feat: action links, telegram webhook and channels API

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BCrwHHnGCB5XH968Nxokqw

core/tests/Feature/ActionLinksTest.php

@@ -0,0 +1,66 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Enums\AfterDue;
+use App\Enums\ChannelType;
+use App\Enums\DeliveryResult;
+use App\Enums\DueMode;
+use App\Enums\EventState;
+use App\Models\Channel;
+use App\Models\Delivery;
+use App\Models\Event;
+use App\Models\Source;
+use App\Models\User;
+use Carbon\CarbonImmutable;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class ActionLinksTest extends TestCase
+{
+    use RefreshDatabase;
+
+    private Event $event;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        CarbonImmutable::setTestNow('2026-09-30T11:17:00Z');
+        $source = Source::create(['name' => 'docs', 'token_hash' => hash('sha256', 'x')]);
+        $user = User::create(['login' => 'n', 'tz' => 'UTC', 'quiet_start' => '22:00:00', 'quiet_end' => '09:00:00']);
+        $channel = Channel::create(['user_id' => $user->id, 'type' => ChannelType::Webhook, 'config' => ['deliver_url' => 'u', 'presence_url' => 'p'], 'enabled' => true]);
+        $this->event = Event::create([
+            'source_id' => $source->id, 'user_id' => $user->id, 'source_ref' => 'r', 'topic' => '',
+            'due_mode' => DueMode::Local, 'due_date' => '2026-09-30', 'due_time' => '24:00:00', 'fire_on' => '2026-09-30',
+            'after_due' => AfterDue::Keep, 'payload' => ['title' => 'T'], 'state' => EventState::Today,
+            'quiet_until' => CarbonImmutable::parse('2000-01-01Z'),
+        ]);
+        Delivery::create(['event_id' => $this->event->id, 'channel_id' => $channel->id, 'window_start' => now(), 'action_token' => 'tok', 'result' => DeliveryResult::Ok]);
+    }
+
+    protected function tearDown(): void
+    {
+        CarbonImmutable::setTestNow();
+        parent::tearDown();
+    }
+
+    public function test_ack_by_token(): void
+    {
+        $this->postJson('/a/tok/ack')->assertOk()->assertJsonPath('state', 'today');
+        $this->assertSame('2026-09-30T13:00:00+00:00', $this->event->fresh()->quiet_until->toIso8601String());
+    }
+
+    public function test_done_by_token_then_gone(): void
+    {
+        $this->postJson('/a/tok/done')->assertOk()->assertJsonPath('state', 'done');
+        $this->assertSame(EventState::Done, $this->event->fresh()->state);
+
+        $this->postJson('/a/tok/done')->assertStatus(410);
+        $this->postJson('/a/tok/ack')->assertStatus(410);
+    }
+
+    public function test_unknown_token(): void
+    {
+        $this->postJson('/a/nope/done')->assertNotFound();
+    }
+}

core/tests/Feature/ChannelsApiTest.php

@@ -0,0 +1,63 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Enums\ChannelType;
+use App\Models\Channel;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
+use Tests\TestCase;
+
+class ChannelsApiTest extends TestCase
+{
+    use RefreshDatabase;
+
+    private array $as = ['X-Remote-User' => 'nikita'];
+
+    public function test_lists_channels_including_auto_web(): void
+    {
+        $this->getJson('/me/channels', $this->as)->assertOk()
+            ->assertJsonCount(1, 'channels')
+            ->assertJsonPath('channels.0.type', 'web');
+    }
+
+    public function test_adds_and_deletes_webhook_channel(): void
+    {
+        $r = $this->postJson('/me/channels', ['type' => 'webhook', 'config' => ['deliver_url' => 'https://ha.test/api/webhook/hado', 'presence_url' => 'https://ha.test/api/presence']], $this->as)
+            ->assertCreated()->assertJsonPath('type', 'webhook');
+
+        $this->deleteJson('/me/channels/'.$r->json('id'), [], $this->as)->assertNoContent();
+        $this->assertSame(1, Channel::count());
+    }
+
+    public function test_validates_webhook_config(): void
+    {
+        $this->postJson('/me/channels', ['type' => 'webhook', 'config' => ['deliver_url' => 'not a url']], $this->as)
+            ->assertStatus(422)->assertJsonValidationErrors(['config.deliver_url', 'config.presence_url']);
+        // telegram подключается только через /start, не через API
+        $this->postJson('/me/channels', ['type' => 'telegram', 'config' => ['chat_id' => 1]], $this->as)
+            ->assertStatus(422);
+    }
+
+    public function test_web_channel_cannot_be_deleted_and_foreign_channel_is_404(): void
+    {
+        $this->getJson('/me', $this->as);
+        $web = User::sole()->channels()->sole();
+        $this->deleteJson('/me/channels/'.$web->id, [], $this->as)->assertStatus(422);
+
+        $this->getJson('/me', ['X-Remote-User' => 'other']);
+        $foreign = Channel::create(['user_id' => User::where('login', 'other')->sole()->id, 'type' => ChannelType::Webhook, 'config' => ['deliver_url' => 'u', 'presence_url' => 'p'], 'enabled' => true]);
+        $this->deleteJson('/me/channels/'.$foreign->id, [], $this->as)->assertNotFound();
+    }
+
+    public function test_telegram_link_code(): void
+    {
+        $r = $this->postJson('/me/channels/telegram/link', [], $this->as)->assertOk();
+        $code = $r->json('code');
+
+        $this->assertSame(6, strlen($code));
+        $this->assertSame('https://t.me/hado_test_bot?start='.$code, $r->json('bot_url'));
+        $this->assertSame(User::sole()->id, Cache::get("tg:link:$code"));
+    }
+}

