@johnnyboy11234/esg-idea-contest 0.3.0 → 0.3.1

package/backend/internal/idea/handler.go

@@ -0,0 +1,148 @@
+package idea
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"net/http"
+
+	"github.com/google/uuid"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/api"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/audit"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/idea/internal/store"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/db"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/security"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/web"
+)
+
+// auditReasonHidden is the one reason stored for a missing and a hidden Idea
+// alike: the log must not tell them apart either (PRD 6.6).
+const auditReasonHidden = "NOT_FOUND"
+
+// View returns the Idea for GET /ideas/{id}. An Admin's successful view writes
+// IDEA_VIEW in the same transaction as the read (fail-closed, PRD 6.11).
+func (s *Service) View(ctx context.Context, id uuid.UUID, caller security.Principal) (Idea, error) {
+	if !caller.IsAdmin() {
+		return s.Get(ctx, id, caller)
+	}
+	var got Idea
+	_, err := db.InTx(ctx, s.DB, func(ctx context.Context, tx *sql.Tx) error {
+		var err error
+		if got, err = store.GetVisible(ctx, tx, id, caller.UserID, true); err != nil {
+			return err
+		}
+		return s.Audit.Record(ctx, tx, audit.Event{
+			Action: audit.IdeaView, Outcome: audit.Success,
+			TargetType: audit.TargetIdea, TargetID: id,
+		})
+	})
+	if errors.Is(err, store.ErrNotFound) {
+		return Idea{}, web.NewError(web.CodeNotFound, "")
+	}
+	return got, err
+}
+
+// Handler serves the Idea endpoints.
+type Handler struct {
+	Service *Service
+	// ExpectedFilename builds the expected slide filename without extension
+	// (storage.ExpectedFilenameBase; injected because idea must not import
+	// storage, D29).
+	ExpectedFilename func(category, org, leaderName, leaderEmpNo, ideaName string) (string, error)
+	Fail             func(w http.ResponseWriter, r *http.Request, err error)
+}
+
+type person struct {
+	EmpNo string `json:"empNo"`
+	Name  string `json:"name"`
+}
+
+type member struct {
+	EmpNo    string `json:"empNo"`
+	Name     string `json:"name"`
+	JoinedAt string `json:"joinedAt"`
+}
+
+type pending struct {
+	EmpNo       string `json:"empNo"`
+	Name        string `json:"name"`
+	RequestedAt string `json:"requestedAt"`
+}
+
+type slides struct {
+	Ext              string `json:"ext"`
+	Size             int64  `json:"size"`
+	SHA256           string `json:"sha256"`
+	UpdatedAt        string `json:"updatedAt"`
+	DownloadFilename string `json:"downloadFilename"`
+}
+
+// detail is IdeaDetail (docs/API/response-bodies.md). It is local so that
+// timestamps use web.FormatTime (fixed milliseconds) instead of time.Time.
+type detail struct {
+	ID                   uuid.UUID  `json:"id"`
+	Category             string     `json:"category"`
+	Org                  string     `json:"org"`
+	Direction            string     `json:"direction"`
+	Name                 string     `json:"name"`
+	Summary              string     `json:"summary"`
+	Leader               person     `json:"leader"`
+	Members              []member   `json:"members"`
+	PendingRequests      *[]pending `json:"pendingRequests"`
+	Slides               slides     `json:"slides"`
+	ExpectedFilenameBase string     `json:"expectedFilenameBase"`
+	CreatedAt            string     `json:"createdAt"`
+	UpdatedAt            string     `json:"updatedAt"`
+	Version              int64      `json:"version"`
+}
+
+// GetIdea serves GET /ideas/{id}.
