init commit

server/router/api/v1/test/idp_service_test.go

@@ -0,0 +1,519 @@
+package v1
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/types/known/fieldmaskpb"
+
+	v1pb "github.com/usememos/memos/proto/gen/api/v1"
+)
+
+func TestCreateIdentityProvider(t *testing.T) {
+	ctx := context.Background()
+
+	t.Run("CreateIdentityProvider success", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create host user
+		hostUser, err := ts.CreateHostUser(ctx, "admin")
+		require.NoError(t, err)
+
+		// Set user context
+		ctx := ts.CreateUserContext(ctx, hostUser.ID)
+
+		// Create OAuth2 identity provider
+		req := &v1pb.CreateIdentityProviderRequest{
+			IdentityProvider: &v1pb.IdentityProvider{
+				Title:            "Test OAuth2 Provider",
+				IdentifierFilter: "",
+				Type:             v1pb.IdentityProvider_OAUTH2,
+				Config: &v1pb.IdentityProviderConfig{
+					Config: &v1pb.IdentityProviderConfig_Oauth2Config{
+						Oauth2Config: &v1pb.OAuth2Config{
+							ClientId:     "test-client-id",
+							ClientSecret: "test-client-secret",
+							AuthUrl:      "https://example.com/oauth/authorize",
+							TokenUrl:     "https://example.com/oauth/token",
+							UserInfoUrl:  "https://example.com/oauth/userinfo",
+							Scopes:       []string{"openid", "profile", "email"},
+							FieldMapping: &v1pb.FieldMapping{
+								Identifier:  "id",
+								DisplayName: "name",
+								Email:       "email",
+								AvatarUrl:   "avatar_url",
+							},
+						},
+					},
+				},
+			},
+		}
+
+		resp, err := ts.Service.CreateIdentityProvider(ctx, req)
+		require.NoError(t, err)
+		require.NotNil(t, resp)
+		require.Equal(t, "Test OAuth2 Provider", resp.Title)
+		require.Equal(t, v1pb.IdentityProvider_OAUTH2, resp.Type)
+		require.Contains(t, resp.Name, "identityProviders/")
+		require.NotNil(t, resp.Config.GetOauth2Config())
+		require.Equal(t, "test-client-id", resp.Config.GetOauth2Config().ClientId)
+	})
+
+	t.Run("CreateIdentityProvider permission denied for non-host user", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create regular user
+		regularUser, err := ts.CreateRegularUser(ctx, "user")
+		require.NoError(t, err)
+
+		// Set user context
+		ctx := ts.CreateUserContext(ctx, regularUser.ID)
+
+		req := &v1pb.CreateIdentityProviderRequest{
+			IdentityProvider: &v1pb.IdentityProvider{
+				Title: "Test Provider",
+				Type:  v1pb.IdentityProvider_OAUTH2,
+			},
+		}
+
+		_, err = ts.Service.CreateIdentityProvider(ctx, req)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "permission denied")
+	})
+
+	t.Run("CreateIdentityProvider unauthenticated", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		req := &v1pb.CreateIdentityProviderRequest{
+			IdentityProvider: &v1pb.IdentityProvider{
+				Title: "Test Provider",
+				Type:  v1pb.IdentityProvider_OAUTH2,
+			},
+		}
+
+		_, err := ts.Service.CreateIdentityProvider(ctx, req)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "permission denied")
+	})
+}
+
+func TestListIdentityProviders(t *testing.T) {
+	ctx := context.Background()
+
+	t.Run("ListIdentityProviders empty", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		req := &v1pb.ListIdentityProvidersRequest{}
+		resp, err := ts.Service.ListIdentityProviders(ctx, req)
+		require.NoError(t, err)
+		require.NotNil(t, resp)
+		require.Empty(t, resp.IdentityProviders)
+	})
+
+	t.Run("ListIdentityProviders with providers", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create host user
+		hostUser, err := ts.CreateHostUser(ctx, "admin")
+		require.NoError(t, err)
+
+		// Set user context
+		userCtx := ts.CreateUserContext(ctx, hostUser.ID)
+
+		// Create a couple of identity providers
+		createReq1 := &v1pb.CreateIdentityProviderRequest{
+			IdentityProvider: &v1pb.IdentityProvider{
+				Title: "Provider 1",
+				Type:  v1pb.IdentityProvider_OAUTH2,
+				Config: &v1pb.IdentityProviderConfig{
+					Config: &v1pb.IdentityProviderConfig_Oauth2Config{
+						Oauth2Config: &v1pb.OAuth2Config{
+							ClientId:    "client1",
+							AuthUrl:     "https://example1.com/auth",
+							TokenUrl:    "https://example1.com/token",
+							UserInfoUrl: "https://example1.com/user",
+							FieldMapping: &v1pb.FieldMapping{
+								Identifier: "id",
+							},
+						},
+					},
+				},
+			},
+		}
+
+		createReq2 := &v1pb.CreateIdentityProviderRequest{
+			IdentityProvider: &v1pb.IdentityProvider{
+				Title: "Provider 2",
+				Type:  v1pb.IdentityProvider_OAUTH2,
+				Config: &v1pb.IdentityProviderConfig{
+					Config: &v1pb.IdentityProviderConfig_Oauth2Config{
+						Oauth2Config: &v1pb.OAuth2Config{
+							ClientId:    "client2",
+							AuthUrl:     "https://example2.com/auth",
+							TokenUrl:    "https://example2.com/token",
+							UserInfoUrl: "https://example2.com/user",
+							FieldMapping: &v1pb.FieldMapping{
+								Identifier: "id",
+							},
+						},
+					},
+				},
+			},
+		}
+
+		_, err = ts.Service.CreateIdentityProvider(userCtx, createReq1)
+		require.NoError(t, err)
+		_, err = ts.Service.CreateIdentityProvider(userCtx, createReq2)
+		require.NoError(t, err)
+
+		// List providers
+		listReq := &v1pb.ListIdentityProvidersRequest{}
+		resp, err := ts.Service.ListIdentityProviders(ctx, listReq)
+		require.NoError(t, err)
+		require.NotNil(t, resp)
+		require.Len(t, resp.IdentityProviders, 2)
+
+		// Verify response contains expected providers
+		titles := []string{resp.IdentityProviders[0].Title, resp.IdentityProviders[1].Title}
+		require.Contains(t, titles, "Provider 1")
+		require.Contains(t, titles, "Provider 2")
+	})
+}
+
+func TestGetIdentityProvider(t *testing.T) {
+	ctx := context.Background()
+
+	t.Run("GetIdentityProvider success", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create host user
+		hostUser, err := ts.CreateHostUser(ctx, "admin")
+		require.NoError(t, err)
+
+		// Set user context
+		userCtx := ts.CreateUserContext(ctx, hostUser.ID)
+
+		// Create identity provider
+		createReq := &v1pb.CreateIdentityProviderRequest{
+			IdentityProvider: &v1pb.IdentityProvider{
+				Title: "Test Provider",
+				Type:  v1pb.IdentityProvider_OAUTH2,
+				Config: &v1pb.IdentityProviderConfig{
+					Config: &v1pb.IdentityProviderConfig_Oauth2Config{
+						Oauth2Config: &v1pb.OAuth2Config{
+							ClientId:     "test-client",
+							ClientSecret: "test-secret",
+							AuthUrl:      "https://example.com/auth",
+							TokenUrl:     "https://example.com/token",
+							UserInfoUrl:  "https://example.com/user",
+							Scopes:       []string{"openid", "profile"},
+							FieldMapping: &v1pb.FieldMapping{
+								Identifier:  "id",
+								DisplayName: "name",
+								Email:       "email",
+							},
+						},
+					},
+				},
+			},
+		}
+
+		created, err := ts.Service.CreateIdentityProvider(userCtx, createReq)
+		require.NoError(t, err)
+
+		// Get identity provider
