tests/api/v1/conftest.py

@@ -0,0 +1,38 @@
+"""Pytest fixtures shared across API v1 tests."""
+from __future__ import annotations
+
+from collections.abc import AsyncGenerator
+
+import pytest_asyncio
+from httpx import ASGITransport, AsyncClient
+from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker, create_async_engine
+
+from app.api.deps import get_db_session
+from app.main import create_app
+from app.models import Base
+
+
+@pytest_asyncio.fixture()
+async def session_factory() -> AsyncGenerator[async_sessionmaker[AsyncSession], None]:
+    engine = create_async_engine("sqlite+aiosqlite:///:memory:", future=True)
+    async with engine.begin() as conn:
+        await conn.run_sync(Base.metadata.create_all)
+    factory = async_sessionmaker(engine, expire_on_commit=False)
+    yield factory
+    await engine.dispose()
+
+
+@pytest_asyncio.fixture()
+async def client(
+    session_factory: async_sessionmaker[AsyncSession],
+) -> AsyncGenerator[AsyncClient, None]:
+    app = create_app()
+
+    async def _get_session_override() -> AsyncGenerator[AsyncSession, None]:
+        async with session_factory() as session:
+            yield session
+
+    app.dependency_overrides[get_db_session] = _get_session_override
+    transport = ASGITransport(app=app)
+    async with AsyncClient(transport=transport, base_url="http://testserver") as test_client:
+        yield test_client

tests/api/v1/task_activity_shared.py

@@ -0,0 +1,101 @@
+"""Shared helpers for task and activity API tests."""
+from __future__ import annotations
+
+from dataclasses import dataclass
+from datetime import timedelta
+
+from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker
+
+from app.core.security import jwt_service
+from app.models.contact import Contact
+from app.models.deal import Deal
+from app.models.organization import Organization
+from app.models.organization_member import OrganizationMember, OrganizationRole
+from app.models.user import User
+
+
+@dataclass(slots=True)
+class Scenario:
+    """Captures seeded entities for API tests."""
+
+    user_id: int
+    user_email: str
+    organization_id: int
+    contact_id: int
+    deal_id: int
+
+
+async def prepare_scenario(session_factory: async_sessionmaker[AsyncSession]) -> Scenario:
+    async with session_factory() as session:
+        user = User(email="owner@example.com", hashed_password="hashed", name="Owner", is_active=True)
+        org = Organization(name="Acme LLC")
+        session.add_all([user, org])
+        await session.flush()
+
+        membership = OrganizationMember(
+            organization_id=org.id,
+            user_id=user.id,
+            role=OrganizationRole.OWNER,
+        )
+        session.add(membership)
+
+        contact = Contact(
+            organization_id=org.id,
+            owner_id=user.id,
+            name="John Doe",
+            email="john@example.com",
+        )
+        session.add(contact)
+        await session.flush()
+
+        deal = Deal(
+            organization_id=org.id,
+            contact_id=contact.id,
+            owner_id=user.id,
+            title="Website redesign",
+            amount=None,
+        )
+        session.add(deal)
+        await session.commit()
+
+    return Scenario(
+        user_id=user.id,
+        user_email=user.email,
+        organization_id=org.id,
+        contact_id=contact.id,
+        deal_id=deal.id,
+    )
+
+
+async def create_deal(
+    session_factory: async_sessionmaker[AsyncSession],
+    *,
+    scenario: Scenario,
+    title: str,
+) -> int:
+    async with session_factory() as session:
+        deal = Deal(
+            organization_id=scenario.organization_id,
+            contact_id=scenario.contact_id,
+            owner_id=scenario.user_id,
+            title=title,
+            amount=None,
+        )
+        session.add(deal)
+        await session.commit()
+        return deal.id
+
+
+def auth_headers(token: str, scenario: Scenario) -> dict[str, str]:
+    return {
+        "Authorization": f"Bearer {token}",
+        "X-Organization-Id": str(scenario.organization_id),
+    }
+
+
+def make_token(user_id: int, email: str) -> str:
+    return jwt_service.create_access_token(
+        subject=str(user_id),
+        expires_delta=timedelta(minutes=30),
+        claims={"email": email},
+    )