core/tests/Feature/TelegramWebhookTest.php

@@ -0,0 +1,99 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Enums\AfterDue;
+use App\Enums\ChannelType;
+use App\Enums\DeliveryResult;
+use App\Enums\DueMode;
+use App\Enums\EventState;
+use App\Models\Channel;
+use App\Models\Delivery;
+use App\Models\Event;
+use App\Models\Source;
+use App\Models\User;
+use Carbon\CarbonImmutable;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Http\Client\Request;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Http;
+use Tests\TestCase;
+
+class TelegramWebhookTest extends TestCase
+{
+    use RefreshDatabase;
+
+    private User $user;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        Http::fake(['api.telegram.org/*' => Http::response(['ok' => true, 'result' => []])]);
+        $this->user = User::create(['login' => 'n', 'tz' => 'UTC', 'quiet_start' => '22:00:00', 'quiet_end' => '09:00:00']);
+    }
+
+    private function secret(): array
+    {
+        return ['X-Telegram-Bot-Api-Secret-Token' => 'test-secret'];
+    }
+
+    public function test_rejects_wrong_secret(): void
+    {
+        $this->postJson('/hooks/telegram', ['message' => []])->assertStatus(403);
+        $this->postJson('/hooks/telegram', ['message' => []], ['X-Telegram-Bot-Api-Secret-Token' => 'wrong'])->assertStatus(403);
+    }
+
+    public function test_start_with_code_links_chat(): void
+    {
+        Cache::put('tg:link:ABC123', $this->user->id, 900);
+
+        $this->postJson('/hooks/telegram', ['message' => ['chat' => ['id' => 555], 'text' => '/start ABC123']], $this->secret())->assertNoContent();
+
+        $channel = $this->user->channels()->where('type', ChannelType::Telegram->value)->sole();
+        $this->assertSame(555, $channel->config['chat_id']);
+        $this->assertFalse(Cache::has('tg:link:ABC123'), 'код одноразовый');
+        $this->assertTrue(Cache::has('tg:seen:555'), 'взаимодействие = присутствие');
+        Http::assertSent(fn (Request $r) => str_ends_with($r->url(), '/sendMessage') && $r['text'] === 'Подключено');
+    }
+
+    public function test_start_with_bad_code_replies_error(): void
+    {
+        $this->postJson('/hooks/telegram', ['message' => ['chat' => ['id' => 555], 'text' => '/start NOPE']], $this->secret())->assertNoContent();
+        $this->assertSame(0, Channel::count());
+        Http::assertSent(fn (Request $r) => str_ends_with($r->url(), '/sendMessage') && str_contains($r['text'], 'Код'));
+    }
+
+    public function test_callback_ack_and_done(): void
+    {
+        CarbonImmutable::setTestNow('2026-09-30T11:17:00Z');
+        $source = Source::create(['name' => 'docs', 'token_hash' => hash('sha256', 'x')]);
+        $channel = Channel::create(['user_id' => $this->user->id, 'type' => ChannelType::Telegram, 'config' => ['chat_id' => 555], 'enabled' => true]);
+        $event = Event::create([
+            'source_id' => $source->id, 'user_id' => $this->user->id, 'source_ref' => 'r', 'topic' => '',
+            'due_mode' => DueMode::Local, 'due_date' => '2026-09-30', 'due_time' => '24:00:00', 'fire_on' => '2026-09-30',
+            'after_due' => AfterDue::Keep, 'payload' => ['title' => 'T'], 'state' => EventState::Today,
+            'quiet_until' => CarbonImmutable::parse('2000-01-01Z'),
+        ]);
+        Delivery::create(['event_id' => $event->id, 'channel_id' => $channel->id, 'window_start' => now(), 'action_token' => 'tok', 'result' => DeliveryResult::Ok, 'meta' => ['message_id' => 9001]]);
+
+        $cb = fn (string $data) => ['callback_query' => ['id' => 'cb1', 'data' => $data, 'message' => ['chat' => ['id' => 555], 'message_id' => 9001]]];
+
+        $this->postJson('/hooks/telegram', $cb('ack:tok'), $this->secret())->assertNoContent();
+        $this->assertSame('2026-09-30T13:00:00+00:00', $event->fresh()->quiet_until->toIso8601String());
+        Http::assertSent(fn (Request $r) => str_ends_with($r->url(), '/answerCallbackQuery') && $r['callback_query_id'] === 'cb1');
+
+        $this->postJson('/hooks/telegram', $cb('done:tok'), $this->secret())->assertNoContent();
+        $this->assertSame(EventState::Done, $event->fresh()->state);
+        Http::assertSent(fn (Request $r) => str_ends_with($r->url(), '/editMessageReplyMarkup') && $r['message_id'] === 9001);
+
+        $this->postJson('/hooks/telegram', $cb('done:tok'), $this->secret())->assertNoContent();
+        Http::assertSent(fn (Request $r) => str_ends_with($r->url(), '/answerCallbackQuery') && $r['text'] === 'Уже неактуально');
+
+        CarbonImmutable::setTestNow();
+    }
+
+    public function test_unrelated_update_is_ignored(): void
+    {
+        $this->postJson('/hooks/telegram', ['edited_message' => ['chat' => ['id' => 1]]], $this->secret())->assertNoContent();
+    }
+}