+		getReq := &v1pb.GetIdentityProviderRequest{
+			Name: created.Name,
+		}
+
+		resp, err := ts.Service.GetIdentityProvider(ctx, getReq)
+		require.NoError(t, err)
+		require.NotNil(t, resp)
+		require.Equal(t, created.Name, resp.Name)
+		require.Equal(t, "Test Provider", resp.Title)
+		require.Equal(t, v1pb.IdentityProvider_OAUTH2, resp.Type)
+		require.NotNil(t, resp.Config.GetOauth2Config())
+		require.Equal(t, "test-client", resp.Config.GetOauth2Config().ClientId)
+		require.Equal(t, "test-secret", resp.Config.GetOauth2Config().ClientSecret)
+	})
+
+	t.Run("GetIdentityProvider not found", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		req := &v1pb.GetIdentityProviderRequest{
+			Name: "identityProviders/999",
+		}
+
+		_, err := ts.Service.GetIdentityProvider(ctx, req)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "not found")
+	})
+
+	t.Run("GetIdentityProvider invalid name", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		req := &v1pb.GetIdentityProviderRequest{
+			Name: "invalid-name",
+		}
+
+		_, err := ts.Service.GetIdentityProvider(ctx, req)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "invalid identity provider name")
+	})
+}
+
+func TestUpdateIdentityProvider(t *testing.T) {
+	ctx := context.Background()
+
+	t.Run("UpdateIdentityProvider success", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create host user
+		hostUser, err := ts.CreateHostUser(ctx, "admin")
+		require.NoError(t, err)
+
+		// Set user context
+		userCtx := ts.CreateUserContext(ctx, hostUser.ID)
+
+		// Create identity provider
+		createReq := &v1pb.CreateIdentityProviderRequest{
+			IdentityProvider: &v1pb.IdentityProvider{
+				Title:            "Original Provider",
+				IdentifierFilter: "",
+				Type:             v1pb.IdentityProvider_OAUTH2,
+				Config: &v1pb.IdentityProviderConfig{
+					Config: &v1pb.IdentityProviderConfig_Oauth2Config{
+						Oauth2Config: &v1pb.OAuth2Config{
+							ClientId:    "original-client",
+							AuthUrl:     "https://original.com/auth",
+							TokenUrl:    "https://original.com/token",
+							UserInfoUrl: "https://original.com/user",
+							FieldMapping: &v1pb.FieldMapping{
+								Identifier: "id",
+							},
+						},
+					},
+				},
+			},
+		}
+
+		created, err := ts.Service.CreateIdentityProvider(userCtx, createReq)
+		require.NoError(t, err)
+
+		// Update identity provider
+		updateReq := &v1pb.UpdateIdentityProviderRequest{
+			IdentityProvider: &v1pb.IdentityProvider{
+				Name:             created.Name,
+				Title:            "Updated Provider",
+				IdentifierFilter: "test@example.com",
+				Type:             v1pb.IdentityProvider_OAUTH2,
+				Config: &v1pb.IdentityProviderConfig{
+					Config: &v1pb.IdentityProviderConfig_Oauth2Config{
+						Oauth2Config: &v1pb.OAuth2Config{
+							ClientId:     "updated-client",
+							ClientSecret: "updated-secret",
+							AuthUrl:      "https://updated.com/auth",
+							TokenUrl:     "https://updated.com/token",
+							UserInfoUrl:  "https://updated.com/user",
+							Scopes:       []string{"openid", "profile", "email"},
+							FieldMapping: &v1pb.FieldMapping{
+								Identifier:  "sub",
+								DisplayName: "given_name",
+								Email:       "email",
+								AvatarUrl:   "picture",
+							},
+						},
+					},
+				},
+			},
+			UpdateMask: &fieldmaskpb.FieldMask{
+				Paths: []string{"title", "identifier_filter", "config"},
+			},
+		}
+
+		updated, err := ts.Service.UpdateIdentityProvider(userCtx, updateReq)
+		require.NoError(t, err)
+		require.NotNil(t, updated)
+		require.Equal(t, "Updated Provider", updated.Title)
+		require.Equal(t, "test@example.com", updated.IdentifierFilter)
+		require.Equal(t, "updated-client", updated.Config.GetOauth2Config().ClientId)
+	})
+
+	t.Run("UpdateIdentityProvider missing update mask", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		req := &v1pb.UpdateIdentityProviderRequest{
+			IdentityProvider: &v1pb.IdentityProvider{
+				Name:  "identityProviders/1",
+				Title: "Updated Provider",
+			},
+		}
+
+		_, err := ts.Service.UpdateIdentityProvider(ctx, req)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "update_mask is required")
+	})
+
+	t.Run("UpdateIdentityProvider invalid name", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		req := &v1pb.UpdateIdentityProviderRequest{
+			IdentityProvider: &v1pb.IdentityProvider{
+				Name:  "invalid-name",
+				Title: "Updated Provider",
+			},
+			UpdateMask: &fieldmaskpb.FieldMask{
+				Paths: []string{"title"},
+			},
+		}
+
+		_, err := ts.Service.UpdateIdentityProvider(ctx, req)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "invalid identity provider name")
+	})
+}
+
+func TestDeleteIdentityProvider(t *testing.T) {
+	ctx := context.Background()
+
+	t.Run("DeleteIdentityProvider success", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create host user
+		hostUser, err := ts.CreateHostUser(ctx, "admin")
+		require.NoError(t, err)
+
+		// Set user context
+		userCtx := ts.CreateUserContext(ctx, hostUser.ID)
+
+		// Create identity provider
+		createReq := &v1pb.CreateIdentityProviderRequest{
+			IdentityProvider: &v1pb.IdentityProvider{
+				Title: "Provider to Delete",
+				Type:  v1pb.IdentityProvider_OAUTH2,
+				Config: &v1pb.IdentityProviderConfig{
+					Config: &v1pb.IdentityProviderConfig_Oauth2Config{
+						Oauth2Config: &v1pb.OAuth2Config{
+							ClientId:    "client-to-delete",
+							AuthUrl:     "https://example.com/auth",
+							TokenUrl:    "https://example.com/token",
+							UserInfoUrl: "https://example.com/user",
+							FieldMapping: &v1pb.FieldMapping{
+								Identifier: "id",
+							},
+						},
+					},
+				},
+			},
+		}
+
+		created, err := ts.Service.CreateIdentityProvider(userCtx, createReq)
+		require.NoError(t, err)
+
+		// Delete identity provider
+		deleteReq := &v1pb.DeleteIdentityProviderRequest{
+			Name: created.Name,
+		}
+
+		_, err = ts.Service.DeleteIdentityProvider(userCtx, deleteReq)
+		require.NoError(t, err)
+
+		// Verify deletion
+		getReq := &v1pb.GetIdentityProviderRequest{
+			Name: created.Name,
+		}
+
+		_, err = ts.Service.GetIdentityProvider(ctx, getReq)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "not found")
+	})
+
+	t.Run("DeleteIdentityProvider invalid name", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		req := &v1pb.DeleteIdentityProviderRequest{
+			Name: "invalid-name",
+		}
+
+		_, err := ts.Service.DeleteIdentityProvider(ctx, req)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "invalid identity provider name")
+	})
+
+	t.Run("DeleteIdentityProvider not found", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create host user
+		hostUser, err := ts.CreateHostUser(ctx, "admin")
+		require.NoError(t, err)
+
+		// Set user context
+		userCtx := ts.CreateUserContext(ctx, hostUser.ID)
+
+		req := &v1pb.DeleteIdentityProviderRequest{