tests/api/v1/test_activities.py

@@ -0,0 +1,63 @@
+"""API tests for activity endpoints."""
+from __future__ import annotations
+
+from datetime import datetime, timedelta, timezone
+
+import pytest
+from httpx import AsyncClient
+from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker
+
+from app.models.activity import Activity, ActivityType
+
+from tests.api.v1.task_activity_shared import auth_headers, make_token, prepare_scenario
+
+
+@pytest.mark.asyncio
+async def test_create_activity_comment_endpoint(
+    session_factory: async_sessionmaker[AsyncSession], client: AsyncClient
+) -> None:
+    scenario = await prepare_scenario(session_factory)
+    token = make_token(scenario.user_id, scenario.user_email)
+
+    response = await client.post(
+        f"/api/v1/deals/{scenario.deal_id}/activities/",
+        json={"type": "comment", "payload": {"text": "  hello world  "}},
+        headers=auth_headers(token, scenario),
+    )
+
+    assert response.status_code == 201
+    payload = response.json()
+    assert payload["payload"]["text"] == "hello world"
+    assert payload["type"] == ActivityType.COMMENT.value
+
+
+@pytest.mark.asyncio
+async def test_list_activities_endpoint_supports_pagination(
+    session_factory: async_sessionmaker[AsyncSession], client: AsyncClient
+) -> None:
+    scenario = await prepare_scenario(session_factory)
+    token = make_token(scenario.user_id, scenario.user_email)
+
+    base_time = datetime.now(timezone.utc)
+    async with session_factory() as session:
+        for index in range(3):
+            activity = Activity(
+                deal_id=scenario.deal_id,
+                author_id=scenario.user_id,
+                type=ActivityType.COMMENT,
+                payload={"text": f"Entry {index}"},
+                created_at=base_time + timedelta(seconds=index),
+            )
+            session.add(activity)
+        await session.commit()
+
+    response = await client.get(
+        f"/api/v1/deals/{scenario.deal_id}/activities/?limit=2&offset=1",
+        headers=auth_headers(token, scenario),
+    )
+
+    assert response.status_code == 200
+    data = response.json()
+    assert len(data) == 2
+    assert data[0]["payload"]["text"] == "Entry 1"
+    assert data[1]["payload"]["text"] == "Entry 2"

tests/api/v1/test_tasks.py

@@ -0,0 +1,78 @@
+"""API tests for task endpoints."""
+from __future__ import annotations
+
+from datetime import date, datetime, timedelta, timezone
+
+import pytest
+from httpx import AsyncClient
+from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker
+
+from app.models.task import Task
+
+from tests.api.v1.task_activity_shared import auth_headers, create_deal, make_token, prepare_scenario
+
+
+@pytest.mark.asyncio
+async def test_create_task_endpoint_creates_task_and_activity(
+    session_factory: async_sessionmaker[AsyncSession], client: AsyncClient
+) -> None:
+    scenario = await prepare_scenario(session_factory)
+    token = make_token(scenario.user_id, scenario.user_email)
+    due_date = (date.today() + timedelta(days=5)).isoformat()
+
+    response = await client.post(
+        "/api/v1/tasks/",
+        json={
+            "deal_id": scenario.deal_id,
+            "title": "Prepare proposal",
+            "description": "Send draft",
+            "due_date": due_date,
+        },
+        headers=auth_headers(token, scenario),
+    )
+
+    assert response.status_code == 201
+    payload = response.json()
+    assert payload["deal_id"] == scenario.deal_id
+    assert payload["title"] == "Prepare proposal"
+    assert payload["is_done"] is False
+
+
+@pytest.mark.asyncio
+async def test_list_tasks_endpoint_filters_by_deal(
+    session_factory: async_sessionmaker[AsyncSession], client: AsyncClient
+) -> None:
+    scenario = await prepare_scenario(session_factory)
+    token = make_token(scenario.user_id, scenario.user_email)
+    other_deal_id = await create_deal(session_factory, scenario=scenario, title="Renewal")
+
+    async with session_factory() as session:
+        session.add_all(
+            [
+                Task(
+                    deal_id=scenario.deal_id,
+                    title="Task A",
+                    description=None,
+                    due_date=datetime.now(timezone.utc) + timedelta(days=2),
+                    is_done=False,
+                ),
+                Task(
+                    deal_id=other_deal_id,
+                    title="Task B",
+                    description=None,
+                    due_date=datetime.now(timezone.utc) + timedelta(days=3),
+                    is_done=False,
+                ),
+            ]
+        )
+        await session.commit()
+
+    response = await client.get(
+        f"/api/v1/tasks/?deal_id={scenario.deal_id}",
+        headers=auth_headers(token, scenario),
+    )
+
+    assert response.status_code == 200
+    data = response.json()
+    assert len(data) == 1
+    assert data[0]["title"] == "Task A"

