tower-studio 0.1.2 → 0.1.3

package/src/actions/__tests__/report-actions.test.ts

@@ -0,0 +1,246 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+
+vi.mock("@/lib/db", () => ({
+  db: {
+    task: { findMany: vi.fn() },
+  },
+}));
+
+import { db } from "@/lib/db";
+import { getDailySummary, getDailyTodo } from "@/actions/report-actions";
+
+const mockDb = db as {
+  task: { findMany: ReturnType<typeof vi.fn> };
+};
+
+/** Build a minimal task object that matches the include clause used by getDailySummary */
+function makeTask(overrides: {
+  id?: string;
+  title?: string;
+  status?: string;
+  priority?: string;
+  updatedAt?: Date;
+  project?: object;
+  messages?: { content: string; createdAt: Date }[];
+  executions?: { startedAt?: Date; status?: string; summary?: string | null }[];
+}) {
+  const now = new Date("2026-01-15T10:00:00Z");
+  const ws = { id: "ws1", name: "Workspace 1" };
+  const proj = { id: "p1", name: "Project 1", alias: null, workspace: ws };
+
+  return {
+    id: overrides.id ?? "task1",
+    title: overrides.title ?? "Test task",
+    status: overrides.status ?? "TODO",
+    priority: overrides.priority ?? "MEDIUM",
+    updatedAt: overrides.updatedAt ?? now,
+    createdAt: now,
+    project: overrides.project ?? proj,
+    messages: overrides.messages ?? [],
+    executions: overrides.executions ?? [],
+    labels: [],
+  };
+}
+
+/** Build a minimal task object that matches the include clause used by getDailyTodo */
+function makeTodoTask(overrides: {
+  id?: string;
+  title?: string;
+  status?: string;
+  priority?: string;
+  updatedAt?: Date;
+  project?: object;
+  labels?: { label: { name: string } }[];
+  executions?: { sessionId?: string | null }[];
+}) {
+  const now = new Date("2026-01-15T10:00:00Z");
+  const ws = { id: "ws1", name: "Workspace 1" };
+  const proj = { id: "p1", name: "Project 1", alias: null, workspace: ws };
+
+  return {
+    id: overrides.id ?? "task1",
+    title: overrides.title ?? "Test task",
+    status: overrides.status ?? "TODO",
+    priority: overrides.priority ?? "MEDIUM",
+    updatedAt: overrides.updatedAt ?? now,
+    createdAt: now,
+    project: overrides.project ?? proj,
+    labels: overrides.labels ?? [],
+    executions: overrides.executions ?? [],
+  };
+}
+
+describe("report-actions", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  // ── getDailySummary ───────────────────────────────────────────────────────
+
+  describe("getDailySummary", () => {
+    it("happy path: groups DONE and IN_PROGRESS tasks into workspaces", async () => {
+      const doneTask = makeTask({ id: "t1", status: "DONE", title: "Done task" });
+      const inProgressTask = makeTask({ id: "t2", status: "IN_PROGRESS", title: "WIP task" });
+      mockDb.task.findMany.mockResolvedValue([doneTask, inProgressTask]);
+
+      const result = await getDailySummary();
+
+      expect(result.workspaces).toHaveLength(1);
+      const ws = result.workspaces[0];
+      expect(ws.projects).toHaveLength(1);
+      const proj = ws.projects[0];
+      expect(proj.completed).toHaveLength(1);
+      expect(proj.completed[0].id).toBe("t1");
+      expect(proj.inProgress).toHaveLength(1);
+      expect(proj.inProgress[0].id).toBe("t2");
+      expect(result.stats.totalCompleted).toBe(1);
+      expect(result.stats.totalInProgress).toBe(1);
+    });
+
+    it("empty day: returns empty workspaces and zero stats", async () => {
+      mockDb.task.findMany.mockResolvedValue([]);
+
+      const result = await getDailySummary();
+
+      expect(result.workspaces).toHaveLength(0);
+      expect(result.stats.totalCompleted).toBe(0);
+      expect(result.stats.totalInProgress).toBe(0);
+      expect(result.stats.totalActive).toBe(0);
+    });
+
+    it("custom date: date range filter spans the specified day (24h window)", async () => {
+      mockDb.task.findMany.mockResolvedValue([]);
+
+      await getDailySummary("2026-01-15");
+
+      const callArgs = mockDb.task.findMany.mock.calls[0][0];
+      const orClauses = callArgs.where.OR;
+      // The updatedAt clause should use gte/lt covering exactly 24 hours
+      const updatedAtClause = orClauses.find((c: Record<string, unknown>) => "updatedAt" in c);