+			Name: "identityProviders/999",
+		}
+
+		_, err = ts.Service.DeleteIdentityProvider(userCtx, req)
+		require.Error(t, err)
+		// Note: Delete might succeed even if item doesn't exist, depending on store implementation
+	})
+}
+
+func TestIdentityProviderPermissions(t *testing.T) {
+	ctx := context.Background()
+
+	t.Run("Only host users can create identity providers", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create regular user
+		regularUser, err := ts.CreateRegularUser(ctx, "regularuser")
+		require.NoError(t, err)
+
+		// Set user context
+		userCtx := ts.CreateUserContext(ctx, regularUser.ID)
+
+		req := &v1pb.CreateIdentityProviderRequest{
+			IdentityProvider: &v1pb.IdentityProvider{
+				Title: "Test Provider",
+				Type:  v1pb.IdentityProvider_OAUTH2,
+			},
+		}
+
+		_, err = ts.Service.CreateIdentityProvider(userCtx, req)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "permission denied")
+	})
+
+	t.Run("Authentication required", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		req := &v1pb.CreateIdentityProviderRequest{
+			IdentityProvider: &v1pb.IdentityProvider{
+				Title: "Test Provider",
+				Type:  v1pb.IdentityProvider_OAUTH2,
+			},
+		}
+
+		_, err := ts.Service.CreateIdentityProvider(ctx, req)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "permission denied")
+	})
+}

server/router/api/v1/test/inbox_service_test.go

@@ -0,0 +1,559 @@
+package v1
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/fieldmaskpb"
+
+	v1pb "github.com/usememos/memos/proto/gen/api/v1"
+	storepb "github.com/usememos/memos/proto/gen/store"
+	"github.com/usememos/memos/store"
+)
+
+func TestListInboxes(t *testing.T) {
+	ctx := context.Background()
+
+	t.Run("ListInboxes success", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create a user
+		user, err := ts.CreateRegularUser(ctx, "testuser")
+		require.NoError(t, err)
+
+		// Set user context
+		userCtx := ts.CreateUserContext(ctx, user.ID)
+
+		// List inboxes (should be empty initially)
+		req := &v1pb.ListInboxesRequest{
+			Parent: fmt.Sprintf("users/%d", user.ID),
+		}
+
+		resp, err := ts.Service.ListInboxes(userCtx, req)
+		require.NoError(t, err)
+		require.NotNil(t, resp)
+		require.Empty(t, resp.Inboxes)
+		require.Equal(t, int32(0), resp.TotalSize)
+	})
+
+	t.Run("ListInboxes with pagination", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create a user
+		user, err := ts.CreateRegularUser(ctx, "testuser")
+		require.NoError(t, err)
+
+		// Create some inbox entries
+		const systemBotID int32 = 0
+		for i := 0; i < 3; i++ {
+			_, err := ts.Store.CreateInbox(ctx, &store.Inbox{
+				SenderID:   systemBotID,
+				ReceiverID: user.ID,
+				Status:     store.UNREAD,
+				Message: &storepb.InboxMessage{
+					Type: storepb.InboxMessage_MEMO_COMMENT,
+				},
+			})
+			require.NoError(t, err)
+		}
+
+		// Set user context
+		userCtx := ts.CreateUserContext(ctx, user.ID)
+
+		// List inboxes with page size limit
+		req := &v1pb.ListInboxesRequest{
+			Parent:   fmt.Sprintf("users/%d", user.ID),
+			PageSize: 2,
+		}
+
+		resp, err := ts.Service.ListInboxes(userCtx, req)
+		require.NoError(t, err)
+		require.NotNil(t, resp)
+		require.Equal(t, 2, len(resp.Inboxes))
+		require.NotEmpty(t, resp.NextPageToken)
+	})
+
+	t.Run("ListInboxes permission denied for different user", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create two users
+		user1, err := ts.CreateRegularUser(ctx, "user1")
+		require.NoError(t, err)
+		user2, err := ts.CreateRegularUser(ctx, "user2")
+		require.NoError(t, err)
+
+		// Set user1 context but try to list user2's inboxes
+		userCtx := ts.CreateUserContext(ctx, user1.ID)
+
+		req := &v1pb.ListInboxesRequest{
+			Parent: fmt.Sprintf("users/%d", user2.ID),
+		}
+
+		_, err = ts.Service.ListInboxes(userCtx, req)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "cannot access inboxes")
+	})
+
+	t.Run("ListInboxes host can access other users' inboxes", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create a host user and a regular user
+		hostUser, err := ts.CreateHostUser(ctx, "hostuser")
+		require.NoError(t, err)
+		regularUser, err := ts.CreateRegularUser(ctx, "regularuser")
+		require.NoError(t, err)
+
+		// Create an inbox for the regular user
+		const systemBotID int32 = 0
+		_, err = ts.Store.CreateInbox(ctx, &store.Inbox{
+			SenderID:   systemBotID,
+			ReceiverID: regularUser.ID,
+			Status:     store.UNREAD,
+			Message: &storepb.InboxMessage{
+				Type: storepb.InboxMessage_MEMO_COMMENT,
+			},
+		})
+		require.NoError(t, err)
+
+		// Set host user context and try to list regular user's inboxes
+		hostCtx := ts.CreateUserContext(ctx, hostUser.ID)
+
+		req := &v1pb.ListInboxesRequest{
+			Parent: fmt.Sprintf("users/%d", regularUser.ID),
+		}
+
+		resp, err := ts.Service.ListInboxes(hostCtx, req)
+		require.NoError(t, err)
+		require.NotNil(t, resp)
+		require.Equal(t, 1, len(resp.Inboxes))
+	})
+
+	t.Run("ListInboxes invalid parent format", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create a user
+		user, err := ts.CreateRegularUser(ctx, "testuser")
+		require.NoError(t, err)
+
+		// Set user context
+		userCtx := ts.CreateUserContext(ctx, user.ID)
+
+		req := &v1pb.ListInboxesRequest{
+			Parent: "invalid-parent-format",
+		}
+
+		_, err = ts.Service.ListInboxes(userCtx, req)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "invalid parent name")
+	})
+
+	t.Run("ListInboxes unauthenticated", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		req := &v1pb.ListInboxesRequest{
+			Parent: "users/1",
+		}
+
+		_, err := ts.Service.ListInboxes(ctx, req)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "user not authenticated")
+	})
+}
+
+func TestUpdateInbox(t *testing.T) {
+	ctx := context.Background()
+
+	t.Run("UpdateInbox success", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create a user
+		user, err := ts.CreateRegularUser(ctx, "testuser")
+		require.NoError(t, err)
+
+		// Create an inbox entry
+		const systemBotID int32 = 0
+		inbox, err := ts.Store.CreateInbox(ctx, &store.Inbox{
+			SenderID:   systemBotID,
+			ReceiverID: user.ID,
+			Status:     store.UNREAD,
+			Message: &storepb.InboxMessage{
+				Type: storepb.InboxMessage_MEMO_COMMENT,
+			},
+		})
+		require.NoError(t, err)
+
+		// Set user context
+		userCtx := ts.CreateUserContext(ctx, user.ID)
+
+		// Update inbox status
+		req := &v1pb.UpdateInboxRequest{
+			Inbox: &v1pb.Inbox{
+				Name:   fmt.Sprintf("inboxes/%d", inbox.ID),
+				Status: v1pb.Inbox_ARCHIVED,
+			},
+			UpdateMask: &fieldmaskpb.FieldMask{
+				Paths: []string{"status"},
+			},
+		}
+
+		resp, err := ts.Service.UpdateInbox(userCtx, req)
+		require.NoError(t, err)
+		require.NotNil(t, resp)
+		require.Equal(t, v1pb.Inbox_ARCHIVED, resp.Status)
+	})
+
+	t.Run("UpdateInbox permission denied for different user", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create two users
