added delete timesheet API endpoint (#726)

src/API/TimesheetController.php

@@ -349,4 +349,47 @@ class TimesheetController extends BaseApiController
 
         return $this->viewHandler->handle($view);
     }
+
+    /**
+     * Delete an existing timesheet record
+     *
+     * @SWG\Delete(
+     *      @SWG\Response(
+     *          response=204,
+     *          description="Delete one timesheet record"
+     *      ),
+     * )
+     * @SWG\Parameter(
+     *      name="id",
+     *      in="path",
+     *      type="integer",
+     *      description="Timesheet record ID to delete",
+     *      required=true,
+     * )
+     *
+     * @Security("is_granted('delete_own_timesheet') or is_granted('delete_other_timesheet')")
+     *
+     * @param int $id
+     * @return Response
+     */
+    public function deleteAction($id)
+    {
+        $timesheet = $this->repository->find($id);
+
+        if (null === $timesheet) {
+            throw new NotFoundException();
+        }
+
+        if (!$this->isGranted('delete', $timesheet)) {
+            throw $this->createAccessDeniedException('You are not allowed to delete this timesheet');
+        }
+
+        $entityManager = $this->getDoctrine()->getManager();
+        $entityManager->remove($timesheet);
+        $entityManager->flush();
+
+        $view = new View(null, Response::HTTP_NO_CONTENT);
+
+        return $this->viewHandler->handle($view);
+    }
 }

tests/API/TimesheetControllerTest.php

@@ -408,6 +408,58 @@ class TimesheetControllerTest extends APIControllerBaseTest
         $this->assertApiCallValidationError($response, ['end', 'activity']);
     }
 
+    public function testDeleteAction()
+    {
+        $client = $this->getClientForAuthenticatedUser(User::ROLE_USER);
+        $this->assertAccessIsGranted($client, '/api/timesheets/1');
+        $result = json_decode($client->getResponse()->getContent(), true);
+
+        $this->assertIsArray($result);
+        $this->assertDefaultStructure($result);
+        $this->assertNotEmpty($result['id']);
+        $id = $result['id'];
+
+        $this->request($client, '/api/timesheets/' . $id, 'DELETE');
+        $this->assertTrue($client->getResponse()->isSuccessful());
+        $this->assertEquals(Response::HTTP_NO_CONTENT, $client->getResponse()->getStatusCode());
+        $this->assertEmpty($client->getResponse()->getContent());
+
+        $this->assertEntityNotFound(User::ROLE_USER, '/api/timesheets/' . $id);
+    }
+
+    public function testDeleteActionForDifferentUser()
+    {
+        $client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
+        $this->assertAccessIsGranted($client, '/api/timesheets/1');
+        $result = json_decode($client->getResponse()->getContent(), true);
+
+        $this->assertIsArray($result);
+        $this->assertDefaultStructure($result);
+        $this->assertNotEmpty($result['id']);
+        $id = $result['id'];
+
+        $this->request($client, '/api/timesheets/' . $id, 'DELETE');
+        $this->assertTrue($client->getResponse()->isSuccessful());
+        $this->assertEquals(Response::HTTP_NO_CONTENT, $client->getResponse()->getStatusCode());
+        $this->assertEmpty($client->getResponse()->getContent());
+
+        $this->assertEntityNotFound(User::ROLE_USER, '/api/timesheets/' . $id);
+    }
+
+    public function testDeleteActionWithoutAuthorization()
+    {
+        $this->importFixtureForUser(User::ROLE_ADMIN);
+        $client = $this->getClientForAuthenticatedUser(User::ROLE_USER);
+
+        $this->request($client, '/api/timesheets/15', 'DELETE');
+
+        $response = $client->getResponse();
+        $this->assertFalse($response->isSuccessful());
+        $this->assertEquals(Response::HTTP_FORBIDDEN, $response->getStatusCode());
+        $json = json_decode($response->getContent(), true);
+        $this->assertEquals('You are not allowed to delete this timesheet', $json['message']);
+    }
+
     protected function assertDefaultStructure(array $result, $full = true)
     {
         $expectedKeys = [