+func (h Handler) GetIdea(w http.ResponseWriter, r *http.Request, id api.IdeaId) {
+	p, ok := security.PrincipalFrom(r.Context())
+	if !ok {
+		h.Fail(w, r, web.NewError(web.CodeUnauthenticated, "authentication required"))
+		return
+	}
+	got, err := h.Service.View(r.Context(), uuid.UUID(id), p)
+	if err != nil {
+		var e *web.Error
+		if errors.As(err, &e) && e.Code == web.CodeNotFound {
+			e.AuditAction = string(audit.IdeaView)
+			e.AuditReason = auditReasonHidden
+			e.AuditTargetType = string(audit.TargetIdea)
+			e.AuditTargetID = uuid.UUID(id)
+		}
+		h.Fail(w, r, err)
+		return
+	}
+	body, err := h.toDetail(got, p)
+	if err != nil {
+		h.Fail(w, r, err)
+		return
+	}
+	web.WriteJSON(w, http.StatusOK, body)
+}
+
+func (h Handler) toDetail(i Idea, caller security.Principal) (detail, error) {
+	base, err := h.ExpectedFilename(i.Category, i.Org, i.LeaderName, i.LeaderEmpNo, i.Name)
+	if err != nil {
+		return detail{}, err
+	}
+	d := detail{
+		ID: i.ID, Category: i.Category, Org: i.Org, Direction: i.Direction, Name: i.Name, Summary: i.Summary,
+		Leader: person{EmpNo: i.LeaderEmpNo, Name: i.LeaderName},
+		// TODO(B5-01): approved Members and pending requests come from idea_member.
+		Members: []member{},
+		Slides: slides{Ext: i.Slides.Ext, Size: i.Slides.Size, SHA256: i.Slides.SHA256,
+			UpdatedAt: web.FormatTime(i.SlidesUpdatedAt), DownloadFilename: base + "." + i.Slides.Ext},
+		ExpectedFilenameBase: base,
+		CreatedAt:            web.FormatTime(i.CreatedAt),
+		UpdatedAt:            web.FormatTime(i.UpdatedAt),
+		Version:              int64(i.Version),
+	}
+	if caller.IsAdmin() || caller.UserID == i.LeaderID {
+		d.PendingRequests = &[]pending{}
+	}
+	return d, nil
+}

package/backend/internal/idea/handler_integration_test.go

@@ -0,0 +1,107 @@
+//go:build integration
+
+package idea_test
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/google/uuid"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/api"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/audit"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/idea"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/server"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/dbtest"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/security"
+)
+
+func TestGetIdeaHandler(t *testing.T) {
+	d := dbtest.New(t)
+	leader := addUser(t, d, "100001", "USER")
+	other := addUser(t, d, "100002", "USER")
+	admin := addUser(t, d, "900001", "ADMIN")
+	n := newIdea(leader.UserID, "Idea A")
+	if err := insert(d, n); err != nil {
+		t.Fatal(err)
+	}
+	aud := audit.New(d, nil)
+	errs := server.ErrorAdapter{Audit: aud}
+	h := idea.Handler{Service: &idea.Service{DB: d, Audit: aud}, ExpectedFilename: expectedBase, Fail: errs.Write}
+
+	call := func(p security.Principal, id uuid.UUID) *httptest.ResponseRecorder {
+		r := chi.NewRouter()
+		r.Get("/ideas/{id}", func(w http.ResponseWriter, req *http.Request) { h.GetIdea(w, req, api.IdeaId(id)) })
+		req := httptest.NewRequest(http.MethodGet, "/ideas/"+id.String(), nil)
+		req = req.WithContext(security.WithPrincipal(context.Background(), p))
+		rec := httptest.NewRecorder()
+		r.ServeHTTP(rec, req)
+		return rec
+	}
+	count := func(where string) (c int) {
+		if err := d.QueryRow(`SELECT COUNT(*) FROM audit_log WHERE ` + where).Scan(&c); err != nil {
+			t.Fatal(err)
+		}
+		return c
+	}
+
+	// Leader: 200, pendingRequests is [] (not null), expected filename.
