From ccf4e3252347118aded214473546a6f9aa8006d3 Mon Sep 17 00:00:00 2001
From: Kevin Papst <kevinpapst@users.noreply.github.com>
Date: Thu, 25 Apr 2019 18:27:58 +0200
Subject: [PATCH] added delete timesheet API endpoint (#726)

---
 src/API/TimesheetController.php       | 43 ++++++++++++++++++++++
 tests/API/TimesheetControllerTest.php | 52 +++++++++++++++++++++++++++
 2 files changed, 95 insertions(+)

diff --git a/src/API/TimesheetController.php b/src/API/TimesheetController.php
index 68e9ef87..f9a6b9d8 100644
--- a/src/API/TimesheetController.php
+++ b/src/API/TimesheetController.php
@@ -349,4 +349,47 @@ class TimesheetController extends BaseApiController
 
         return $this->viewHandler->handle($view);
     }
+
+    /**
+     * Delete an existing timesheet record
+     *
+     * @SWG\Delete(
+     *      @SWG\Response(
+     *          response=204,
+     *          description="Delete one timesheet record"
+     *      ),
+     * )
+     * @SWG\Parameter(
+     *      name="id",
+     *      in="path",
+     *      type="integer",
+     *      description="Timesheet record ID to delete",
+     *      required=true,
+     * )
+     *
+     * @Security("is_granted('delete_own_timesheet') or is_granted('delete_other_timesheet')")
+     *
+     * @param int $id
+     * @return Response
+     */
+    public function deleteAction($id)
+    {
+        $timesheet = $this->repository->find($id);
+
+        if (null === $timesheet) {
+            throw new NotFoundException();
+        }
+
+        if (!$this->isGranted('delete', $timesheet)) {
+            throw $this->createAccessDeniedException('You are not allowed to delete this timesheet');
+        }
+
+        $entityManager = $this->getDoctrine()->getManager();
+        $entityManager->remove($timesheet);
+        $entityManager->flush();
+
+        $view = new View(null, Response::HTTP_NO_CONTENT);
+
+        return $this->viewHandler->handle($view);
+    }
 }
diff --git a/tests/API/TimesheetControllerTest.php b/tests/API/TimesheetControllerTest.php
index afa399a9..78acb18d 100644
--- a/tests/API/TimesheetControllerTest.php
+++ b/tests/API/TimesheetControllerTest.php
@@ -408,6 +408,58 @@ class TimesheetControllerTest extends APIControllerBaseTest
         $this->assertApiCallValidationError($response, ['end', 'activity']);
     }
 
+    public function testDeleteAction()
+    {
+        $client = $this->getClientForAuthenticatedUser(User::ROLE_USER);
+        $this->assertAccessIsGranted($client, '/api/timesheets/1');
+        $result = json_decode($client->getResponse()->getContent(), true);
+
+        $this->assertIsArray($result);
+        $this->assertDefaultStructure($result);
+        $this->assertNotEmpty($result['id']);
+        $id = $result['id'];
+
+        $this->request($client, '/api/timesheets/' . $id, 'DELETE');
+        $this->assertTrue($client->getResponse()->isSuccessful());
+        $this->assertEquals(Response::HTTP_NO_CONTENT, $client->getResponse()->getStatusCode());
+        $this->assertEmpty($client->getResponse()->getContent());
+
+        $this->assertEntityNotFound(User::ROLE_USER, '/api/timesheets/' . $id);
+    }
+
+    public function testDeleteActionForDifferentUser()
+    {
+        $client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
+        $this->assertAccessIsGranted($client, '/api/timesheets/1');
+        $result = json_decode($client->getResponse()->getContent(), true);
+
+        $this->assertIsArray($result);
+        $this->assertDefaultStructure($result);
+        $this->assertNotEmpty($result['id']);
+        $id = $result['id'];
+
+        $this->request($client, '/api/timesheets/' . $id, 'DELETE');
+        $this->assertTrue($client->getResponse()->isSuccessful());
+        $this->assertEquals(Response::HTTP_NO_CONTENT, $client->getResponse()->getStatusCode());
+        $this->assertEmpty($client->getResponse()->getContent());
+
+        $this->assertEntityNotFound(User::ROLE_USER, '/api/timesheets/' . $id);
+    }
+
+    public function testDeleteActionWithoutAuthorization()
+    {
+        $this->importFixtureForUser(User::ROLE_ADMIN);
+        $client = $this->getClientForAuthenticatedUser(User::ROLE_USER);
+
+        $this->request($client, '/api/timesheets/15', 'DELETE');
+
+        $response = $client->getResponse();
+        $this->assertFalse($response->isSuccessful());
+        $this->assertEquals(Response::HTTP_FORBIDDEN, $response->getStatusCode());
+        $json = json_decode($response->getContent(), true);
+        $this->assertEquals('You are not allowed to delete this timesheet', $json['message']);
+    }
+
     protected function assertDefaultStructure(array $result, $full = true)
     {
         $expectedKeys = [