Added more tests for creating new tasks

pkg/integrations/link_sharing_test.go

@@ -26,193 +26,329 @@ import (
 )
 
 func TestLinkSharing(t *testing.T) {
-	testHandlerReadOnly := webHandlerTest{
-		linkShare: &models.LinkSharing{
-			ID:          1,
-			Hash:        "test1",
-			ListID:      1,
-			Right:       models.RightRead,
-			SharingType: models.SharingTypeWithoutPassword,
-			SharedByID:  1,
-		},
-		strFunc: func() handler.CObject {
-			return &models.List{}
-		},
-		t: t,
-	}
-	testHandlerWrite := webHandlerTest{
-		linkShare: &models.LinkSharing{
-			ID:          2,
-			Hash:        "test2",
-			ListID:      2,
-			Right:       models.RightWrite,
-			SharingType: models.SharingTypeWithoutPassword,
-			SharedByID:  1,
-		},
-		strFunc: func() handler.CObject {
-			return &models.List{}
-		},
-		t: t,
-	}
-	testHandlerAdmin := webHandlerTest{
-		linkShare: &models.LinkSharing{
-			ID:          3,
-			Hash:        "test3",
-			ListID:      3,
-			Right:       models.RightAdmin,
-			SharingType: models.SharingTypeWithoutPassword,
-			SharedByID:  1,
-		},
-		strFunc: func() handler.CObject {
-			return &models.List{}
-		},
-		t: t,
+
+	linkshareRead := &models.LinkSharing{
+		ID:          1,
+		Hash:        "test1",
+		ListID:      1,
+		Right:       models.RightRead,
+		SharingType: models.SharingTypeWithoutPassword,
+		SharedByID:  1,
 	}
 