tests/services/test_activity_service.py

@@ -0,0 +1,164 @@
+"""Unit tests for ActivityService."""
+from __future__ import annotations
+
+from collections.abc import AsyncGenerator
+import uuid
+
+import pytest
+import pytest_asyncio
+from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker, create_async_engine
+from sqlalchemy.pool import StaticPool
+
+from app.models.activity import Activity, ActivityType
+from app.models.base import Base
+from app.models.contact import Contact
+from app.models.deal import Deal
+from app.models.organization import Organization
+from app.models.organization_member import OrganizationMember, OrganizationRole
+from app.models.user import User
+from app.repositories.activity_repo import ActivityRepository
+from app.services.activity_service import (
+    ActivityForbiddenError,
+    ActivityListFilters,
+    ActivityService,
+    ActivityValidationError,
+)
+from app.services.organization_service import OrganizationContext
+
+
+@pytest_asyncio.fixture()
+async def session() -> AsyncGenerator[AsyncSession, None]:
+    engine = create_async_engine(
+        "sqlite+aiosqlite:///:memory:",
+        future=True,
+        poolclass=StaticPool,
+    )
+    async with engine.begin() as conn:
+        await conn.run_sync(Base.metadata.create_all)
+    session_factory = async_sessionmaker(engine, expire_on_commit=False)
+    async with session_factory() as session:
+        yield session
+    await engine.dispose()
+
+
+def _make_user(suffix: str) -> User:
+    return User(
+        email=f"user-{suffix}@example.com",
+        hashed_password="hashed",
+        name="Test",
+        is_active=True,
+    )
+
+
+async def _prepare_deal(
+    session: AsyncSession,
+    *,
+    role: OrganizationRole = OrganizationRole.MANAGER,
+) -> tuple[OrganizationContext, ActivityRepository, int, Organization]:
+    org = Organization(name=f"Org-{uuid.uuid4()}"[:8])
+    user = _make_user("owner")
+    session.add_all([org, user])
+    await session.flush()
+
+    contact = Contact(
+        organization_id=org.id,
+        owner_id=user.id,
+        name="Alice",
+        email="alice@example.com",
+    )
+    session.add(contact)
+    await session.flush()
+
+    deal = Deal(
+        organization_id=org.id,
+        contact_id=contact.id,
+        owner_id=user.id,
+        title="Activity",
+        amount=None,
+    )
+    session.add(deal)
+    await session.flush()
+
+    membership = OrganizationMember(organization_id=org.id, user_id=user.id, role=role)
+    context = OrganizationContext(organization=org, membership=membership)
+    return context, ActivityRepository(session=session), deal.id, org
+
+
+@pytest.mark.asyncio
+async def test_list_activities_returns_only_current_deal(session: AsyncSession) -> None:
+    context, repo, deal_id, _ = await _prepare_deal(session)
+    service = ActivityService(repository=repo)
+
+    session.add_all(
+        [
+            Activity(deal_id=deal_id, author_id=context.user_id, type=ActivityType.COMMENT, payload={"text": "hi"}),
+            Activity(deal_id=deal_id + 1, author_id=context.user_id, type=ActivityType.SYSTEM, payload={}),
+        ]
+    )
+    await session.flush()
+
+    activities = await service.list_activities(
+        filters=ActivityListFilters(deal_id=deal_id, limit=10, offset=0),
+        context=context,
+    )
+
+    assert len(activities) == 1
+    assert activities[0].deal_id == deal_id
+
+
+@pytest.mark.asyncio
+async def test_add_comment_rejects_empty_text(session: AsyncSession) -> None:
+    context, repo, deal_id, _ = await _prepare_deal(session)
+    service = ActivityService(repository=repo)
+
+    with pytest.raises(ActivityValidationError):
+        await service.add_comment(deal_id=deal_id, author_id=context.user_id, text="   ", context=context)
+
+
+@pytest.mark.asyncio
+async def test_record_activity_blocks_foreign_deal(session: AsyncSession) -> None:
+    context, repo, _deal_id, _ = await _prepare_deal(session)
+    service = ActivityService(repository=repo)
+    # Create a second deal in another organization
+    other_org = Organization(name="External")
+    other_user = _make_user("external")
+    session.add_all([other_org, other_user])
+    await session.flush()
+    other_contact = Contact(
+        organization_id=other_org.id,
+        owner_id=other_user.id,
+        name="Bob",
+        email="bob@example.com",
+    )
+    session.add(other_contact)
+    await session.flush()
+    other_deal = Deal(
+        organization_id=other_org.id,
+        contact_id=other_contact.id,
+        owner_id=other_user.id,
+        title="Foreign",
+        amount=None,
+    )
+    session.add(other_deal)
+    await session.flush()
+
+    with pytest.raises(ActivityForbiddenError):
+        await service.list_activities(
+            filters=ActivityListFilters(deal_id=other_deal.id),
+            context=context,
+        )
+
+
+@pytest.mark.asyncio
+async def test_add_comment_trims_payload_text(session: AsyncSession) -> None:
+    context, repo, deal_id, _ = await _prepare_deal(session)
+    service = ActivityService(repository=repo)
+
+    activity = await service.add_comment(
+        deal_id=deal_id,
+        author_id=context.user_id,
+        text="  trimmed text  ",
+        context=context,
+    )
+
+    assert activity.payload["text"] == "trimmed text"