+      expect(updatedAtClause).toBeDefined();
+      const gte = updatedAtClause.updatedAt.gte as Date;
+      const lt = updatedAtClause.updatedAt.lt as Date;
+      // gte should be midnight local time for 2026-01-15
+      expect(gte.getHours()).toBe(0);
+      expect(gte.getMinutes()).toBe(0);
+      // lt should be exactly 24 hours after gte
+      const diffMs = lt.getTime() - gte.getTime();
+      expect(diffMs).toBe(24 * 60 * 60 * 1000);
+    });
+
+    it("CANCELLED tasks are excluded from completed and inProgress", async () => {
+      const cancelledTask = makeTask({ id: "t1", status: "CANCELLED" });
+      mockDb.task.findMany.mockResolvedValue([cancelledTask]);
+
+      const result = await getDailySummary();
+
+      expect(result.stats.totalCompleted).toBe(0);
+      expect(result.stats.totalInProgress).toBe(0);
+      // workspace may or may not be present but counts are 0
+    });
+
+    it("uses execution summary as progressSummary when available", async () => {
+      const task = makeTask({
+        status: "IN_PROGRESS",
+        executions: [{ summary: "Execution progress summary" }],
+        messages: [],
+      });
+      mockDb.task.findMany.mockResolvedValue([task]);
+
+      const result = await getDailySummary();
+
+      const inProgressTask = result.workspaces[0].projects[0].inProgress[0];
+      expect(inProgressTask.progressSummary).toBe("Execution progress summary");
+    });
+
+    it("falls back to message content (truncated at 200 chars) when no execution summary", async () => {
+      const longContent = "A".repeat(300);
+      const now = new Date();
+      const task = makeTask({
+        status: "IN_PROGRESS",
+        executions: [{ summary: null }],
+        messages: [{ content: longContent, createdAt: now }],
+      });
+      mockDb.task.findMany.mockResolvedValue([task]);
+
+      const result = await getDailySummary();
+
+      const inProgressTask = result.workspaces[0].projects[0].inProgress[0];
+      expect(inProgressTask.progressSummary).toHaveLength(203); // 200 chars + "..."
+      expect(inProgressTask.progressSummary).toMatch(/\.\.\.$/);
+    });
+  });
+
+  // ── getDailyTodo ──────────────────────────────────────────────────────────
+
+  describe("getDailyTodo", () => {
+    it("happy path: tasks sorted by priority (CRITICAL first)", async () => {
+      const lowTask = makeTodoTask({ id: "t3", priority: "LOW", title: "Low priority" });
+      const criticalTask = makeTodoTask({ id: "t1", priority: "CRITICAL", title: "Critical task" });
+      const highTask = makeTodoTask({ id: "t2", priority: "HIGH", title: "High priority" });
+      // findMany returns in arbitrary order — sort happens in the action
+      mockDb.task.findMany.mockResolvedValue([lowTask, criticalTask, highTask]);
+
+      const result = await getDailyTodo();
+
+      // All tasks end up in the workspace/project structure
+      const tasks = result.workspaces[0].projects[0].tasks;
+      expect(tasks[0].priority).toBe("CRITICAL");
+      expect(tasks[1].priority).toBe("HIGH");
+      expect(tasks[2].priority).toBe("LOW");
+    });
+
+    it("filter by workspaceId: where clause includes project.workspaceId", async () => {
+      mockDb.task.findMany.mockResolvedValue([]);
+
+      await getDailyTodo({ workspaceId: "ws1" });
+
+      const where = mockDb.task.findMany.mock.calls[0][0].where;
+      expect(where.project).toEqual({ workspaceId: "ws1" });
+    });
+
+    it("filter by projectId: where clause includes projectId", async () => {
+      mockDb.task.findMany.mockResolvedValue([]);
+
+      await getDailyTodo({ projectId: "p1" });
+
+      const where = mockDb.task.findMany.mock.calls[0][0].where;
+      expect(where.projectId).toBe("p1");
+    });
+
+    it("filter by priority: where clause includes priority.in", async () => {
+      mockDb.task.findMany.mockResolvedValue([]);
+
+      await getDailyTodo({ priority: ["CRITICAL", "HIGH"] });
+
+      const where = mockDb.task.findMany.mock.calls[0][0].where;
+      expect(where.priority).toEqual({ in: ["CRITICAL", "HIGH"] });
+    });
+