-	t.Run("ReadAll", func(t *testing.T) {
-		t.Run("Normal", func(t *testing.T) {
-			rec, err := testHandlerReadOnly.testReadAllWithLinkShare(nil, nil)
-			assert.NoError(t, err)
-			// Should only return the shared list, nothing else
-			assert.Contains(t, rec.Body.String(), `Test1`)
-			assert.NotContains(t, rec.Body.String(), `Test2`)
-			assert.NotContains(t, rec.Body.String(), `Test3`)
-			assert.NotContains(t, rec.Body.String(), `Test4`)
-			assert.NotContains(t, rec.Body.String(), `Test5`)
-		})
-		t.Run("Search", func(t *testing.T) {
-			rec, err := testHandlerReadOnly.testReadAllWithLinkShare(url.Values{"s": []string{"est1"}}, nil)
-			assert.NoError(t, err)
-			// Should only return the shared list, nothing else
-			assert.Contains(t, rec.Body.String(), `Test1`)
-			assert.NotContains(t, rec.Body.String(), `Test2`)
-			assert.NotContains(t, rec.Body.String(), `Test3`)
-			assert.NotContains(t, rec.Body.String(), `Test4`)
-			assert.NotContains(t, rec.Body.String(), `Test5`)
-		})
-	})
-	t.Run("ReadOne", func(t *testing.T) {
-		t.Run("Normal", func(t *testing.T) {
-			rec, err := testHandlerReadOnly.testReadOneWithLinkShare(nil, map[string]string{"list": "1"})
-			assert.NoError(t, err)
-			assert.Contains(t, rec.Body.String(), `"title":"Test1"`)
-			assert.NotContains(t, rec.Body.String(), `"title":"Test2"`)
-		})
-		t.Run("Nonexisting", func(t *testing.T) {
-			_, err := testHandlerReadOnly.testReadOneWithLinkShare(nil, map[string]string{"list": "9999999"})
-			assert.Error(t, err)
-			assertHandlerErrorCode(t, err, models.ErrCodeListDoesNotExist)
-		})
-		t.Run("Rights check", func(t *testing.T) {
-			t.Run("Forbidden", func(t *testing.T) {
-				// List 2, not shared with this token
-				_, err := testHandlerReadOnly.testReadOneWithLinkShare(nil, map[string]string{"list": "2"})
-				assert.Error(t, err)
-				assert.Contains(t, err.(*echo.HTTPError).Message, `You don't have the right to see this`)
+	linkShareWrite := &models.LinkSharing{
+		ID:          2,
+		Hash:        "test2",
+		ListID:      2,
+		Right:       models.RightWrite,
+		SharingType: models.SharingTypeWithoutPassword,
+		SharedByID:  1,
+	}
+
+	linkShareAdmin := &models.LinkSharing{
+		ID:          3,
+		Hash:        "test3",
+		ListID:      3,
+		Right:       models.RightAdmin,
+		SharingType: models.SharingTypeWithoutPassword,
+		SharedByID:  1,
+	}
+
+	t.Run("Lists", func(t *testing.T) {
+		testHandlerListReadOnly := webHandlerTest{
+			linkShare: linkshareRead,
+			strFunc: func() handler.CObject {
+				return &models.List{}
+			},
+			t: t,
+		}
+		testHandlerListWrite := webHandlerTest{
+			linkShare: linkShareWrite,
+			strFunc: func() handler.CObject {
+				return &models.List{}
+			},
+			t: t,
+		}
+		testHandlerListAdmin := webHandlerTest{
+			linkShare: linkShareAdmin,
+			strFunc: func() handler.CObject {
+				return &models.List{}
+			},
+			t: t,
+		}
+
+		t.Run("ReadAll", func(t *testing.T) {
+			t.Run("Normal", func(t *testing.T) {
+				rec, err := testHandlerListReadOnly.testReadAllWithLinkShare(nil, nil)
+				assert.NoError(t, err)
+				// Should only return the shared list, nothing else
+				assert.Contains(t, rec.Body.String(), `Test1`)
+				assert.NotContains(t, rec.Body.String(), `Test2`)
+				assert.NotContains(t, rec.Body.String(), `Test3`)
+				assert.NotContains(t, rec.Body.String(), `Test4`)
+				assert.NotContains(t, rec.Body.String(), `Test5`)
 			})
-			t.Run("Shared readonly", func(t *testing.T) {
-				rec, err := testHandlerReadOnly.testReadOneWithLinkShare(nil, map[string]string{"list": "1"})
+			t.Run("Search", func(t *testing.T) {
+				rec, err := testHandlerListReadOnly.testReadAllWithLinkShare(url.Values{"s": []string{"est1"}}, nil)
+				assert.NoError(t, err)
+				// Should only return the shared list, nothing else
+				assert.Contains(t, rec.Body.String(), `Test1`)
+				assert.NotContains(t, rec.Body.String(), `Test2`)
+				assert.NotContains(t, rec.Body.String(), `Test3`)
+				assert.NotContains(t, rec.Body.String(), `Test4`)
+				assert.NotContains(t, rec.Body.String(), `Test5`)
+			})
+		})
+		t.Run("ReadOne", func(t *testing.T) {
+			t.Run("Normal", func(t *testing.T) {
+				rec, err := testHandlerListReadOnly.testReadOneWithLinkShare(nil, map[string]string{"list": "1"})
 				assert.NoError(t, err)
 				assert.Contains(t, rec.Body.String(), `"title":"Test1"`)
+				assert.NotContains(t, rec.Body.String(), `"title":"Test2"`)