tests/services/test_task_service.py

@@ -0,0 +1,199 @@
+"""Unit tests for TaskService."""
+from __future__ import annotations
+
+from collections.abc import AsyncGenerator
+from datetime import datetime, timedelta, timezone
+import uuid
+
+import pytest
+import pytest_asyncio
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker, create_async_engine
+from sqlalchemy.pool import StaticPool
+
+from app.models.activity import Activity, ActivityType
+from app.models.base import Base
+from app.models.contact import Contact
+from app.models.deal import Deal
+from app.models.organization import Organization
+from app.models.organization_member import OrganizationMember, OrganizationRole
+from app.models.task import TaskCreate
+from app.models.user import User
+from app.repositories.activity_repo import ActivityRepository
+from app.repositories.task_repo import TaskRepository
+from app.services.organization_service import OrganizationContext
+from app.services.task_service import (
+    TaskDueDateError,
+    TaskForbiddenError,
+    TaskService,
+    TaskUpdateData,
+)
+
+
+@pytest_asyncio.fixture()
+async def session() -> AsyncGenerator[AsyncSession, None]:
+    engine = create_async_engine(
+        "sqlite+aiosqlite:///:memory:",
+        future=True,
+        poolclass=StaticPool,
+    )
+    async with engine.begin() as conn:
+        await conn.run_sync(Base.metadata.create_all)
+    session_factory = async_sessionmaker(engine, expire_on_commit=False)
+    async with session_factory() as session:
+        yield session
+    await engine.dispose()
+
+
+def _make_user(suffix: str) -> User:
+    return User(
+        email=f"user-{suffix}@example.com",
+        hashed_password="hashed",
+        name="Test User",
+        is_active=True,
+    )
+
+
+async def _setup_environment(
+    session: AsyncSession,
+    *,
+    role: OrganizationRole = OrganizationRole.MANAGER,
+    context_user: User | None = None,
+    owner_user: User | None = None,
+) -> tuple[OrganizationContext, User, User, int, TaskRepository, ActivityRepository]:
+    org = Organization(name=f"Org-{uuid.uuid4()}"[:8])
+    owner = owner_user or _make_user("owner")
+    ctx_user = context_user or owner
+    session.add_all([org, owner])
+    if ctx_user is not owner:
+        session.add(ctx_user)
+    await session.flush()
+
+    contact = Contact(
+        organization_id=org.id,
+        owner_id=owner.id,
+        name="John Doe",
+        email="john@example.com",
+    )
+    session.add(contact)
+    await session.flush()
+
+    deal = Deal(
+        organization_id=org.id,
+        contact_id=contact.id,
+        owner_id=owner.id,
+        title="Implementation",
+        amount=None,
+    )
+    session.add(deal)
+    await session.flush()
+
+    membership = OrganizationMember(organization_id=org.id, user_id=ctx_user.id, role=role)
+    context = OrganizationContext(organization=org, membership=membership)
+    task_repo = TaskRepository(session=session)
+    activity_repo = ActivityRepository(session=session)
+    return context, owner, ctx_user, deal.id, task_repo, activity_repo
+
+
+@pytest.mark.asyncio
+async def test_create_task_logs_activity(session: AsyncSession) -> None:
+    context, owner, _, deal_id, task_repo, activity_repo = await _setup_environment(session)
+    service = TaskService(task_repository=task_repo, activity_repository=activity_repo)
