateFunc: func(t *testing.T, response map[string]interface{}) {
				t.Helper()

				assertUUID(t, response["id"])
				assert.NotEqual(t, unusedID, response["id"])
				assertTimestamps(t, response)
			},
		},
		{
			description:         "POST catalog",
			query:               "POST /v1/catalogs",
			body:                `{"name": "New Catalog", "sources": [{"url": "https://github.com/example/post-14"}]}`,
			headers:             patchHeaders(),
			expectedCode:        200,
			expectedContentType: "application/json",
			validateFunc: func(t *testing.T, response map[string]interface{}) {
				t.Helper()

				assertUUID(t, response["id"])
				assert.NotEqual(t, unusedID, response["id"])
				assertTimestamps(t, response)
			},
		},
	}

	runTestCases(t, tests)
}

func patchHeaders() map[string][]string {
	return map[string][]string{
		"Authorization": {goodToken},
		"Content-Type":  {"application/json"},
	}
}