 			})
-			t.Run("Shared write", func(t *testing.T) {
-				rec, err := testHandlerWrite.testReadOneWithLinkShare(nil, map[string]string{"list": "2"})
-				assert.NoError(t, err)
-				assert.Contains(t, rec.Body.String(), `"title":"Test2"`)
+			t.Run("Nonexisting", func(t *testing.T) {
+				_, err := testHandlerListReadOnly.testReadOneWithLinkShare(nil, map[string]string{"list": "9999999"})
+				assert.Error(t, err)
+				assertHandlerErrorCode(t, err, models.ErrCodeListDoesNotExist)
 			})
-			t.Run("Shared admin", func(t *testing.T) {
-				rec, err := testHandlerAdmin.testReadOneWithLinkShare(nil, map[string]string{"list": "3"})
-				assert.NoError(t, err)
-				assert.Contains(t, rec.Body.String(), `"title":"Test3"`)
+			t.Run("Rights check", func(t *testing.T) {
+				t.Run("Forbidden", func(t *testing.T) {
+					// List 2, not shared with this token
+					_, err := testHandlerListReadOnly.testReadOneWithLinkShare(nil, map[string]string{"list": "2"})
+					assert.Error(t, err)
+					assert.Contains(t, err.(*echo.HTTPError).Message, `You don't have the right to see this`)
+				})
+				t.Run("Shared readonly", func(t *testing.T) {
+					rec, err := testHandlerListReadOnly.testReadOneWithLinkShare(nil, map[string]string{"list": "1"})
+					assert.NoError(t, err)
+					assert.Contains(t, rec.Body.String(), `"title":"Test1"`)
+				})
+				t.Run("Shared write", func(t *testing.T) {
+					rec, err := testHandlerListWrite.testReadOneWithLinkShare(nil, map[string]string{"list": "2"})
+					assert.NoError(t, err)
+					assert.Contains(t, rec.Body.String(), `"title":"Test2"`)
+				})
+				t.Run("Shared admin", func(t *testing.T) {
+					rec, err := testHandlerListAdmin.testReadOneWithLinkShare(nil, map[string]string{"list": "3"})
+					assert.NoError(t, err)
+					assert.Contains(t, rec.Body.String(), `"title":"Test3"`)
+				})
 			})
 		})
-	})
-	t.Run("Update", func(t *testing.T) {
-		t.Run("Nonexisting", func(t *testing.T) {
-			_, err := testHandlerReadOnly.testUpdateWithLinkShare(nil, map[string]string{"list": "9999999"}, `{"title":"TestLoremIpsum"}`)
-			assert.Error(t, err)
-			assertHandlerErrorCode(t, err, models.ErrCodeListDoesNotExist)
+		t.Run("Update", func(t *testing.T) {
+			t.Run("Nonexisting", func(t *testing.T) {
+				_, err := testHandlerListReadOnly.testUpdateWithLinkShare(nil, map[string]string{"list": "9999999"}, `{"title":"TestLoremIpsum"}`)
+				assert.Error(t, err)
+				assertHandlerErrorCode(t, err, models.ErrCodeListDoesNotExist)
+			})
+			t.Run("Rights check", func(t *testing.T) {
+				t.Run("Forbidden", func(t *testing.T) {
+					_, err := testHandlerListReadOnly.testUpdateWithLinkShare(nil, map[string]string{"list": "2"}, `{"title":"TestLoremIpsum"}`)
+					assert.Error(t, err)
+					assert.Contains(t, err.(*echo.HTTPError).Message, `Forbidden`)
+				})
+				t.Run("Shared readonly", func(t *testing.T) {
+					_, err := testHandlerListReadOnly.testUpdateWithLinkShare(nil, map[string]string{"list": "1"}, `{"title":"TestLoremIpsum"}`)
+					assert.Error(t, err)
+					assert.Contains(t, err.(*echo.HTTPError).Message, `Forbidden`)
+				})
+				t.Run("Shared write", func(t *testing.T) {
+					rec, err := testHandlerListWrite.testUpdateWithLinkShare(nil, map[string]string{"list": "2"}, `{"title":"TestLoremIpsum"}`)
+					assert.NoError(t, err)
+					assert.Contains(t, rec.Body.String(), `"title":"TestLoremIpsum"`)
+				})
+				t.Run("Shared admin", func(t *testing.T) {
+					rec, err := testHandlerListAdmin.testUpdateWithLinkShare(nil, map[string]string{"list": "3"}, `{"title":"TestLoremIpsum"}`)
+					assert.NoError(t, err)
+					assert.Contains(t, rec.Body.String(), `"title":"TestLoremIpsum"`)
+				})
+			})
 		})
-		t.Run("Rights check", func(t *testing.T) {
-			t.Run("Forbidden", func(t *testing.T) {
-				_, err := testHandlerReadOnly.testUpdateWithLinkShare(nil, map[string]string{"list": "2"}, `{"title":"TestLoremIpsum"}`)
+		t.Run("Delete", func(t *testing.T) {
+			t.Run("Nonexisting", func(t *testing.T) {
+				_, err := testHandlerListReadOnly.testDeleteWithLinkShare(nil, map[string]string{"list": "9999999"})
+				assert.Error(t, err)
+				assertHandlerErrorCode(t, err, models.ErrCodeListDoesNotExist)
+			})
+			t.Run("Rights check", func(t *testing.T) {
+				t.Run("Forbidden", func(t *testing.T) {
+					_, err := testHandlerListReadOnly.testDeleteWithLinkShare(nil, map[string]string{"list": "1"})
+					assert.Error(t, err)