+
+    due_date = datetime.now(timezone.utc) + timedelta(days=2)
+    task = await service.create_task(
+        TaskCreate(
+            deal_id=deal_id,
+            title="Follow up",
+            description="Call client",
+            due_date=due_date,
+        ),
+        context=context,
+    )
+
+    result = await session.scalars(select(Activity).where(Activity.deal_id == deal_id))
+    activities = result.all()
+    assert len(activities) == 1
+    assert activities[0].type == ActivityType.TASK_CREATED
+    assert activities[0].payload["task_id"] == task.id
+    assert activities[0].payload["title"] == task.title
+
+
+@pytest.mark.asyncio
+async def test_member_cannot_create_task_for_foreign_deal(session: AsyncSession) -> None:
+    owner = _make_user("owner")
+    member = _make_user("member")
+    context, _, _, deal_id, task_repo, activity_repo = await _setup_environment(
+        session,
+        role=OrganizationRole.MEMBER,
+        context_user=member,
+        owner_user=owner,
+    )
+    service = TaskService(task_repository=task_repo, activity_repository=activity_repo)
+
+    with pytest.raises(TaskForbiddenError):
+        await service.create_task(
+            TaskCreate(
+                deal_id=deal_id,
+                title="Follow up",
+                description=None,
+                due_date=datetime.now(timezone.utc) + timedelta(days=1),
+            ),
+            context=context,
+        )
+
+
+@pytest.mark.asyncio
+async def test_due_date_cannot_be_in_past(session: AsyncSession) -> None:
+    context, _, _, deal_id, task_repo, activity_repo = await _setup_environment(session)
+    service = TaskService(task_repository=task_repo, activity_repository=activity_repo)
+
+    with pytest.raises(TaskDueDateError):
+        await service.create_task(
+            TaskCreate(
+                deal_id=deal_id,
+                title="Late",
+                description=None,
+                due_date=datetime.now(timezone.utc) - timedelta(days=1),
+            ),
+            context=context,
+        )
+
+
+@pytest.mark.asyncio
+async def test_member_cannot_update_foreign_task(session: AsyncSession) -> None:
+    # First create a task as the owner
+    owner = _make_user("owner")
+    context_owner, _, _, deal_id, task_repo, activity_repo = await _setup_environment(
+        session,
+        context_user=owner,
+        owner_user=owner,
+    )
+    service = TaskService(task_repository=task_repo, activity_repository=activity_repo)
+    task = await service.create_task(
+        TaskCreate(
+            deal_id=deal_id,
+            title="Prepare deck",
+            description=None,
+            due_date=datetime.now(timezone.utc) + timedelta(days=5),
+        ),
+        context=context_owner,
+    )
+
+    # Attempt to update it as another member
+    member = _make_user("member")
+    session.add(member)
+    await session.flush()
+    membership = OrganizationMember(
+        organization_id=context_owner.organization_id,
+        user_id=member.id,
+        role=OrganizationRole.MEMBER,
+    )
+    member_context = OrganizationContext(organization=context_owner.organization, membership=membership)
+
+    with pytest.raises(TaskForbiddenError):
+        await service.update_task(
+            task.id,
+            TaskUpdateData(is_done=True),
+            context=member_context,
+        )