+		user1, err := ts.CreateRegularUser(ctx, "user1")
+		require.NoError(t, err)
+		user2, err := ts.CreateRegularUser(ctx, "user2")
+		require.NoError(t, err)
+
+		// Create an inbox entry for user2
+		const systemBotID int32 = 0
+		inbox, err := ts.Store.CreateInbox(ctx, &store.Inbox{
+			SenderID:   systemBotID,
+			ReceiverID: user2.ID,
+			Status:     store.UNREAD,
+			Message: &storepb.InboxMessage{
+				Type: storepb.InboxMessage_MEMO_COMMENT,
+			},
+		})
+		require.NoError(t, err)
+
+		// Set user1 context but try to update user2's inbox
+		userCtx := ts.CreateUserContext(ctx, user1.ID)
+
+		req := &v1pb.UpdateInboxRequest{
+			Inbox: &v1pb.Inbox{
+				Name:   fmt.Sprintf("inboxes/%d", inbox.ID),
+				Status: v1pb.Inbox_ARCHIVED,
+			},
+			UpdateMask: &fieldmaskpb.FieldMask{
+				Paths: []string{"status"},
+			},
+		}
+
+		_, err = ts.Service.UpdateInbox(userCtx, req)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "cannot update inbox")
+	})
+
+	t.Run("UpdateInbox missing update mask", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create a user
+		user, err := ts.CreateRegularUser(ctx, "testuser")
+		require.NoError(t, err)
+
+		// Set user context
+		userCtx := ts.CreateUserContext(ctx, user.ID)
+
+		req := &v1pb.UpdateInboxRequest{
+			Inbox: &v1pb.Inbox{
+				Name:   "inboxes/1",
+				Status: v1pb.Inbox_ARCHIVED,
+			},
+		}
+
+		_, err = ts.Service.UpdateInbox(userCtx, req)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "update mask is required")
+	})
+
+	t.Run("UpdateInbox invalid name format", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create a user
+		user, err := ts.CreateRegularUser(ctx, "testuser")
+		require.NoError(t, err)
+
+		// Set user context
+		userCtx := ts.CreateUserContext(ctx, user.ID)
+
+		req := &v1pb.UpdateInboxRequest{
+			Inbox: &v1pb.Inbox{
+				Name:   "invalid-inbox-name",
+				Status: v1pb.Inbox_ARCHIVED,
+			},
+			UpdateMask: &fieldmaskpb.FieldMask{
+				Paths: []string{"status"},
+			},
+		}
+
+		_, err = ts.Service.UpdateInbox(userCtx, req)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "invalid inbox name")
+	})
+
+	t.Run("UpdateInbox not found", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create a user
+		user, err := ts.CreateRegularUser(ctx, "testuser")
+		require.NoError(t, err)
+
+		// Set user context
+		userCtx := ts.CreateUserContext(ctx, user.ID)
+
+		req := &v1pb.UpdateInboxRequest{
+			Inbox: &v1pb.Inbox{
+				Name:   "inboxes/99999", // Non-existent inbox
+				Status: v1pb.Inbox_ARCHIVED,
+			},
+			UpdateMask: &fieldmaskpb.FieldMask{
+				Paths: []string{"status"},
+			},
+		}
+
+		_, err = ts.Service.UpdateInbox(userCtx, req)
+		require.Error(t, err)
+		st, ok := status.FromError(err)
+		require.True(t, ok)
+		require.Equal(t, codes.NotFound, st.Code())
+	})
+
+	t.Run("UpdateInbox unsupported field", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create a user
+		user, err := ts.CreateRegularUser(ctx, "testuser")
+		require.NoError(t, err)
+
+		// Create an inbox entry
+		const systemBotID int32 = 0
+		inbox, err := ts.Store.CreateInbox(ctx, &store.Inbox{
+			SenderID:   systemBotID,
+			ReceiverID: user.ID,
+			Status:     store.UNREAD,
+			Message: &storepb.InboxMessage{
+				Type: storepb.InboxMessage_MEMO_COMMENT,
+			},
+		})
+		require.NoError(t, err)
+
+		// Set user context
+		userCtx := ts.CreateUserContext(ctx, user.ID)
+
+		req := &v1pb.UpdateInboxRequest{
+			Inbox: &v1pb.Inbox{
+				Name:   fmt.Sprintf("inboxes/%d", inbox.ID),
+				Status: v1pb.Inbox_ARCHIVED,
+			},
+			UpdateMask: &fieldmaskpb.FieldMask{
+				Paths: []string{"unsupported_field"},
+			},
+		}
+
+		_, err = ts.Service.UpdateInbox(userCtx, req)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "unsupported field")
+	})
+}
+
+func TestDeleteInbox(t *testing.T) {
+	ctx := context.Background()
+
+	t.Run("DeleteInbox success", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create a user
+		user, err := ts.CreateRegularUser(ctx, "testuser")
+		require.NoError(t, err)
+
+		// Create an inbox entry
+		const systemBotID int32 = 0
+		inbox, err := ts.Store.CreateInbox(ctx, &store.Inbox{
+			SenderID:   systemBotID,
+			ReceiverID: user.ID,
+			Status:     store.UNREAD,
+			Message: &storepb.InboxMessage{
+				Type: storepb.InboxMessage_MEMO_COMMENT,
+			},
+		})
+		require.NoError(t, err)
+
+		// Set user context
+		userCtx := ts.CreateUserContext(ctx, user.ID)
+
+		// Delete inbox
+		req := &v1pb.DeleteInboxRequest{
+			Name: fmt.Sprintf("inboxes/%d", inbox.ID),
+		}
+
+		_, err = ts.Service.DeleteInbox(userCtx, req)
+		require.NoError(t, err)
+
+		// Verify inbox is deleted
+		inboxes, err := ts.Store.ListInboxes(ctx, &store.FindInbox{
+			ReceiverID: &user.ID,
+		})
+		require.NoError(t, err)
+		require.Equal(t, 0, len(inboxes))
+	})
+
+	t.Run("DeleteInbox permission denied for different user", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create two users
+		user1, err := ts.CreateRegularUser(ctx, "user1")
+		require.NoError(t, err)
+		user2, err := ts.CreateRegularUser(ctx, "user2")
+		require.NoError(t, err)
+
+		// Create an inbox entry for user2
+		const systemBotID int32 = 0
+		inbox, err := ts.Store.CreateInbox(ctx, &store.Inbox{
+			SenderID:   systemBotID,
+			ReceiverID: user2.ID,
+			Status:     store.UNREAD,
+			Message: &storepb.InboxMessage{
+				Type: storepb.InboxMessage_MEMO_COMMENT,
+			},
+		})
+		require.NoError(t, err)
+
+		// Set user1 context but try to delete user2's inbox
+		userCtx := ts.CreateUserContext(ctx, user1.ID)
+
+		req := &v1pb.DeleteInboxRequest{
+			Name: fmt.Sprintf("inboxes/%d", inbox.ID),
+		}
+
+		_, err = ts.Service.DeleteInbox(userCtx, req)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "cannot delete inbox")
+	})
+
+	t.Run("DeleteInbox invalid name format", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create a user
+		user, err := ts.CreateRegularUser(ctx, "testuser")
+		require.NoError(t, err)
+
+		// Set user context
+		userCtx := ts.CreateUserContext(ctx, user.ID)
+
+		req := &v1pb.DeleteInboxRequest{
+			Name: "invalid-inbox-name",
+		}
+
+		_, err = ts.Service.DeleteInbox(userCtx, req)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "invalid inbox name")
+	})
+
+	t.Run("DeleteInbox not found", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create a user
+		user, err := ts.CreateRegularUser(ctx, "testuser")
+		require.NoError(t, err)
+
+		// Set user context
+		userCtx := ts.CreateUserContext(ctx, user.ID)
+
+		req := &v1pb.DeleteInboxRequest{
+			Name: "inboxes/99999", // Non-existent inbox
+		}
+
+		_, err = ts.Service.DeleteInbox(userCtx, req)
+		require.Error(t, err)
+		st, ok := status.FromError(err)
+		require.True(t, ok)
+		require.Equal(t, codes.NotFound, st.Code())
+	})
+}
+
+func TestInboxCRUDComplete(t *testing.T) {