+					assert.Contains(t, err.(*echo.HTTPError).Message, `Forbidden`)
+				})
+				t.Run("Shared readonly", func(t *testing.T) {
+					_, err := testHandlerListReadOnly.testDeleteWithLinkShare(nil, map[string]string{"list": "1"})
+					assert.Error(t, err)
+					assert.Contains(t, err.(*echo.HTTPError).Message, `Forbidden`)
+				})
+				t.Run("Shared write", func(t *testing.T) {
+					_, err := testHandlerListWrite.testDeleteWithLinkShare(nil, map[string]string{"list": "2"})
+					assert.Error(t, err)
+					assert.Contains(t, err.(*echo.HTTPError).Message, `Forbidden`)
+				})
+				t.Run("Shared admin", func(t *testing.T) {
+					rec, err := testHandlerListAdmin.testDeleteWithLinkShare(nil, map[string]string{"list": "3"})
+					assert.NoError(t, err)
+					assert.Contains(t, rec.Body.String(), `"message":"Successfully deleted."`)
+				})
+			})
+		})
+
+		// Creating a list should always be forbidden, since users need access to a namespace to create a list
+		t.Run("Create", func(t *testing.T) {
+			t.Run("Nonexisting", func(t *testing.T) {
+				_, err := testHandlerListReadOnly.testCreateWithLinkShare(nil, map[string]string{"namespace": "999999"}, `{"title":"Lorem"}`)
 				assert.Error(t, err)
 				assert.Contains(t, err.(*echo.HTTPError).Message, `Forbidden`)
 			})
-			t.Run("Shared readonly", func(t *testing.T) {
-				_, err := testHandlerReadOnly.testUpdateWithLinkShare(nil, map[string]string{"list": "1"}, `{"title":"TestLoremIpsum"}`)
-				assert.Error(t, err)
-				assert.Contains(t, err.(*echo.HTTPError).Message, `Forbidden`)
-			})
-			t.Run("Shared write", func(t *testing.T) {
-				rec, err := testHandlerWrite.testUpdateWithLinkShare(nil, map[string]string{"list": "2"}, `{"title":"TestLoremIpsum"}`)
-				assert.NoError(t, err)
-				assert.Contains(t, rec.Body.String(), `"title":"TestLoremIpsum"`)
-			})
-			t.Run("Shared admin", func(t *testing.T) {
-				rec, err := testHandlerAdmin.testUpdateWithLinkShare(nil, map[string]string{"list": "3"}, `{"title":"TestLoremIpsum"}`)
-				assert.NoError(t, err)
-				assert.Contains(t, rec.Body.String(), `"title":"TestLoremIpsum"`)
-			})
-		})
-	})
-	t.Run("Delete", func(t *testing.T) {
-		t.Run("Nonexisting", func(t *testing.T) {
-			_, err := testHandlerReadOnly.testDeleteWithLinkShare(nil, map[string]string{"list": "9999999"})
-			assert.Error(t, err)
-			assertHandlerErrorCode(t, err, models.ErrCodeListDoesNotExist)
-		})
-		t.Run("Rights check", func(t *testing.T) {
-			t.Run("Forbidden", func(t *testing.T) {
-				_, err := testHandlerReadOnly.testDeleteWithLinkShare(nil, map[string]string{"list": "1"})
-				assert.Error(t, err)
-				assert.Contains(t, err.(*echo.HTTPError).Message, `Forbidden`)
-			})
-			t.Run("Shared readonly", func(t *testing.T) {
-				_, err := testHandlerReadOnly.testDeleteWithLinkShare(nil, map[string]string{"list": "1"})
-				assert.Error(t, err)
-				assert.Contains(t, err.(*echo.HTTPError).Message, `Forbidden`)
-			})
-			t.Run("Shared write", func(t *testing.T) {
-				_, err := testHandlerWrite.testDeleteWithLinkShare(nil, map[string]string{"list": "2"})
-				assert.Error(t, err)
-				assert.Contains(t, err.(*echo.HTTPError).Message, `Forbidden`)
-			})
-			t.Run("Shared admin", func(t *testing.T) {
-				rec, err := testHandlerAdmin.testDeleteWithLinkShare(nil, map[string]string{"list": "3"})
-				assert.NoError(t, err)
-				assert.Contains(t, rec.Body.String(), `"message":"Successfully deleted."`)
+			t.Run("Rights check", func(t *testing.T) {
+				t.Run("Shared readonly", func(t *testing.T) {
+					_, err := testHandlerListReadOnly.testCreateWithLinkShare(nil, map[string]string{"namespace": "1"}, `{"title":"Lorem","description":"Lorem Ipsum"}`)
+					assert.Error(t, err)
+					assert.Contains(t, err.(*echo.HTTPError).Message, `Forbidden`)
+				})
+				t.Run("Shared write", func(t *testing.T) {
+					_, err := testHandlerListWrite.testCreateWithLinkShare(nil, map[string]string{"namespace": "2"}, `{"title":"Lorem","description":"Lorem Ipsum"}`)
+					assert.Error(t, err)
+					assert.Contains(t, err.(*echo.HTTPError).Message, `Forbidden`)
+				})
+				t.Run("Shared admin", func(t *testing.T) {
+					_, err := testHandlerListAdmin.testCreateWithLinkShare(nil, map[string]string{"namespace": "3"}, `{"title":"Lorem","description":"Lorem Ipsum"}`)
+					assert.Error(t, err)
+					assert.Contains(t, err.(*echo.HTTPError).Message, `Forbidden`)
+				})
 			})
 		})
+
 	})
 