+    it("stats breakdown: byStatus and byPriority match mocked data", async () => {
+      const t1 = makeTodoTask({ id: "t1", status: "TODO", priority: "CRITICAL" });
+      const t2 = makeTodoTask({ id: "t2", status: "IN_PROGRESS", priority: "HIGH" });
+      const t3 = makeTodoTask({ id: "t3", status: "IN_REVIEW", priority: "CRITICAL" });
+      mockDb.task.findMany.mockResolvedValue([t1, t2, t3]);
+
+      const result = await getDailyTodo();
+
+      expect(result.stats.total).toBe(3);
+      expect(result.stats.byStatus.TODO).toBe(1);
+      expect(result.stats.byStatus.IN_PROGRESS).toBe(1);
+      expect(result.stats.byStatus.IN_REVIEW).toBe(1);
+      expect(result.stats.byPriority.CRITICAL).toBe(2);
+      expect(result.stats.byPriority.HIGH).toBe(1);
+      expect(result.stats.byPriority.MEDIUM).toBe(0);
+    });
+
+    it("default status filter: includes TODO, IN_PROGRESS, IN_REVIEW when no filters provided", async () => {
+      mockDb.task.findMany.mockResolvedValue([]);
+
+      await getDailyTodo();
+
+      const where = mockDb.task.findMany.mock.calls[0][0].where;
+      expect(where.status).toEqual({ in: ["TODO", "IN_PROGRESS", "IN_REVIEW"] });
+    });
+  });
+});

package/src/actions/__tests__/search-code-actions.test.ts

@@ -0,0 +1,308 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+
+// vi.hoisted required for child_process mock in jsdom vitest environment
+const mockExecFile = vi.hoisted(() => vi.fn());
+
+vi.mock("child_process", () => ({
+  default: { execFile: mockExecFile },
+  execFile: mockExecFile,
+}));
+
+vi.mock("@vscode/ripgrep", () => ({
+  rgPath: "/mocked/bin/rg",
+}));
+
+import { searchCode } from "@/actions/search-code-actions";
+
+const MOCKED_RG_PATH = "/mocked/bin/rg";
+
+beforeEach(() => {
+  vi.clearAllMocks();
+});
+
+// Helper: build a valid rg JSON match line
+function makeRgMatchLine(
+  absolutePath: string,
+  lineNumber: number,
+  lineText: string,
+  matchText: string,
+  start: number,
+  end: number
+): string {
+  return JSON.stringify({
+    type: "match",
+    data: {
+      path: { text: absolutePath },
+      lines: { text: lineText },
+      line_number: lineNumber,
+      absolute_offset: 0,
+      submatches: [{ match: { text: matchText }, start, end }],
+    },
+  });
+}
+
+// Helper: mock execFile to call callback with success
+function mockExecFileSuccess(stdout: string) {
+  mockExecFile.mockImplementationOnce(
+    (_cmd: string, _args: string[], _opts: unknown, cb: (err: null, stdout: string, stderr: string) => void) => {
+      cb(null, stdout, "");
+      return {};
+    }
+  );
+}
+
+// Helper: mock execFile to call callback with error
+function mockExecFileError(code: number, message = "Command failed") {
+  mockExecFile.mockImplementationOnce(
+    (_cmd: string, _args: string[], _opts: unknown, cb: (err: Error & { code?: number }, stdout: string, stderr: string) => void) => {
+      const err = Object.assign(new Error(message), { code });
+      cb(err, "", "");
+      return {};
+    }
+  );
+}
+
+// ---------------------------------------------------------------------------
+// Test 1 (SEARCH-02): rg exit 0 → returns matches array with SearchMatch objects
+// ---------------------------------------------------------------------------
+describe("Test 1: rg exit 0 returns matches", () => {
+  it("returns non-empty matches array, no error", async () => {
+    const rgOutput = [
+      makeRgMatchLine("/project/src/foo.ts", 42, '  const hello = "world";\n', "hello", 8, 13),
+      JSON.stringify({ type: "summary", data: {} }),
+    ].join("\n");
+
+    mockExecFileSuccess(rgOutput);
+
+    const result = await searchCode("/project", "hello");
+
+    expect(result.error).toBeUndefined();
+    expect(result.matches.length).toBeGreaterThan(0);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Test 2 (SEARCH-02): rg exit 1 (no matches) → returns empty matches
+// ---------------------------------------------------------------------------
+describe("Test 2: rg exit 1 returns empty matches", () => {
+  it("exit code 1 returns empty matches array without error", async () => {
+    mockExecFileError(1);
+
+    const result = await searchCode("/project", "nomatch_xyz");
+