+	ctx := context.Background()
+
+	t.Run("Complete CRUD lifecycle", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create a user
+		user, err := ts.CreateRegularUser(ctx, "testuser")
+		require.NoError(t, err)
+
+		// Create an inbox entry directly in store
+		const systemBotID int32 = 0
+		inbox, err := ts.Store.CreateInbox(ctx, &store.Inbox{
+			SenderID:   systemBotID,
+			ReceiverID: user.ID,
+			Status:     store.UNREAD,
+			Message: &storepb.InboxMessage{
+				Type: storepb.InboxMessage_MEMO_COMMENT,
+			},
+		})
+		require.NoError(t, err)
+
+		// Set user context
+		userCtx := ts.CreateUserContext(ctx, user.ID)
+
+		// 1. List inboxes - should have 1
+		listReq := &v1pb.ListInboxesRequest{
+			Parent: fmt.Sprintf("users/%d", user.ID),
+		}
+		listResp, err := ts.Service.ListInboxes(userCtx, listReq)
+		require.NoError(t, err)
+		require.Equal(t, 1, len(listResp.Inboxes))
+		require.Equal(t, v1pb.Inbox_UNREAD, listResp.Inboxes[0].Status)
+
+		// 2. Update inbox status to ARCHIVED
+		updateReq := &v1pb.UpdateInboxRequest{
+			Inbox: &v1pb.Inbox{
+				Name:   fmt.Sprintf("inboxes/%d", inbox.ID),
+				Status: v1pb.Inbox_ARCHIVED,
+			},
+			UpdateMask: &fieldmaskpb.FieldMask{
+				Paths: []string{"status"},
+			},
+		}
+		updateResp, err := ts.Service.UpdateInbox(userCtx, updateReq)
+		require.NoError(t, err)
+		require.Equal(t, v1pb.Inbox_ARCHIVED, updateResp.Status)
+
+		// 3. List inboxes again - should still have 1 but ARCHIVED
+		listResp, err = ts.Service.ListInboxes(userCtx, listReq)
+		require.NoError(t, err)
+		require.Equal(t, 1, len(listResp.Inboxes))
+		require.Equal(t, v1pb.Inbox_ARCHIVED, listResp.Inboxes[0].Status)
+
+		// 4. Delete inbox
+		deleteReq := &v1pb.DeleteInboxRequest{
+			Name: fmt.Sprintf("inboxes/%d", inbox.ID),
+		}
+		_, err = ts.Service.DeleteInbox(userCtx, deleteReq)
+		require.NoError(t, err)
+
+		// 5. List inboxes - should be empty
+		listResp, err = ts.Service.ListInboxes(userCtx, listReq)
+		require.NoError(t, err)
+		require.Equal(t, 0, len(listResp.Inboxes))
+		require.Equal(t, int32(0), listResp.TotalSize)
+	})
+}

server/router/api/v1/test/shortcut_service_test.go

@@ -0,0 +1,819 @@
+package v1
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/types/known/fieldmaskpb"
+
+	v1pb "github.com/usememos/memos/proto/gen/api/v1"
+)
+
+func TestListShortcuts(t *testing.T) {
+	ctx := context.Background()
+
+	t.Run("ListShortcuts success", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create a user
+		user, err := ts.CreateRegularUser(ctx, "testuser")
+		require.NoError(t, err)
+
+		// Set user context
+		userCtx := ts.CreateUserContext(ctx, user.ID)
+
+		// List shortcuts (should be empty initially)
+		req := &v1pb.ListShortcutsRequest{
+			Parent: fmt.Sprintf("users/%d", user.ID),
+		}
+
+		resp, err := ts.Service.ListShortcuts(userCtx, req)
+		require.NoError(t, err)
+		require.NotNil(t, resp)
+		require.Empty(t, resp.Shortcuts)
+	})
+
+	t.Run("ListShortcuts permission denied for different user", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create two users
+		user1, err := ts.CreateRegularUser(ctx, "user1")
+		require.NoError(t, err)
+		user2, err := ts.CreateRegularUser(ctx, "user2")
+		require.NoError(t, err)
+
+		// Set user1 context but try to list user2's shortcuts
+		userCtx := ts.CreateUserContext(ctx, user1.ID)
+
+		req := &v1pb.ListShortcutsRequest{
+			Parent: fmt.Sprintf("users/%d", user2.ID),
+		}
+
+		_, err = ts.Service.ListShortcuts(userCtx, req)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "permission denied")
+	})
+
+	t.Run("ListShortcuts invalid parent format", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create user
+		user, err := ts.CreateRegularUser(ctx, "testuser")
+		require.NoError(t, err)
+
+		// Set user context
+		userCtx := ts.CreateUserContext(ctx, user.ID)
+
+		req := &v1pb.ListShortcutsRequest{
+			Parent: "invalid-parent-format",
+		}
+
+		_, err = ts.Service.ListShortcuts(userCtx, req)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "invalid user name")
+	})
+
+	t.Run("ListShortcuts unauthenticated", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		req := &v1pb.ListShortcutsRequest{
+			Parent: "users/1",
+		}
+
+		_, err := ts.Service.ListShortcuts(ctx, req)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "permission denied")
+	})
+}
+
+func TestGetShortcut(t *testing.T) {
+	ctx := context.Background()
+
+	t.Run("GetShortcut success", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create a user
+		user, err := ts.CreateRegularUser(ctx, "testuser")
+		require.NoError(t, err)
+
+		// Set user context
+		userCtx := ts.CreateUserContext(ctx, user.ID)
+
+		// First create a shortcut
+		createReq := &v1pb.CreateShortcutRequest{
+			Parent: fmt.Sprintf("users/%d", user.ID),
+			Shortcut: &v1pb.Shortcut{
+				Title:  "Test Shortcut",
+				Filter: "tag in [\"test\"]",
+			},
+		}
+
+		created, err := ts.Service.CreateShortcut(userCtx, createReq)
+		require.NoError(t, err)
+
+		// Now get the shortcut
+		getReq := &v1pb.GetShortcutRequest{
+			Name: created.Name,
+		}
+
+		resp, err := ts.Service.GetShortcut(userCtx, getReq)
+		require.NoError(t, err)
+		require.NotNil(t, resp)
+		require.Equal(t, created.Name, resp.Name)
+		require.Equal(t, "Test Shortcut", resp.Title)
+		require.Equal(t, "tag in [\"test\"]", resp.Filter)
+	})
+
+	t.Run("GetShortcut permission denied for different user", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create two users
+		user1, err := ts.CreateRegularUser(ctx, "user1")
+		require.NoError(t, err)
+		user2, err := ts.CreateRegularUser(ctx, "user2")
+		require.NoError(t, err)
+
+		// Create shortcut as user1
+		user1Ctx := ts.CreateUserContext(ctx, user1.ID)
+		createReq := &v1pb.CreateShortcutRequest{
+			Parent: fmt.Sprintf("users/%d", user1.ID),
+			Shortcut: &v1pb.Shortcut{
+				Title:  "User1 Shortcut",
+				Filter: "tag in [\"user1\"]",
+			},
+		}
+
+		created, err := ts.Service.CreateShortcut(user1Ctx, createReq)
+		require.NoError(t, err)
+
+		// Try to get shortcut as user2
+		user2Ctx := ts.CreateUserContext(ctx, user2.ID)
+		getReq := &v1pb.GetShortcutRequest{
+			Name: created.Name,
+		}
+
+		_, err = ts.Service.GetShortcut(user2Ctx, getReq)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "permission denied")
+	})
+
+	t.Run("GetShortcut invalid name format", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create user
+		user, err := ts.CreateRegularUser(ctx, "testuser")
+		require.NoError(t, err)
+
+		// Set user context
+		userCtx := ts.CreateUserContext(ctx, user.ID)
+
+		req := &v1pb.GetShortcutRequest{
+			Name: "invalid-shortcut-name",
+		}
+
+		_, err = ts.Service.GetShortcut(userCtx, req)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "invalid shortcut name")
+	})
+
+	t.Run("GetShortcut not found", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create user