 	t.Run("Tasks", func(t *testing.T) {
-		// Should work the same way as with other rights.
-	})
-
-	// Creating a list should always be forbidden, since users need access to a namespace to create a list
-	t.Run("Create", func(t *testing.T) {
-		t.Run("Nonexisting", func(t *testing.T) {
-			_, err := testHandlerReadOnly.testCreateWithLinkShare(nil, map[string]string{"namespace": "999999"}, `{"title":"Lorem"}`)
-			assert.Error(t, err)
-			assert.Contains(t, err.(*echo.HTTPError).Message, `Forbidden`)
+		testHandlerTaskReadOnly := webHandlerTest{
+			linkShare: linkshareRead,
+			strFunc: func() handler.CObject {
+				return &models.Task{}
+			},
+			t: t,
+		}
+		testHandlerTaskWrite := webHandlerTest{
+			linkShare: linkShareWrite,
+			strFunc: func() handler.CObject {
+				return &models.Task{}
+			},
+			t: t,
+		}
+		testHandlerTaskAdmin := webHandlerTest{
+			linkShare: linkShareAdmin,
+			strFunc: func() handler.CObject {
+				return &models.Task{}
+			},
+			t: t,
+		}
+		t.Run("ReadAll", func(t *testing.T) {
+			t.Run("shared readonly", func(t *testing.T) {
+				rec, err := testHandlerTaskReadOnly.testReadAllWithLinkShare(nil, nil)
+				assert.NoError(t, err)
+				assert.Contains(t, rec.Body.String(), `task #1`)
+				assert.Contains(t, rec.Body.String(), `task #2`)
+				assert.Contains(t, rec.Body.String(), `task #3`)
+				assert.Contains(t, rec.Body.String(), `task #4`)
+				assert.Contains(t, rec.Body.String(), `task #5`)
+				assert.Contains(t, rec.Body.String(), `task #6`)
+				assert.Contains(t, rec.Body.String(), `task #7`)
+				assert.Contains(t, rec.Body.String(), `task #8`)
+				assert.Contains(t, rec.Body.String(), `task #9`)
+				assert.Contains(t, rec.Body.String(), `task #10`)
+				assert.Contains(t, rec.Body.String(), `task #11`)
+				assert.Contains(t, rec.Body.String(), `task #12`)
+				assert.NotContains(t, rec.Body.String(), `task #13`)
+				assert.NotContains(t, rec.Body.String(), `task #14`)
+			})
+			t.Run("shared write", func(t *testing.T) {
+				rec, err := testHandlerTaskWrite.testReadAllWithLinkShare(nil, nil)
+				assert.NoError(t, err)
+				assert.NotContains(t, rec.Body.String(), `task #2`)
+				assert.NotContains(t, rec.Body.String(), `task #3`)
+				assert.NotContains(t, rec.Body.String(), `task #4`)
+				assert.NotContains(t, rec.Body.String(), `task #5`)
+				assert.NotContains(t, rec.Body.String(), `task #6`)
+				assert.NotContains(t, rec.Body.String(), `task #7`)
+				assert.NotContains(t, rec.Body.String(), `task #8`)
+				assert.NotContains(t, rec.Body.String(), `task #9`)
+				assert.NotContains(t, rec.Body.String(), `task #10`)
+				assert.NotContains(t, rec.Body.String(), `task #11`)
+				assert.NotContains(t, rec.Body.String(), `task #12`)
+				assert.Contains(t, rec.Body.String(), `task #13`)
+				assert.NotContains(t, rec.Body.String(), `task #14`)
+			})
+			t.Run("shared admin", func(t *testing.T) {
+				rec, err := testHandlerTaskAdmin.testReadAllWithLinkShare(nil, nil)
+				assert.NoError(t, err)
+				assert.NotContains(t, rec.Body.String(), `task #2`)
+				assert.NotContains(t, rec.Body.String(), `task #4`)
+				assert.NotContains(t, rec.Body.String(), `task #5`)
+				assert.NotContains(t, rec.Body.String(), `task #6`)
+				assert.NotContains(t, rec.Body.String(), `task #7`)
+				assert.NotContains(t, rec.Body.String(), `task #8`)
+				assert.NotContains(t, rec.Body.String(), `task #9`)
+				assert.NotContains(t, rec.Body.String(), `task #10`)