+	rec := call(leader, n.ID)
+	if rec.Code != 200 {
+		t.Fatalf("leader: %d %s", rec.Code, rec.Body)
+	}
+	var body map[string]any
+	_ = json.Unmarshal(rec.Body.Bytes(), &body)
+	if body["expectedFilenameBase"] != "I_BSID_User 100001_100001_Idea A" ||
+		body["slides"].(map[string]any)["downloadFilename"] != "I_BSID_User 100001_100001_Idea A.pdf" {
+		t.Errorf("filename: %v", body)
+	}
+	if pr, ok := body["pendingRequests"].([]any); !ok || len(pr) != 0 {
+		t.Errorf("pendingRequests = %v", body["pendingRequests"])
+	}
+	if count(`action = 'IDEA_VIEW'`) != 0 {
+		t.Error("a Leader view must not write IDEA_VIEW")
+	}
+
+	// Admin: 200 and one IDEA_VIEW SUCCESS row.
+	if rec := call(admin, n.ID); rec.Code != 200 {
+		t.Fatalf("admin: %d", rec.Code)
+	}
+	if count(`action = 'IDEA_VIEW' AND outcome = 'SUCCESS' AND actor_role = 'ADMIN'`) != 1 {
+		t.Error("admin view: want one IDEA_VIEW SUCCESS row")
+	}
+
+	// Hidden and missing: identical 404 (bar the request ID), both audited DENIED.
+	hidden, missing := call(other, n.ID), call(other, uuid.New())
+	if hidden.Code != 404 || missing.Code != 404 {
+		t.Fatalf("codes %d %d", hidden.Code, missing.Code)
+	}
+	strip := func(rr *httptest.ResponseRecorder) (map[string]any, http.Header) {
+		var m map[string]any
+		_ = json.Unmarshal(rr.Body.Bytes(), &m)
+		delete(m, "requestId")
+		return m, rr.Header()
+	}
+	hb, hh := strip(hidden)
+	mb, mh := strip(missing)
+	if len(hb) != len(mb) || hb["code"] != mb["code"] || hb["detail"] != mb["detail"] {
+		t.Errorf("bodies differ: %v vs %v", hb, mb)
+	}
+	for k := range hh {
+		if hh.Get(k) != mh.Get(k) {
+			t.Errorf("header %s differs: %q vs %q", k, hh.Get(k), mh.Get(k))
+		}
+	}
+	if got := count(`action = 'IDEA_VIEW' AND outcome = 'DENIED' AND status = 404 AND error_code = 'NOT_FOUND'`); got != 2 {
+		t.Errorf("DENIED rows = %d, want 2", got)
+	}
+}
+
+// expectedBase mirrors storage.ExpectedFilenameBase (idea must not import storage).
+func expectedBase(category, org, leaderName, leaderEmpNo, ideaName string) (string, error) {
+	return "I_" + org + "_" + leaderName + "_" + leaderEmpNo + "_" + ideaName, nil
+}

package/backend/internal/idea/integration_test.go

@@ -0,0 +1,149 @@
+//go:build integration
+
+package idea_test
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"strings"
+	"testing"
+
+	"github.com/google/uuid"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/idea"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/idea/internal/store"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/db"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/dbtest"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/security"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/web"
+)
+
+const hash = "$2a$10$" + "abcdefghijklmnopqrstuuabcdefghijklmnopqrstuuabcdefghi" // 7 + 53 chars
+
+func addUser(t *testing.T, d *sql.DB, empNo, role string) security.Principal {
+	t.Helper()
+	id := uuid.New()
+	var email any
+	if role == "USER" {
+		email = empNo + "@example.com"
+	}
+	if _, err := d.Exec(`INSERT INTO app_user (id, emp_no, name, email, password_hash, role) VALUES (?,?,?,?,?,?)`,
+		id.String(), empNo, "User "+empNo, email, hash, role); err != nil {