+		user, err := ts.CreateRegularUser(ctx, "testuser")
+		require.NoError(t, err)
+
+		// Set user context
+		userCtx := ts.CreateUserContext(ctx, user.ID)
+
+		req := &v1pb.GetShortcutRequest{
+			Name: fmt.Sprintf("users/%d", user.ID) + "/shortcuts/nonexistent",
+		}
+
+		_, err = ts.Service.GetShortcut(userCtx, req)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "not found")
+	})
+}
+
+func TestCreateShortcut(t *testing.T) {
+	ctx := context.Background()
+
+	t.Run("CreateShortcut success", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create a user
+		user, err := ts.CreateRegularUser(ctx, "testuser")
+		require.NoError(t, err)
+
+		// Set user context
+		userCtx := ts.CreateUserContext(ctx, user.ID)
+
+		req := &v1pb.CreateShortcutRequest{
+			Parent: fmt.Sprintf("users/%d", user.ID),
+			Shortcut: &v1pb.Shortcut{
+				Title:  "My Shortcut",
+				Filter: "tag in [\"important\"]",
+			},
+		}
+
+		resp, err := ts.Service.CreateShortcut(userCtx, req)
+		require.NoError(t, err)
+		require.NotNil(t, resp)
+		require.Equal(t, "My Shortcut", resp.Title)
+		require.Equal(t, "tag in [\"important\"]", resp.Filter)
+		require.Contains(t, resp.Name, fmt.Sprintf("users/%d/shortcuts/", user.ID))
+
+		// Verify the shortcut was created by listing
+		listReq := &v1pb.ListShortcutsRequest{
+			Parent: fmt.Sprintf("users/%d", user.ID),
+		}
+
+		listResp, err := ts.Service.ListShortcuts(userCtx, listReq)
+		require.NoError(t, err)
+		require.Len(t, listResp.Shortcuts, 1)
+		require.Equal(t, "My Shortcut", listResp.Shortcuts[0].Title)
+	})
+
+	t.Run("CreateShortcut permission denied for different user", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create two users
+		user1, err := ts.CreateRegularUser(ctx, "user1")
+		require.NoError(t, err)
+		user2, err := ts.CreateRegularUser(ctx, "user2")
+		require.NoError(t, err)
+
+		// Set user1 context but try to create shortcut for user2
+		userCtx := ts.CreateUserContext(ctx, user1.ID)
+
+		req := &v1pb.CreateShortcutRequest{
+			Parent: fmt.Sprintf("users/%d", user2.ID),
+			Shortcut: &v1pb.Shortcut{
+				Title:  "Forbidden Shortcut",
+				Filter: "tag in [\"forbidden\"]",
+			},
+		}
+
+		_, err = ts.Service.CreateShortcut(userCtx, req)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "permission denied")
+	})
+
+	t.Run("CreateShortcut invalid parent format", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create user
+		user, err := ts.CreateRegularUser(ctx, "testuser")
+		require.NoError(t, err)
+
+		// Set user context
+		userCtx := ts.CreateUserContext(ctx, user.ID)
+
+		req := &v1pb.CreateShortcutRequest{
+			Parent: "invalid-parent",
+			Shortcut: &v1pb.Shortcut{
+				Title:  "Test Shortcut",
+				Filter: "tag in [\"test\"]",
+			},
+		}
+
+		_, err = ts.Service.CreateShortcut(userCtx, req)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "invalid user name")
+	})
+
+	t.Run("CreateShortcut invalid filter", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create user
+		user, err := ts.CreateRegularUser(ctx, "testuser")
+		require.NoError(t, err)
+
+		// Set user context
+		userCtx := ts.CreateUserContext(ctx, user.ID)
+
+		req := &v1pb.CreateShortcutRequest{
+			Parent: fmt.Sprintf("users/%d", user.ID),
+			Shortcut: &v1pb.Shortcut{
+				Title:  "Invalid Filter Shortcut",
+				Filter: "invalid||filter))syntax",
+			},
+		}
+
+		_, err = ts.Service.CreateShortcut(userCtx, req)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "invalid filter")
+	})
+
+	t.Run("CreateShortcut missing title", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create user
+		user, err := ts.CreateRegularUser(ctx, "testuser")
+		require.NoError(t, err)
+
+		// Set user context
+		userCtx := ts.CreateUserContext(ctx, user.ID)
+
+		req := &v1pb.CreateShortcutRequest{
+			Parent: fmt.Sprintf("users/%d", user.ID),
+			Shortcut: &v1pb.Shortcut{
+				Filter: "tag in [\"test\"]",
+			},
+		}
+
+		_, err = ts.Service.CreateShortcut(userCtx, req)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "title is required")
+	})
+}
+
+func TestUpdateShortcut(t *testing.T) {
+	ctx := context.Background()
+
+	t.Run("UpdateShortcut success", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create a user
+		user, err := ts.CreateRegularUser(ctx, "testuser")
+		require.NoError(t, err)
+
+		// Set user context
+		userCtx := ts.CreateUserContext(ctx, user.ID)
+
+		// Create a shortcut first
+		createReq := &v1pb.CreateShortcutRequest{
+			Parent: fmt.Sprintf("users/%d", user.ID),
+			Shortcut: &v1pb.Shortcut{
+				Title:  "Original Title",
+				Filter: "tag in [\"original\"]",
+			},
+		}
+
+		created, err := ts.Service.CreateShortcut(userCtx, createReq)
+		require.NoError(t, err)
+
+		// Update the shortcut
+		updateReq := &v1pb.UpdateShortcutRequest{
+			Shortcut: &v1pb.Shortcut{
+				Name:   created.Name,
+				Title:  "Updated Title",
+				Filter: "tag in [\"updated\"]",
+			},
+			UpdateMask: &fieldmaskpb.FieldMask{
+				Paths: []string{"title", "filter"},
+			},
+		}
+
+		updated, err := ts.Service.UpdateShortcut(userCtx, updateReq)
+		require.NoError(t, err)
+		require.NotNil(t, updated)
+		require.Equal(t, "Updated Title", updated.Title)
+		require.Equal(t, "tag in [\"updated\"]", updated.Filter)
+		require.Equal(t, created.Name, updated.Name)
+	})
+
+	t.Run("UpdateShortcut permission denied for different user", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create two users
+		user1, err := ts.CreateRegularUser(ctx, "user1")
+		require.NoError(t, err)
+		user2, err := ts.CreateRegularUser(ctx, "user2")
+		require.NoError(t, err)
+
+		// Create shortcut as user1
+		user1Ctx := ts.CreateUserContext(ctx, user1.ID)
+		createReq := &v1pb.CreateShortcutRequest{
+			Parent: fmt.Sprintf("users/%d", user1.ID),
+			Shortcut: &v1pb.Shortcut{
+				Title:  "User1 Shortcut",
+				Filter: "tag in [\"user1\"]",
+			},
+		}
+
+		created, err := ts.Service.CreateShortcut(user1Ctx, createReq)
+		require.NoError(t, err)
+
+		// Try to update shortcut as user2
+		user2Ctx := ts.CreateUserContext(ctx, user2.ID)
+		updateReq := &v1pb.UpdateShortcutRequest{
+			Shortcut: &v1pb.Shortcut{
+				Name:   created.Name,
+				Title:  "Hacked Title",
+				Filter: "tag in [\"hacked\"]",
+			},
+			UpdateMask: &fieldmaskpb.FieldMask{
+				Paths: []string{"title", "filter"},
+			},
+		}
+
+		_, err = ts.Service.UpdateShortcut(user2Ctx, updateReq)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "permission denied")
+	})
+
+	t.Run("UpdateShortcut missing update mask", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create a user and context for authentication
+		user, err := ts.CreateRegularUser(ctx, "testuser")
+		require.NoError(t, err)
+		userCtx := ts.CreateUserContext(ctx, user.ID)
+
+		req := &v1pb.UpdateShortcutRequest{
+			Shortcut: &v1pb.Shortcut{
+				Name:  fmt.Sprintf("users/%d/shortcuts/test", user.ID),