+				assert.NotContains(t, rec.Body.String(), `task #11`)
+				assert.NotContains(t, rec.Body.String(), `task #12`)
+				assert.NotContains(t, rec.Body.String(), `task #13`)
+				assert.NotContains(t, rec.Body.String(), `task #14`)
+				assert.Contains(t, rec.Body.String(), `task #32`)
+			})
 		})
-		t.Run("Rights check", func(t *testing.T) {
+		t.Run("Create", func(t *testing.T) {
 			t.Run("Shared readonly", func(t *testing.T) {
-				_, err := testHandlerReadOnly.testCreateWithLinkShare(nil, map[string]string{"namespace": "1"}, `{"title":"Lorem","description":"Lorem Ipsum"}`)
+				_, err := testHandlerTaskReadOnly.testCreateWithLinkShare(nil, map[string]string{"list": "1"}, `{"text":"Lorem Ipsum"}`)
 				assert.Error(t, err)
 				assert.Contains(t, err.(*echo.HTTPError).Message, `Forbidden`)
 			})
 			t.Run("Shared write", func(t *testing.T) {
-				_, err := testHandlerWrite.testCreateWithLinkShare(nil, map[string]string{"namespace": "2"}, `{"title":"Lorem","description":"Lorem Ipsum"}`)
+				rec, err := testHandlerTaskWrite.testCreateWithLinkShare(nil, map[string]string{"list": "2"}, `{"text":"Lorem Ipsum"}`)
+				assert.NoError(t, err)
+				assert.Contains(t, rec.Body.String(), `"text":"Lorem Ipsum"`)
+			})
+			t.Run("Shared admin", func(t *testing.T) {
+				rec, err := testHandlerTaskAdmin.testCreateWithLinkShare(nil, map[string]string{"list": "3"}, `{"text":"Lorem Ipsum"}`)
+				assert.NoError(t, err)
+				assert.Contains(t, rec.Body.String(), `"text":"Lorem Ipsum"`)
+			})
+		})
+		t.Run("Update", func(t *testing.T) {
+			t.Run("Shared readonly", func(t *testing.T) {
+				_, err := testHandlerTaskReadOnly.testUpdateWithLinkShare(nil, map[string]string{"listtask": "1"}, `{"text":"Lorem Ipsum"}`)
 				assert.Error(t, err)
 				assert.Contains(t, err.(*echo.HTTPError).Message, `Forbidden`)
 			})
-			t.Run("Shared admin", func(t *testing.T) {
-				_, err := testHandlerAdmin.testCreateWithLinkShare(nil, map[string]string{"namespace": "3"}, `{"title":"Lorem","description":"Lorem Ipsum"}`)
+			t.Run("Shared write", func(t *testing.T) {
+				rec, err := testHandlerTaskWrite.testUpdateWithLinkShare(nil, map[string]string{"listtask": "13"}, `{"text":"Lorem Ipsum"}`)
+				assert.NoError(t, err)
+				assert.Contains(t, rec.Body.String(), `"text":"Lorem Ipsum"`)
+			})
+			t.Run(" admin", func(t *testing.T) {
+				rec, err := testHandlerTaskAdmin.testUpdateWithLinkShare(nil, map[string]string{"listtask": "32"}, `{"text":"Lorem Ipsum"}`)
+				assert.NoError(t, err)
+				assert.Contains(t, rec.Body.String(), `"text":"Lorem Ipsum"`)
+			})
+
+		})
+		t.Run("Delete", func(t *testing.T) {
+			t.Run("Shared readonly", func(t *testing.T) {
+				_, err := testHandlerTaskReadOnly.testDeleteWithLinkShare(nil, map[string]string{"listtask": "1"})
 				assert.Error(t, err)
 				assert.Contains(t, err.(*echo.HTTPError).Message, `Forbidden`)
 			})
+			t.Run("Shared write", func(t *testing.T) {
+				rec, err := testHandlerTaskWrite.testDeleteWithLinkShare(nil, map[string]string{"listtask": "13"})
+				assert.NoError(t, err)
+				assert.Contains(t, rec.Body.String(), `Successfully deleted.`)
+			})
+			t.Run("Shared admin", func(t *testing.T) {
+				rec, err := testHandlerTaskAdmin.testDeleteWithLinkShare(nil, map[string]string{"listtask": "32"})
+				assert.NoError(t, err)
+				assert.Contains(t, rec.Body.String(), `Successfully deleted.`)
+			})
 		})
 	})
 