+		t.Fatal(err)
+	}
+	return security.Principal{UserID: id, EmpNo: empNo, Role: security.Role(role)}
+}
+
+func newIdea(leader uuid.UUID, name string) store.NewIdea {
+	id := uuid.New()
+	return store.NewIdea{
+		ID: id, LeaderID: leader, Category: "COOL_IDEA", Org: "BSID", Direction: "TALENT_DEVELOPMENT",
+		Name: name, Summary: "s",
+		Slides: store.Slides{ObjectKey: "slides/" + id.String() + "/" + uuid.NewString() + ".pdf",
+			Ext: "pdf", Size: 1024, SHA256: strings.Repeat("ab", 32)},
+	}
+}
+
+func insert(d *sql.DB, n store.NewIdea) error {
+	tx, err := d.Begin()
+	if err != nil {
+		return err
+	}
+	if err := store.InsertIdea(context.Background(), tx, n); err != nil {
+		_ = tx.Rollback()
+		return err
+	}
+	return tx.Commit()
+}
+
+func TestVisibilityPerRole(t *testing.T) {
+	d := dbtest.New(t)
+	leader := addUser(t, d, "100001", "USER")
+	other := addUser(t, d, "100002", "USER")
+	admin := addUser(t, d, "900001", "ADMIN")
+	n := newIdea(leader.UserID, "Idea A")
+	if err := insert(d, n); err != nil {
+		t.Fatal(err)
+	}
+	svc := &idea.Service{DB: d}
+	ctx := context.Background()
+
+	for _, tc := range []struct {
+		who     string
+		p       security.Principal
+		visible bool
+	}{{"leader", leader, true}, {"admin", admin, true}, {"other user", other, false}} {
+		got, err := svc.Get(ctx, n.ID, tc.p)
+		if tc.visible {
+			if err != nil || got.ID != n.ID || got.LeaderEmpNo != "100001" || got.Version != 0 || got.Slides.Ext != "pdf" {
+				t.Errorf("%s: got %+v, %v", tc.who, got, err)
+			}
+			continue
+		}
+		if !isNotFound(err) {
+			t.Errorf("%s: want NOT_FOUND, got %v", tc.who, err)
+		}
+	}
+
+	// A missing Idea is indistinguishable from a hidden one.
+	_, errMissing := svc.Get(ctx, uuid.New(), leader)
+	_, errHidden := svc.Get(ctx, n.ID, other)
+	if !isNotFound(errMissing) || errMissing.Error() != errHidden.Error() {
+		t.Errorf("missing %v vs hidden %v", errMissing, errHidden)
+	}
+}
+
+func isNotFound(err error) bool {
+	var we *web.Error
+	return errors.As(err, &we) && we.Error() == "NOT_FOUND"
+}
+
+func TestUniqueLeaderName(t *testing.T) {
+	d := dbtest.New(t)
+	a := addUser(t, d, "100001", "USER")
+	b := addUser(t, d, "100002", "USER")
+	if err := insert(d, newIdea(a.UserID, "Same")); err != nil {
+		t.Fatal(err)
+	}
+	err := insert(d, newIdea(a.UserID, "Same"))
+	if key, ok := db.DuplicateKey(err); !ok || key != "uq_idea_leader_name" {
+		t.Errorf("same leader, same name: key %q ok %v err %v", key, ok, err)
+	}
+	if err := insert(d, newIdea(a.UserID, "same")); err != nil {
+		t.Errorf("name is case-sensitive: %v", err)
+	}
+	if err := insert(d, newIdea(b.UserID, "Same")); err != nil {
+		t.Errorf("names are unique per leader, not globally: %v", err)
+	}
+}
+
+func TestChecksRejectBadRows(t *testing.T) {
+	d := dbtest.New(t)
+	a := addUser(t, d, "100001", "USER")
+	for name, mut := range map[string]func(*store.NewIdea){
+		"category":       func(n *store.NewIdea) { n.Category = "X" },
+		"org":            func(n *store.NewIdea) { n.Org = "ZZZZ" },
+		"direction":      func(n *store.NewIdea) { n.Direction = "X" },
+		"empty name":     func(n *store.NewIdea) { n.Name = "" },