+				Title: "Updated Title",
+			},
+		}
+
+		_, err = ts.Service.UpdateShortcut(userCtx, req)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "update mask is required")
+	})
+
+	t.Run("UpdateShortcut invalid name format", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		req := &v1pb.UpdateShortcutRequest{
+			Shortcut: &v1pb.Shortcut{
+				Name:  "invalid-shortcut-name",
+				Title: "Updated Title",
+			},
+			UpdateMask: &fieldmaskpb.FieldMask{
+				Paths: []string{"title"},
+			},
+		}
+
+		_, err := ts.Service.UpdateShortcut(ctx, req)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "invalid shortcut name")
+	})
+
+	t.Run("UpdateShortcut invalid filter", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create user
+		user, err := ts.CreateRegularUser(ctx, "testuser")
+		require.NoError(t, err)
+
+		// Set user context
+		userCtx := ts.CreateUserContext(ctx, user.ID)
+
+		// Create a shortcut first
+		createReq := &v1pb.CreateShortcutRequest{
+			Parent: fmt.Sprintf("users/%d", user.ID),
+			Shortcut: &v1pb.Shortcut{
+				Title:  "Test Shortcut",
+				Filter: "tag in [\"test\"]",
+			},
+		}
+
+		created, err := ts.Service.CreateShortcut(userCtx, createReq)
+		require.NoError(t, err)
+
+		// Try to update with invalid filter
+		updateReq := &v1pb.UpdateShortcutRequest{
+			Shortcut: &v1pb.Shortcut{
+				Name:   created.Name,
+				Filter: "invalid||filter))syntax",
+			},
+			UpdateMask: &fieldmaskpb.FieldMask{
+				Paths: []string{"filter"},
+			},
+		}
+
+		_, err = ts.Service.UpdateShortcut(userCtx, updateReq)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "invalid filter")
+	})
+}
+
+func TestDeleteShortcut(t *testing.T) {
+	ctx := context.Background()
+
+	t.Run("DeleteShortcut success", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create a user
+		user, err := ts.CreateRegularUser(ctx, "testuser")
+		require.NoError(t, err)
+
+		// Set user context
+		userCtx := ts.CreateUserContext(ctx, user.ID)
+
+		// Create a shortcut first
+		createReq := &v1pb.CreateShortcutRequest{
+			Parent: fmt.Sprintf("users/%d", user.ID),
+			Shortcut: &v1pb.Shortcut{
+				Title:  "Shortcut to Delete",
+				Filter: "tag in [\"delete\"]",
+			},
+		}
+
+		created, err := ts.Service.CreateShortcut(userCtx, createReq)
+		require.NoError(t, err)
+
+		// Delete the shortcut
+		deleteReq := &v1pb.DeleteShortcutRequest{
+			Name: created.Name,
+		}
+
+		_, err = ts.Service.DeleteShortcut(userCtx, deleteReq)
+		require.NoError(t, err)
+
+		// Verify deletion by listing shortcuts
+		listReq := &v1pb.ListShortcutsRequest{
+			Parent: fmt.Sprintf("users/%d", user.ID),
+		}
+
+		listResp, err := ts.Service.ListShortcuts(userCtx, listReq)
+		require.NoError(t, err)
+		require.Empty(t, listResp.Shortcuts)
+
+		// Also verify by trying to get the deleted shortcut
+		getReq := &v1pb.GetShortcutRequest{
+			Name: created.Name,
+		}
+
+		_, err = ts.Service.GetShortcut(userCtx, getReq)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "not found")
+	})
+
+	t.Run("DeleteShortcut permission denied for different user", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create two users
+		user1, err := ts.CreateRegularUser(ctx, "user1")
+		require.NoError(t, err)
+		user2, err := ts.CreateRegularUser(ctx, "user2")
+		require.NoError(t, err)
+
+		// Create shortcut as user1
+		user1Ctx := ts.CreateUserContext(ctx, user1.ID)
+		createReq := &v1pb.CreateShortcutRequest{
+			Parent: fmt.Sprintf("users/%d", user1.ID),
+			Shortcut: &v1pb.Shortcut{
+				Title:  "User1 Shortcut",
+				Filter: "tag in [\"user1\"]",
+			},
+		}
+
+		created, err := ts.Service.CreateShortcut(user1Ctx, createReq)
+		require.NoError(t, err)
+
+		// Try to delete shortcut as user2
+		user2Ctx := ts.CreateUserContext(ctx, user2.ID)
+		deleteReq := &v1pb.DeleteShortcutRequest{
+			Name: created.Name,
+		}
+
+		_, err = ts.Service.DeleteShortcut(user2Ctx, deleteReq)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "permission denied")
+	})
+
+	t.Run("DeleteShortcut invalid name format", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		req := &v1pb.DeleteShortcutRequest{
+			Name: "invalid-shortcut-name",
+		}
+
+		_, err := ts.Service.DeleteShortcut(ctx, req)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "invalid shortcut name")
+	})
+
+	t.Run("DeleteShortcut not found", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create user
+		user, err := ts.CreateRegularUser(ctx, "testuser")
+		require.NoError(t, err)
+
+		// Set user context
+		userCtx := ts.CreateUserContext(ctx, user.ID)
+
+		req := &v1pb.DeleteShortcutRequest{
+			Name: fmt.Sprintf("users/%d", user.ID) + "/shortcuts/nonexistent",
+		}
+
+		_, err = ts.Service.DeleteShortcut(userCtx, req)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "not found")
+	})
+}
+
+func TestShortcutFiltering(t *testing.T) {
+	ctx := context.Background()
+
+	t.Run("CreateShortcut with valid filters", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create user
+		user, err := ts.CreateRegularUser(ctx, "testuser")
+		require.NoError(t, err)
+
+		// Set user context
+		userCtx := ts.CreateUserContext(ctx, user.ID)
+
+		// Test various valid filter formats
+		validFilters := []string{
+			"tag in [\"work\"]",
+			"content.contains(\"meeting\")",
+			"tag in [\"work\"] && content.contains(\"meeting\")",
+			"tag in [\"work\"] || tag in [\"personal\"]",
+			"creator_id == 1",
+			"visibility == \"PUBLIC\"",
+			"has_task_list == true",
+			"has_task_list == false",
+		}
+
+		for i, filter := range validFilters {
+			req := &v1pb.CreateShortcutRequest{
+				Parent: fmt.Sprintf("users/%d", user.ID),
+				Shortcut: &v1pb.Shortcut{
+					Title:  "Valid Filter " + string(rune(i)),
+					Filter: filter,
+				},
+			}
+
+			_, err = ts.Service.CreateShortcut(userCtx, req)
+			require.NoError(t, err, "Filter should be valid: %s", filter)
+		}
+	})
+
+	t.Run("CreateShortcut with invalid filters", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create user
+		user, err := ts.CreateRegularUser(ctx, "testuser")
+		require.NoError(t, err)
+
+		// Set user context
+		userCtx := ts.CreateUserContext(ctx, user.ID)
+
+		// Test various invalid filter formats
+		invalidFilters := []string{
+			"tag in ",                                   // incomplete expression
+			"invalid_field @in [\"value\"]",             // unknown field
+			"tag in [\"work\"] &&",                      // incomplete expression
+			"tag in [\"work\"] || || tag in [\"test\"]", // double operator
+			"((tag in [\"work\"]",                       // unmatched parentheses
+			"tag in [\"work\"] && )",                    // mismatched parentheses
+			"tag == \"work\"",                           // wrong operator (== not supported for tags)
+			"tag in work",                               // missing brackets
+		}
+