pkg/integrations/task_test.go

@@ -90,7 +90,7 @@ func TestTask(t *testing.T) {
 			t.Run("by priority asc", func(t *testing.T) {
 				rec, err := testHandler.testReadAllWithUser(url.Values{"sort": []string{"priorityasc"}}, nil)
 				assert.NoError(t, err)
-				assert.Contains(t, rec.Body.String(), `{"id":31,"text":"task #31 with color","description":"","done":false,"doneAt":0,"dueDate":0,"reminderDates":null,"listID":1,"repeatAfter":0,"parentTaskID":0,"priority":0,"startDate":0,"endDate":0,"assignees":null,"labels":null,"hexColor":"f0f0f0","subtasks":null,"created":1543626724,"updated":1543626724,"createdBy":{"id":1,"username":"user1","avatarUrl":"111d68d06e2d317b5a59c2c6c5bad808","created":0,"updated":0}},{"id":4,"text":"task #4 low prio","description":"","done":false,"doneAt":0,"dueDate":0,"reminderDates":null,"listID":1,"repeatAfter":0,"parentTaskID":0,"priority":1,"startDate":0,"endDate":0,"assignees":null,"labels":null,"hexColor":"","subtasks":null,"created":1543626724,"updated":1543626724,"createdBy":{"id":1,"username":"user1","avatarUrl":"111d68d06e2d317b5a59c2c6c5bad808","created":0,"updated":0}},{"id":3,"text":"task #3 high prio","description":"","done":false,"doneAt":0,"dueDate":0,"reminderDates":null,"listID":1,"repeatAfter":0,"parentTaskID":0,"priority":100,"startDate":0,"endDate":0,"assignees":null,"labels":null,"hexColor":"","subtasks":null,"created":1543626724,"updated":1543626724,"createdBy":{"id":1,"username":"user1","avatarUrl":"111d68d06e2d317b5a59c2c6c5bad808","created":0,"updated":0}}]`)
+				assert.Contains(t, rec.Body.String(), `{"id":32,"text":"task #32","description":"","done":false,"doneAt":0,"dueDate":0,"reminderDates":null,"listID":3,"repeatAfter":0,"parentTaskID":0,"priority":0,"startDate":0,"endDate":0,"assignees":null,"labels":null,"hexColor":"","subtasks":null,"created":1543626724,"updated":1543626724,"createdBy":{"id":1,"username":"user1","avatarUrl":"111d68d06e2d317b5a59c2c6c5bad808","created":0,"updated":0}},{"id":4,"text":"task #4 low prio","description":"","done":false,"doneAt":0,"dueDate":0,"reminderDates":null,"listID":1,"repeatAfter":0,"parentTaskID":0,"priority":1,"startDate":0,"endDate":0,"assignees":null,"labels":null,"hexColor":"","subtasks":null,"created":1543626724,"updated":1543626724,"createdBy":{"id":1,"username":"user1","avatarUrl":"111d68d06e2d317b5a59c2c6c5bad808","created":0,"updated":0}},{"id":3,"text":"task #3 high prio","description":"","done":false,"doneAt":0,"dueDate":0,"reminderDates":null,"listID":1,"repeatAfter":0,"parentTaskID":0,"priority":100,"startDate":0,"endDate":0,"assignees":null,"labels":null,"hexColor":"","subtasks":null,"created":1543626724,"updated":1543626724,"createdBy":{"id":1,"username":"user1","avatarUrl":"111d68d06e2d317b5a59c2c6c5bad808","created":0,"updated":0}}]`)
 			})
 			// should equal duedate desc
 			t.Run("by duedate", func(t *testing.T) {

pkg/models/fixtures/tasks.yml

@@ -198,4 +198,10 @@
   hex_color: f0f0f0
   created: 1543626724
   updated: 1543626724
+- id: 32
+  text: 'task #32'
+  created_by_id: 1
+  list_id: 3
+  created: 1543626724
+  updated: 1543626724
 

pkg/models/label.go

@@ -18,7 +18,6 @@ package models
 
 import (
 	"code.vikunja.io/web"
-	"time"
 )
 
 // Label represents a label
@@ -192,7 +191,14 @@ func getLabelByIDSimple(labelID int64) (*Label, error) {
 
 // Helper method to get all task ids a user has
 func getUserTaskIDs(u *User) (taskIDs []int64, err error) {
-	tasks, err := GetTasksByUser("", u, -1, SortTasksByUnsorted, time.Unix(0, 0), time.Unix(0, 0))
+
+	// Get all lists
+	lists, err := getRawListsForUser("", u, -1)
+	if err != nil {
+		return nil, err
+	}
+
+	tasks, err := getTasksForLists(lists, &taskOptions{})
 	if err != nil {
 		return nil, err
 	}

pkg/models/tasks.go

@@ -147,17 +147,40 @@ func (t *Task) ReadAll(search string, a web.Auth, page int) (interface{}, error)
 		sortby = SortTasksByUnsorted
 	}
 