+		"slash name":     func(n *store.NewIdea) { n.Name = "a/b" },
+		"long name":      func(n *store.NewIdea) { n.Name = strings.Repeat("好", 76) },
+		"empty summary":  func(n *store.NewIdea) { n.Summary = "" },
+		"ext":            func(n *store.NewIdea) { n.Slides.Ext = "docx" },
+		"size zero":      func(n *store.NewIdea) { n.Slides.Size = 0 },
+		"size over 5MiB": func(n *store.NewIdea) { n.Slides.Size = 5*1024*1024 + 1 },
+		"sha upper":      func(n *store.NewIdea) { n.Slides.SHA256 = strings.Repeat("AB", 32) },
+		"no leader":      func(n *store.NewIdea) { n.LeaderID = uuid.New() },
+	} {
+		n := newIdea(a.UserID, "ok")
+		mut(&n)
+		if err := insert(d, n); err == nil {
+			t.Errorf("%s: row accepted", name)
+		}
+	}
+	n := newIdea(a.UserID, strings.Repeat("好", 75))
+	n.Slides.Size = 5 * 1024 * 1024
+	if err := insert(d, n); err != nil {
+		t.Errorf("boundary values rejected: %v", err)
+	}
+}

package/backend/internal/idea/internal/store/list.go

@@ -0,0 +1,146 @@
+package store
+
+import (
+	"context"
+	"database/sql"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/google/uuid"
+)
+
+// ListFilter is the validated filter set of GET /ideas (PRD 6.6). A nil or
+// empty field means "no filter". CreatedFrom is inclusive, CreatedTo exclusive.
+type ListFilter struct {
+	Org, Category, Direction string
+	LeaderEmpNo              string
+	CreatedFrom, CreatedTo   *time.Time
+	// Q is a case-insensitive "name contains" term; %, _ and the escape
+	// character are literal.
+	Q string
+	// SortName sorts by name (code point order) instead of created_at; Desc is
+	// the direction. The handler resolves the per-field default direction.
+	SortName, Desc bool
+}
+
+// likeEscape is the ESCAPE character of the name search. It is not a backslash,
+// so the SQL literal does not depend on NO_BACKSLASH_ESCAPES.
+const likeEscape = "!"
+
+// containsPattern turns a user term into a LIKE pattern matching names that
+// contain it, with every wildcard escaped.
+func containsPattern(q string) string {
+	r := strings.NewReplacer(likeEscape, likeEscape+likeEscape, "%", likeEscape+"%", "_", likeEscape+"_")
+	return "%" + r.Replace(q) + "%"
+}
+
+func (f ListFilter) orderBy() string {
+	dir := "ASC"
+	if f.Desc {
+		dir = "DESC"
+	}
+	col := "i.created_at"
+	if f.SortName {
+		col = "i.name"
+	}
+	return col + " " + dir + ", i.id " + dir
+}
+
+// Summary is one row of the list (IdeaSummary: no summary text).
+type Summary struct {
+	ID              uuid.UUID
+	Name            string
+	Category        string
+	Org             string
+	Direction       string
+	LeaderID        uuid.UUID
+	LeaderEmpNo     string
+	LeaderName      string
+	MemberCount     int
+	CreatedAt       time.Time
+	SlidesUpdatedAt time.Time
+}
+
+// dbTime is the DATETIME(6) literal of an instant; the database stores UTC.
+func dbTime(t time.Time) string { return t.UTC().Format("2006-01-02 15:04:05.000000") }
+
+// ListVisible returns one page of the Ideas the viewer may see, in the requested order
+// (id is the final tie-breaker), and the total number of matches. It is built
+// on VisibleWhere like every other read. A page beyond the last is empty.
