From 5fd1b413c39048d0af68b339d5019d68a000c218 Mon Sep 17 00:00:00 2001
From: Dave <david.els1@outlook.com>
Date: Mon, 21 Sep 2026 06:30:49 +0200
Subject: [PATCH] test(intake): public route invariants and bad-token 404s
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Phase 8a Task 17. Mirrors the existing intake-submit.test.ts pattern:
- happy path: card lands in inbox with created_by_role=anonymous
- counter bump: submission_count and last_submission_at update
- hostile brief: server-set fields cannot be overridden, even when
  the body includes top-level priority/accepted/column/created_by
- none of unknown/revoked/expired/malformed tokens reach the
  handler — they all 404 with the same wording
- deleted-project token: link cascades away, 404 follows
- activity log: card_submitted_anonymously row written

Deviation from plan: the second project needs an explicit Inbox
column created in beforeAll — the schema does not auto-create one
for new projects.
---
 tests/integration/intake-submit-public.test.ts | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/tests/integration/intake-submit-public.test.ts b/tests/integration/intake-submit-public.test.ts
index 122374a..9a926a3 100644
--- a/tests/integration/intake-submit-public.test.ts
+++ b/tests/integration/intake-submit-public.test.ts
@@ -63,11 +63,15 @@ beforeAll(async () => {
   });
   anotherProjectId = another.id;
 
-  anotherInboxId = (
-    await admin
-      .collection("columns")
-      .getFirstListItem(`project = "${anotherProjectId}" && is_inbox = true`)
-  ).id;
+  // The schema doesn't auto-create an Inbox column for new projects; the test
+  // owns the fixture it relies on.
+  const anotherColumn = await admin.collection("columns").create({
+    project: anotherProjectId,
+    name: "Inbox",
+    position: 1000,
+    is_inbox: true,
+  });
+  anotherInboxId = anotherColumn.id;
 });
 
 afterAll(async () => {