+    expect(result.matches).toEqual([]);
+    expect(result.truncated).toBe(false);
+    expect(result.error).toBeUndefined();
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Test 3 (SEARCH-02): rg exit 2+ (error) → returns sanitized error string
+// ---------------------------------------------------------------------------
+describe("Test 3: rg exit 2+ returns error string", () => {
+  it("exit code 2 returns error string", async () => {
+    mockExecFileError(2, "rg error");
+
+    const result = await searchCode("/project", "pattern");
+
+    expect(result.error).toBeDefined();
+    expect(typeof result.error).toBe("string");
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Test 4: uses bundled @vscode/ripgrep binary path
+// ---------------------------------------------------------------------------
+describe("Test 4: uses bundled ripgrep", () => {
+  it("calls execFile with the @vscode/ripgrep rgPath", async () => {
+    const rgOutput = makeRgMatchLine("/project/src/foo.ts", 1, "hello\n", "hello", 0, 5);
+    mockExecFileSuccess(rgOutput);
+
+    await searchCode("/project", "hello");
+
+    const rgCall = mockExecFile.mock.calls[0];
+    expect(rgCall[0]).toBe(MOCKED_RG_PATH);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Test 5 (SEARCH-03): glob filter → --glob arg is passed
+// ---------------------------------------------------------------------------
+describe("Test 5: glob filter passes --glob arg", () => {
+  it("passes --glob and the glob value to rg args", async () => {
+    const rgOutput = makeRgMatchLine("/project/src/foo.ts", 1, "hello world\n", "hello", 0, 5);
+
+    mockExecFileSuccess(rgOutput);
+
+    await searchCode("/project", "hello", "*.ts");
+
+    const rgCall = mockExecFile.mock.calls[0];
+    expect(rgCall[0]).toBe(MOCKED_RG_PATH);
+    const args = rgCall[1] as string[];
+    expect(args).toContain("--glob");
+    expect(args).toContain("*.ts");
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Test 6 (SEARCH-04): result parsing → filePath is relative
+// ---------------------------------------------------------------------------
+describe("Test 6: filePath is relative (strips localPath prefix)", () => {
+  it("strips localPath prefix from match absolute path", async () => {
+    const rgOutput = makeRgMatchLine(
+      "/project/src/foo.ts", 42, '  const hello = "world";\n', "hello", 8, 13
+    );
+
+    mockExecFileSuccess(rgOutput);
+
+    const result = await searchCode("/project", "hello");
+    expect(result.matches[0].filePath).toBe("src/foo.ts");
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Test 7 (SEARCH-04): result contains lineNumber, lineText, submatches
+// ---------------------------------------------------------------------------
+describe("Test 7: result contains lineNumber, lineText, submatches", () => {
+  it("match object has correct fields with start/end", async () => {
+    const rgOutput = makeRgMatchLine(
+      "/project/src/foo.ts", 42, '  const hello = "world";\n', "hello", 8, 13
+    );
+
+    mockExecFileSuccess(rgOutput);
+
+    const result = await searchCode("/project", "hello");
+
+    const match = result.matches[0];
+    expect(match.lineNumber).toBe(42);
+    expect(match.lineText).toBe('  const hello = "world";');
+    expect(match.submatches).toHaveLength(1);
+    expect(match.submatches[0].start).toBe(8);
+    expect(match.submatches[0].end).toBe(13);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Test 8: truncation → results capped at maxResults
+// ---------------------------------------------------------------------------
+describe("Test 8: results truncated at maxResults", () => {
+  it("caps results at maxResults=200 and sets truncated=true when 250 matches", async () => {
+    const lines = Array.from({ length: 250 }, (_, i) =>
+      makeRgMatchLine(`/project/src/file${i}.ts`, i + 1, `line content ${i}\n`, "pattern", 0, 7)
+    );
+    const rgOutput = lines.join("\n");
+
+    mockExecFileSuccess(rgOutput);
+
+    const result = await searchCode("/project", "pattern", undefined, 200);
+
+    expect(result.matches.length).toBe(200);
+    expect(result.truncated).toBe(true);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Test 9: relative path rejected