-	return GetTasksByUser(search, &User{ID: a.GetID()}, page, sortby, time.Unix(t.StartDateSortUnix, 0), time.Unix(t.EndDateSortUnix, 0))
-}
+	taskopts := &taskOptions{
+		search:    search,
+		sortby:    sortby,
+		startDate: time.Unix(t.StartDateSortUnix, 0),
+		endDate:   time.Unix(t.EndDateSortUnix, 0),
+	}
 
-//GetTasksByUser returns all tasks for a user
-func GetTasksByUser(search string, u *User, page int, sortby SortBy, startDate time.Time, endDate time.Time) ([]*Task, error) {
-	// Get all lists
-	lists, err := getRawListsForUser("", u, page)
+	shareAuth, is := a.(*LinkSharing)
+	if is {
+		shareAuth.List = &List{ID: shareAuth.ListID}
+		err := shareAuth.List.GetSimpleByID()
+		if err != nil {
+			return nil, err
+		}
+		return getTasksForLists([]*List{shareAuth.List}, taskopts)
+	}
+
+	// Get all lists for the user
+	lists, err := getRawListsForUser("", &User{ID: a.GetID()}, page)
 	if err != nil {
 		return nil, err
 	}
 
+	return getTasksForLists(lists, taskopts)
+}
+
+type taskOptions struct {
+	search    string
+	sortby    SortBy
+	startDate time.Time
+	endDate   time.Time
+}
+
+func getTasksForLists(lists []*List, opts *taskOptions) (tasks []*Task, err error) {
 	// Get all list IDs and get the tasks
 	var listIDs []int64
 	for _, l := range lists {
@@ -165,7 +188,7 @@ func GetTasksByUser(search string, u *User, page int, sortby SortBy, startDate t
 	}
 
 	var orderby string
-	switch sortby {
+	switch opts.sortby {
 	case SortTasksByPriorityDesc:
 		orderby = "priority desc"
 	case SortTasksByPriorityAsc:
@@ -179,20 +202,20 @@ func GetTasksByUser(search string, u *User, page int, sortby SortBy, startDate t
 	taskMap := make(map[int64]*Task)
 
 	// Then return all tasks for that lists
-	if startDate.Unix() != 0 || endDate.Unix() != 0 {
+	if opts.startDate.Unix() != 0 || opts.endDate.Unix() != 0 {
 
 		startDateUnix := time.Now().Unix()
-		if startDate.Unix() != 0 {
-			startDateUnix = startDate.Unix()
+		if opts.startDate.Unix() != 0 {
+			startDateUnix = opts.startDate.Unix()
 		}
 
 		endDateUnix := time.Now().Unix()
-		if endDate.Unix() != 0 {
-			endDateUnix = endDate.Unix()
+		if opts.endDate.Unix() != 0 {
+			endDateUnix = opts.endDate.Unix()
 		}
 
 		if err := x.In("list_id", listIDs).
-			Where("text LIKE ?", "%"+search+"%").
+			Where("text LIKE ?", "%"+opts.search+"%").
 			And("((due_date_unix BETWEEN ? AND ?) OR "+
 				"(start_date_unix BETWEEN ? and ?) OR "+
 				"(end_date_unix BETWEEN ? and ?))", startDateUnix, endDateUnix, startDateUnix, endDateUnix, startDateUnix, endDateUnix).
@@ -203,7 +226,7 @@ func GetTasksByUser(search string, u *User, page int, sortby SortBy, startDate t
 		}
 	} else {
 		if err := x.In("list_id", listIDs).
-			Where("text LIKE ?", "%"+search+"%").
+			Where("text LIKE ?", "%"+opts.search+"%").
 			And("(parent_task_id = 0 OR parent_task_id IS NULL)").
 			OrderBy(orderby).
 			Find(&taskMap); err != nil {
@@ -211,13 +234,13 @@ func GetTasksByUser(search string, u *User, page int, sortby SortBy, startDate t
 		}
 	}
 
-	tasks, err := addMoreInfoToTasks(taskMap)
+	tasks, err = addMoreInfoToTasks(taskMap)
 	if err != nil {
 		return nil, err
 	}
 	// Because the list is sorted by id which we don't want (since we're dealing with maps)
 	// we have to manually sort the tasks again here.
-	sortTasks(tasks, sortby)
+	sortTasks(tasks, opts.sortby)
 
 	return tasks, err
 }