From 675dfb3ea47dd882de7e49ab1b0ace79a5e8bb9b Mon Sep 17 00:00:00 2001
From: kolaente <k@knt.li>
Date: Tue, 10 Mar 2026 23:46:05 +0100
Subject: [PATCH] test: add web tests for bulk label task endpoint

---
 pkg/webtests/label_task_test.go | 68 +++++++++++++++++++++++++++++++++
 1 file changed, 68 insertions(+)
 create mode 100644 pkg/webtests/label_task_test.go

diff --git a/pkg/webtests/label_task_test.go b/pkg/webtests/label_task_test.go
new file mode 100644
index 000000000..b28511913
--- /dev/null
+++ b/pkg/webtests/label_task_test.go
@@ -0,0 +1,68 @@
+// Vikunja is a to-do list application to facilitate your life.
+// Copyright 2018-present Vikunja and contributors. All rights reserved.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+package webtests
+
+import (
+	"testing"
+
+	"code.vikunja.io/api/pkg/models"
+	"code.vikunja.io/api/pkg/web/handler"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestLabelTaskBulk(t *testing.T) {
+	testHandlerBulk := webHandlerTest{
+		user: &testuser1,
+		strFunc: func() handler.CObject {
+			return &models.LabelTaskBulk{}
+		},
+		t: t,
+	}
+
+	t.Run("Create", func(t *testing.T) {
+		t.Run("Normal", func(t *testing.T) {
+			rec, err := testHandlerBulk.testCreateWithUser(nil, map[string]string{"projecttask": "1"}, `{"labels":[{"id":1}]}`)
+			require.NoError(t, err)
+			assert.Contains(t, rec.Body.String(), `"labels"`)
+		})
+		t.Run("Nonexisting task", func(t *testing.T) {
+			_, err := testHandlerBulk.testCreateWithUser(nil, map[string]string{"projecttask": "9999"}, `{"labels":[{"id":1}]}`)
+			require.Error(t, err)
+			assertHandlerErrorCode(t, err, models.ErrCodeTaskDoesNotExist)
+		})
+		t.Run("Rights check", func(t *testing.T) {
+			t.Run("Forbidden", func(t *testing.T) {
+				// Task 34 is owned by user13, user1 has no access
+				_, err := testHandlerBulk.testCreateWithUser(nil, map[string]string{"projecttask": "34"}, `{"labels":[{"id":1}]}`)
+				require.Error(t, err)
+				assert.Contains(t, getHTTPErrorMessage(err), `Forbidden`)
+			})
+			t.Run("Shared Via Team write", func(t *testing.T) {
+				rec, err := testHandlerBulk.testCreateWithUser(nil, map[string]string{"projecttask": "16"}, `{"labels":[{"id":1}]}`)
+				require.NoError(t, err)
+				assert.Contains(t, rec.Body.String(), `"labels"`)
+			})
+			t.Run("Shared Via Team readonly", func(t *testing.T) {
+				_, err := testHandlerBulk.testCreateWithUser(nil, map[string]string{"projecttask": "15"}, `{"labels":[{"id":1}]}`)
+				require.Error(t, err)
+				assert.Contains(t, getHTTPErrorMessage(err), `Forbidden`)
+			})
+		})
+	})
+}