Scope tag_ids assignment to the card account

Author: robzolkos

app/models/card/taggable.rb

@@ -8,6 +8,13 @@ module Card::Taggable
     scope :tagged_with, ->(tags) { joins(:taggings).where(taggings: { tag: tags }) }
   end
 
+  def tag_ids=(ids)
+    ids = Array(ids).compact_blank
+    account_scope = account || board&.account || Current.account
+
+    self.tags = ids.present? ? account_scope.tags.find(ids) : []
+  end
+
   def toggle_tag_with(title)
     tag = account.tags.find_or_create_by!(title: title)
 

test/controllers/cards_controller_test.rb

@@ -222,6 +222,28 @@ class CardsControllerTest < ActionDispatch::IntegrationTest
     assert_equal [ tag.title ], @response.parsed_body["tags"]
   end
 
+  test "create as JSON with nonexistent tag_ids returns not found" do
+    assert_no_difference -> { Card.count } do
+      post board_cards_path(boards(:writebook)),
+        params: { card: { title: "Tagged card", tag_ids: [ "does-not-exist" ] } },
+        as: :json
+    end
+
+    assert_response :not_found
+  end
+
+  test "create as JSON with foreign-account tag_ids returns not found" do
+    foreign_tag = accounts(:initech).tags.create!(title: "foreign")
+
+    assert_no_difference -> { Card.count } do
+      post board_cards_path(boards(:writebook)),
+        params: { card: { title: "Tagged card", tag_ids: [ foreign_tag.id ] } },
+        as: :json
+    end
+
+    assert_response :not_found
+  end
+
   test "create as JSON with custom created_at" do
     custom_time = Time.utc(2024, 1, 15, 10, 30, 0)
 
@@ -319,6 +341,16 @@ class CardsControllerTest < ActionDispatch::IntegrationTest
     assert_equal [ tag.title ], @response.parsed_body["tags"]
   end
 
+  test "update as JSON with foreign-account tag_ids returns not found" do
+    card = cards(:logo)
+    foreign_tag = accounts(:initech).tags.create!(title: "foreign")
+
+    put card_path(card, format: :json), params: { card: { tag_ids: [ foreign_tag.id ] } }
+
+    assert_response :not_found
+    assert_equal [ tags(:web) ], card.reload.tags
+  end
+
   test "update as JSON with description and tag_ids busts the card cache key" do
     card = cards(:logo)
     original_cache_key = card.cache_key_with_version

test/models/card/taggable_test.rb

@@ -38,4 +38,18 @@ class Card::TaggableTest < ActiveSupport::TestCase
     assert @card.reload.updated_at > card_updated_at
     assert board.reload.updated_at > board_updated_at
   end
+
+  test "updating tag_ids raises when a tag does not exist" do
+    assert_raises(ActiveRecord::RecordNotFound) do
+      @card.update!(tag_ids: [ "does-not-exist" ])
+    end
+  end
+
+  test "updating tag_ids raises when the tag belongs to another account" do
+    foreign_tag = accounts(:initech).tags.create!(title: "foreign")
+
+    assert_raises(ActiveRecord::RecordNotFound) do
+      @card.update!(tag_ids: [ foreign_tag.id ])
+    end
+  end
 end