feat: scaffold personal progress monitor MVP

tests/test_api.py

@@ -0,0 +1,31 @@
+from datetime import date
+
+
+def payload(name="API 任务"):
+    return {"name": name, "startDate": "2026-08-01", "priority": 3, "metrics": [{"name": "完成", "kind": "checkin", "period": "day"}]}
+
+
+def test_api_crud_order_layout_and_daily(client):
+    response = client.get("/api/health"); assert response.status_code == 200
+    assert client.get("/api/layouts/home").json()["page"] == "home"
+    first = client.post("/api/tasks", json=payload("第一项")); assert first.status_code == 201
+    second = client.post("/api/tasks", json=payload("第二项")).json()
+    task = first.json(); metric_id = task["metrics"][0]["metricId"]
+    listed = client.get("/api/tasks").json(); assert len(listed["items"]) == 2
+    reordered = client.put("/api/tasks/reorder/all", json={"taskIds": [second["taskId"], task["taskId"]], "expectedVersion": listed["version"]})
+    assert reordered.status_code == 200
+    saved = client.put(f"/api/tasks/{task['taskId']}/daily/2026-08-20", json={"values": [{"metricId": metric_id, "value": 1}], "note": "完成"})
+    assert saved.status_code == 200
+    assert client.get(f"/api/tasks/{task['taskId']}/history?start=2026-08-20&end=2026-08-20").json()["records"]
+
+
+def test_invalid_input_and_auth(auth_client):
+    assert auth_client.get("/api/tasks").status_code == 401
+    login = auth_client.post("/api/auth/login", json={"password": "secret"}); assert login.status_code == 200
+    assert auth_client.get("/api/tasks").status_code == 200
+    csrf = login.json()["csrfToken"]
+    bad = auth_client.post("/api/tasks", json={"name": "", "startDate": "2026-08-01", "metrics": []}, headers={"X-CSRF-Token": csrf})
+    assert bad.status_code == 422
+    forbidden = auth_client.post("/api/tasks", json=payload())
+    assert forbidden.status_code == 403
+