+// ---------------------------------------------------------------------------
+describe("Test 9: relative localPath rejected", () => {
+  it("returns error for relative path like '../etc'", async () => {
+    const result = await searchCode("../etc", "password");
+    expect(result.error).toBeDefined();
+    expect(result.matches).toEqual([]);
+  });
+
+  it("returns error for bare directory name", async () => {
+    const result = await searchCode("my-project", "hello");
+    expect(result.error).toBeDefined();
+    expect(result.matches).toEqual([]);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Test 10: pattern boundary — 500 chars accepted, 501 rejected
+// ---------------------------------------------------------------------------
+describe("Test 10: pattern boundary — 500 chars accepted, 501 rejected", () => {
+  it("500-char pattern is accepted", async () => {
+    const longPattern = "a".repeat(500);
+    mockExecFileError(1); // no matches
+
+    const result = await searchCode("/project", longPattern);
+    expect(result.error).toBeUndefined();
+  });
+
+  it("501-char pattern is rejected with validation error", async () => {
+    const tooLongPattern = "a".repeat(501);
+    const result = await searchCode("/project", tooLongPattern);
+    expect(result.error).toBeDefined();
+    expect(result.error).toMatch(/[Ii]nvalid/);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Test 11: maxResults boundary values
+// ---------------------------------------------------------------------------
+describe("Test 11: maxResults boundary values", () => {
+  it("maxResults=1 returns at most 1 result", async () => {
+    const lines = Array.from({ length: 5 }, (_, i) =>
+      makeRgMatchLine(`/project/src/f${i}.ts`, i + 1, `line ${i}\n`, "x", 0, 1)
+    );
+    mockExecFileSuccess(lines.join("\n"));
+
+    const result = await searchCode("/project", "x", undefined, 1);
+    expect(result.matches.length).toBe(1);
+    expect(result.truncated).toBe(true);
+  });
+
+  it("maxResults=0 is rejected by Zod (min 1)", async () => {
+    const result = await searchCode("/project", "x", undefined, 0);
+    expect(result.error).toBeDefined();
+  });
+
+  it("maxResults=501 is rejected by Zod (max 500)", async () => {
+    const result = await searchCode("/project", "x", undefined, 501);
+    expect(result.error).toBeDefined();
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Test 12: error messages sanitized — no server path leaks
+// ---------------------------------------------------------------------------
+describe("Test 12: error messages sanitized", () => {
+  it("rg error does not contain file system paths", async () => {
+    mockExecFileError(2, "rg: /secret/internal/path: Permission denied");
+
+    const result = await searchCode("/project", "pattern");
+    expect(result.error).toBeDefined();
+    expect(result.error).not.toContain("/secret/internal/path");
+    expect(result.error).not.toContain("Permission denied");
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Test 13: execFile uses timeout option
+// ---------------------------------------------------------------------------
+describe("Test 13: rg invocation includes timeout", () => {
+  it("passes timeout option to execFile", async () => {
+    const rgOutput = makeRgMatchLine("/project/src/foo.ts", 1, "hello\n", "hello", 0, 5);
+    mockExecFileSuccess(rgOutput);
+
+    await searchCode("/project", "hello");
+
+    const rgCall = mockExecFile.mock.calls[0];
+    expect(rgCall[0]).toBe(MOCKED_RG_PATH);
+    const opts = rgCall[2] as { timeout?: number };
+    expect(opts.timeout).toBe(10_000);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Test 14: Windows absolute path accepted
+// ---------------------------------------------------------------------------
+describe("Test 14: Windows absolute path accepted", () => {
+  it("accepts Windows-style absolute path C:\\project", async () => {
+    mockExecFileError(1); // no matches
+
+    const result = await searchCode("C:\\project", "hello");
+    expect(result.error).toBeUndefined();
+  });
+});

