Merge pull request 'codex/public-api-docs' (#38) from codex/public-api-docs into main

Reviewed-on: OpenSource/KanbanGit#38
Reviewed-by: Koda <koda@twyco.de>

tests/Feature/Api/PublicApiDocumentationTest.php

@@ -0,0 +1,42 @@
+<?php
+
+namespace Tests\Feature\Api;
+
+use Tests\TestCase;
+
+class PublicApiDocumentationTest extends TestCase
+{
+    public function test_scalar_api_docs_are_public(): void
+    {
+        $response = $this->get('/api/docs')
+            ->assertOk();
+
+        $content = (string) $response->getContent();
+
+        $this->assertMatchesRegularExpression('/"hideClientButton"\s*:\s*true/', $content);
+        $this->assertMatchesRegularExpression('/"mcp"\s*:\s*\{[^}]*"disabled"\s*:\s*true/', $content);
+    }
+
+    public function test_openapi_document_is_publicly_served(): void
+    {
+        $response = $this->get('/api/docs/openapi.json')
+            ->assertOk();
+
+        $this->assertStringStartsWith(
+            'application/vnd.oai.openapi+json',
+            (string) $response->headers->get('Content-Type'),
+        );
+
+        $document = json_decode((string) $response->getContent(), true, 512, JSON_THROW_ON_ERROR);
+
+        $this->assertSame('3.1.0', $document['openapi']);
+        $this->assertSame([], $document['security']);
+        $this->assertArrayHasKey('/projects', $document['paths']);
+    }
+
+    public function test_application_api_still_requires_an_authenticated_user(): void
+    {
+        $this->getJson('/api/projects')
+            ->assertUnauthorized();
+    }
+}