+func ListVisible(ctx context.Context, q interface {
+	QueryContext(ctx context.Context, query string, args ...any) (*sql.Rows, error)
+	QueryRowContext(ctx context.Context, query string, args ...any) *sql.Row
+}, viewer uuid.UUID, isAdmin bool, f ListFilter, limit, offset int) ([]Summary, int, error) {
+	admin := 0
+	if isAdmin {
+		admin = 1
+	}
+	where := []string{VisibleWhere}
+	args := []any{admin, viewer.String()}
+	add := func(cond string, v any) {
+		where = append(where, cond)
+		args = append(args, v)
+	}
+	if f.Org != "" {
+		add("i.org = ?", f.Org)
+	}
+	if f.Category != "" {
+		add("i.category = ?", f.Category)
+	}
+	if f.Direction != "" {
+		add("i.direction = ?", f.Direction)
+	}
+	if f.LeaderEmpNo != "" {
+		add("u.emp_no = ?", f.LeaderEmpNo)
+	}
+	if f.Q != "" {
+		add("LOWER(i.name) LIKE LOWER(?) ESCAPE '"+likeEscape+"'", containsPattern(f.Q))
+	}
+	if f.CreatedFrom != nil {
+		add("i.created_at >= ?", dbTime(*f.CreatedFrom))
+	}
+	if f.CreatedTo != nil {
+		add("i.created_at < ?", dbTime(*f.CreatedTo))
+	}
+	cond := strings.Join(where, " AND ")
+
+	var total int
+	if err := q.QueryRowContext(ctx,
+		`SELECT COUNT(*) FROM idea i JOIN app_user u ON u.id = i.leader_id WHERE `+cond, args...).Scan(&total); err != nil {
+		return nil, 0, fmt.Errorf("count ideas: %w", err)
+	}
+
+	// TODO(B5-01): memberCount counts ACCEPTED idea_member rows (Leader excluded).
+	rows, err := q.QueryContext(ctx,
+		`SELECT i.id, i.name, i.category, i.org, i.direction, i.leader_id, u.emp_no, u.name,
+		        0, i.created_at, i.slides_updated_at
+		   FROM idea i JOIN app_user u ON u.id = i.leader_id
+		  WHERE `+cond+`
+		  ORDER BY `+f.orderBy()+`
+		  LIMIT ? OFFSET ?`, append(args, limit, offset)...)
+	if err != nil {
+		return nil, 0, fmt.Errorf("list ideas: %w", err)
+	}
+	defer func() { _ = rows.Close() }()
+	out := []Summary{}
+	for rows.Next() {
+		var s Summary
+		var id, lid string
+		if err := rows.Scan(&id, &s.Name, &s.Category, &s.Org, &s.Direction, &lid, &s.LeaderEmpNo,
+			&s.LeaderName, &s.MemberCount, &s.CreatedAt, &s.SlidesUpdatedAt); err != nil {
+			return nil, 0, fmt.Errorf("scan idea: %w", err)
+		}
+		if s.ID, err = uuid.Parse(id); err != nil {
+			return nil, 0, fmt.Errorf("idea id: %w", err)
+		}
+		if s.LeaderID, err = uuid.Parse(lid); err != nil {
+			return nil, 0, fmt.Errorf("idea leader id: %w", err)
+		}
+		out = append(out, s)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, 0, fmt.Errorf("list ideas: %w", err)
+	}
+	return out, total, nil
+}

package/backend/internal/idea/internal/store/list_test.go

@@ -0,0 +1,33 @@
+package store
+
+import "testing"
+
+func TestContainsPattern(t *testing.T) {
+	for in, want := range map[string]string{
+		"abc": "%abc%",
+		"50%": "%50!%%",
+		"a_b": "%a!_b%",
+		"hi!": "%hi!!%",
+		"%_!": "%!%!_!!%",
+		`a\b`: `%a\b%`,
+		"綠能":  "%綠能%",
+		"":    "%%",
+	} {
+		if got := containsPattern(in); got != want {
+			t.Errorf("containsPattern(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
+
+func TestOrderBy(t *testing.T) {
+	for f, want := range map[ListFilter]string{
+		{}:                           "i.created_at ASC, i.id ASC",
+		{Desc: true}:                 "i.created_at DESC, i.id DESC",
+		{SortName: true}:             "i.name ASC, i.id ASC",
+		{SortName: true, Desc: true}: "i.name DESC, i.id DESC",
+	} {
+		if got := f.orderBy(); got != want {
+			t.Errorf("%+v: %q, want %q", f, got, want)
+		}
+	}
+}