package/src/actions/__tests__/task-actions-overview.test.ts

@@ -0,0 +1,58 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+
+vi.mock("@/lib/db", () => ({
+  db: {
+    task: { findUnique: vi.fn() },
+  },
+}));
+
+import { db } from "@/lib/db";
+import { getTaskOverview } from "@/actions/task-actions";
+
+const mockDb = db as unknown as {
+  task: { findUnique: ReturnType<typeof vi.fn> };
+};
+
+beforeEach(() => {
+  vi.clearAllMocks();
+});
+
+describe("getTaskOverview", () => {
+  it("returns null for invalid CUID", async () => {
+    const result = await getTaskOverview("not-a-cuid");
+    expect(result).toBeNull();
+    expect(mockDb.task.findUnique).not.toHaveBeenCalled();
+  });
+
+  it("returns null for empty string", async () => {
+    const result = await getTaskOverview("");
+    expect(result).toBeNull();
+  });
+
+  it("returns null for SQL injection attempt", async () => {
+    const result = await getTaskOverview("'; DROP TABLE task; --");
+    expect(result).toBeNull();
+    expect(mockDb.task.findUnique).not.toHaveBeenCalled();
+  });
+
+  it("queries DB for valid CUID", async () => {
+    mockDb.task.findUnique.mockResolvedValue({
+      id: "cm1234567890abcdefghij",
+      title: "Test Task",
+    });
+
+    const result = await getTaskOverview("cm1234567890abcdefghij");
+    expect(mockDb.task.findUnique).toHaveBeenCalledWith(
+      expect.objectContaining({
+        where: { id: "cm1234567890abcdefghij" },
+      })
+    );
+    expect(result).toBeTruthy();
+  });
+
+  it("returns null when task not found", async () => {
+    mockDb.task.findUnique.mockResolvedValue(null);
+    const result = await getTaskOverview("cm1234567890abcdefghij");
+    expect(result).toBeNull();
+  });
+});

package/src/actions/__tests__/task-actions-pin.test.ts

@@ -0,0 +1,79 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+
+vi.mock("@/lib/db", () => ({
+  db: {
+    task: { findUniqueOrThrow: vi.fn(), update: vi.fn() },
+  },
+}));
+
+vi.mock("next/cache", () => ({
+  revalidatePath: vi.fn(),
+}));
+
+import { db } from "@/lib/db";
+import { toggleTaskPinned } from "@/actions/task-actions";
+
+const mockDb = db as unknown as {
+  task: {
+    findUniqueOrThrow: ReturnType<typeof vi.fn>;
+    update: ReturnType<typeof vi.fn>;
+  };
+};
+
+beforeEach(() => {
+  vi.clearAllMocks();
+});
+
+describe("toggleTaskPinned", () => {
+  const validCuid = "cm1234567890abcdefghij";
+
+  it("throws on invalid taskId (not CUID)", async () => {
+    await expect(toggleTaskPinned("not-valid")).rejects.toThrow();
+    expect(mockDb.task.findUniqueOrThrow).not.toHaveBeenCalled();
+  });
+
+  it("throws on empty string", async () => {
+    await expect(toggleTaskPinned("")).rejects.toThrow();
+  });
+
+  it("throws on SQL injection attempt", async () => {
+    await expect(toggleTaskPinned("'; DROP TABLE task; --")).rejects.toThrow();
+    expect(mockDb.task.findUniqueOrThrow).not.toHaveBeenCalled();
+  });
+
+  it("toggles pinned false → true", async () => {
+    mockDb.task.findUniqueOrThrow.mockResolvedValue({ pinned: false });
+    mockDb.task.update.mockResolvedValue({ id: validCuid, pinned: true });
+
+    const result = await toggleTaskPinned(validCuid);
+
+    expect(mockDb.task.findUniqueOrThrow).toHaveBeenCalledWith({
+      where: { id: validCuid },
+      select: { pinned: true },
+    });
+    expect(mockDb.task.update).toHaveBeenCalledWith({
+      where: { id: validCuid },
+      data: { pinned: true },
+    });
+    expect(result.pinned).toBe(true);
+  });
+
+  it("toggles pinned true → false", async () => {
+    mockDb.task.findUniqueOrThrow.mockResolvedValue({ pinned: true });
+    mockDb.task.update.mockResolvedValue({ id: validCuid, pinned: false });
+
+    const result = await toggleTaskPinned(validCuid);
+
+    expect(mockDb.task.update).toHaveBeenCalledWith({
+      where: { id: validCuid },
+      data: { pinned: false },
+    });
+    expect(result.pinned).toBe(false);
+  });
+
+  it("throws when task not found", async () => {
+    mockDb.task.findUniqueOrThrow.mockRejectedValue(new Error("Record not found"));
+
+    await expect(toggleTaskPinned(validCuid)).rejects.toThrow("Record not found");
+  });
+});