+		for _, filter := range invalidFilters {
+			req := &v1pb.CreateShortcutRequest{
+				Parent: fmt.Sprintf("users/%d", user.ID),
+				Shortcut: &v1pb.Shortcut{
+					Title:  "Invalid Filter Test",
+					Filter: filter,
+				},
+			}
+
+			_, err = ts.Service.CreateShortcut(userCtx, req)
+			require.Error(t, err, "Filter should be invalid: %s", filter)
+			require.Contains(t, err.Error(), "invalid filter", "Error should mention invalid filter for: %s", filter)
+		}
+	})
+}
+
+func TestShortcutCRUDComplete(t *testing.T) {
+	ctx := context.Background()
+
+	t.Run("Complete CRUD lifecycle", func(t *testing.T) {
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create user
+		user, err := ts.CreateRegularUser(ctx, "testuser")
+		require.NoError(t, err)
+
+		// Set user context
+		userCtx := ts.CreateUserContext(ctx, user.ID)
+
+		// 1. Create multiple shortcuts
+		shortcut1Req := &v1pb.CreateShortcutRequest{
+			Parent: fmt.Sprintf("users/%d", user.ID),
+			Shortcut: &v1pb.Shortcut{
+				Title:  "Work Notes",
+				Filter: "tag in [\"work\"]",
+			},
+		}
+
+		shortcut2Req := &v1pb.CreateShortcutRequest{
+			Parent: fmt.Sprintf("users/%d", user.ID),
+			Shortcut: &v1pb.Shortcut{
+				Title:  "Personal Notes",
+				Filter: "tag in [\"personal\"]",
+			},
+		}
+
+		created1, err := ts.Service.CreateShortcut(userCtx, shortcut1Req)
+		require.NoError(t, err)
+		require.Equal(t, "Work Notes", created1.Title)
+
+		created2, err := ts.Service.CreateShortcut(userCtx, shortcut2Req)
+		require.NoError(t, err)
+		require.Equal(t, "Personal Notes", created2.Title)
+
+		// 2. List shortcuts and verify both exist
+		listReq := &v1pb.ListShortcutsRequest{
+			Parent: fmt.Sprintf("users/%d", user.ID),
+		}
+
+		listResp, err := ts.Service.ListShortcuts(userCtx, listReq)
+		require.NoError(t, err)
+		require.Len(t, listResp.Shortcuts, 2)
+
+		// 3. Get individual shortcuts
+		getReq1 := &v1pb.GetShortcutRequest{Name: created1.Name}
+		getResp1, err := ts.Service.GetShortcut(userCtx, getReq1)
+		require.NoError(t, err)
+		require.Equal(t, created1.Name, getResp1.Name)
+		require.Equal(t, "Work Notes", getResp1.Title)
+
+		getReq2 := &v1pb.GetShortcutRequest{Name: created2.Name}
+		getResp2, err := ts.Service.GetShortcut(userCtx, getReq2)
+		require.NoError(t, err)
+		require.Equal(t, created2.Name, getResp2.Name)
+		require.Equal(t, "Personal Notes", getResp2.Title)
+
+		// 4. Update one shortcut
+		updateReq := &v1pb.UpdateShortcutRequest{
+			Shortcut: &v1pb.Shortcut{
+				Name:   created1.Name,
+				Title:  "Work & Meeting Notes",
+				Filter: "tag in [\"work\"] || tag in [\"meeting\"]",
+			},
+			UpdateMask: &fieldmaskpb.FieldMask{
+				Paths: []string{"title", "filter"},
+			},
+		}
+
+		updated, err := ts.Service.UpdateShortcut(userCtx, updateReq)
+		require.NoError(t, err)
+		require.Equal(t, "Work & Meeting Notes", updated.Title)
+		require.Equal(t, "tag in [\"work\"] || tag in [\"meeting\"]", updated.Filter)
+
+		// 5. Verify update by getting it again
+		getUpdatedReq := &v1pb.GetShortcutRequest{Name: created1.Name}
+		getUpdatedResp, err := ts.Service.GetShortcut(userCtx, getUpdatedReq)
+		require.NoError(t, err)
+		require.Equal(t, "Work & Meeting Notes", getUpdatedResp.Title)
+		require.Equal(t, "tag in [\"work\"] || tag in [\"meeting\"]", getUpdatedResp.Filter)
+
+		// 6. Delete one shortcut
+		deleteReq := &v1pb.DeleteShortcutRequest{
+			Name: created2.Name,
+		}
+
+		_, err = ts.Service.DeleteShortcut(userCtx, deleteReq)
+		require.NoError(t, err)
+
+		// 7. Verify deletion by listing (should only have 1 left)
+		finalListResp, err := ts.Service.ListShortcuts(userCtx, listReq)
+		require.NoError(t, err)
+		require.Len(t, finalListResp.Shortcuts, 1)
+		require.Equal(t, "Work & Meeting Notes", finalListResp.Shortcuts[0].Title)
+
+		// 8. Verify deleted shortcut can't be accessed
+		getDeletedReq := &v1pb.GetShortcutRequest{Name: created2.Name}
+		_, err = ts.Service.GetShortcut(userCtx, getDeletedReq)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "not found")
+	})
+}

server/router/api/v1/test/test_helper.go

@@ -0,0 +1,81 @@
+package v1
+
+import (
+	"context"
+	"testing"
+
+	"github.com/usememos/memos/internal/profile"
+	apiv1 "github.com/usememos/memos/server/router/api/v1"
+	"github.com/usememos/memos/store"
+	teststore "github.com/usememos/memos/store/test"
+)
+
+// TestService holds the test service setup for API v1 services.
+type TestService struct {
+	Service *apiv1.APIV1Service
+	Store   *store.Store
+	Profile *profile.Profile
+	Secret  string
+}
+
+// NewTestService creates a new test service with SQLite database.
+func NewTestService(t *testing.T) *TestService {
+	ctx := context.Background()
+
+	// Create a test store with SQLite
+	testStore := teststore.NewTestingStore(ctx, t)
+
+	// Create a test profile
+	testProfile := &profile.Profile{
+		Mode:        "dev",
+		Version:     "test-1.0.0",
+		InstanceURL: "http://localhost:8080",
+		Driver:      "sqlite",
+		DSN:         ":memory:",
+	}
+
+	// Create APIV1Service with nil grpcServer since we're testing direct calls
+	secret := "test-secret"
+	service := &apiv1.APIV1Service{
+		Secret:  secret,
+		Profile: testProfile,
+		Store:   testStore,
+	}
+
+	return &TestService{
+		Service: service,
+		Store:   testStore,
+		Profile: testProfile,
+		Secret:  secret,
+	}
+}
+
+// Cleanup clears caches and closes resources after test.
+func (ts *TestService) Cleanup() {
+	ts.Store.Close()
+	// Note: Owner cache is package-level in parent package, cannot clear from test package
+}
+
+// CreateHostUser creates a host user for testing.
+func (ts *TestService) CreateHostUser(ctx context.Context, username string) (*store.User, error) {
+	return ts.Store.CreateUser(ctx, &store.User{
+		Username: username,
+		Role:     store.RoleHost,
+		Email:    username + "@example.com",
+	})
+}
+
+// CreateRegularUser creates a regular user for testing.
+func (ts *TestService) CreateRegularUser(ctx context.Context, username string) (*store.User, error) {
+	return ts.Store.CreateUser(ctx, &store.User{
+		Username: username,
+		Role:     store.RoleUser,
+		Email:    username + "@example.com",
+	})
+}
+
+// CreateUserContext creates a context with the given user's ID for authentication.
+func (*TestService) CreateUserContext(ctx context.Context, userID int32) context.Context {
+	// Use the real context key from the parent package
+	return apiv1.CreateTestUserContext(ctx, userID)
+}

server/router/api/v1/test/user_service_stats_test.go

@@ -0,0 +1,105 @@
+package v1
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	v1pb "github.com/usememos/memos/proto/gen/api/v1"
+	storepb "github.com/usememos/memos/proto/gen/store"
+	"github.com/usememos/memos/store"
+)
+
+func TestGetUserStats_TagCount(t *testing.T) {
+	ctx := context.Background()
+
+	// Create test service
+	ts := NewTestService(t)
+	defer ts.Cleanup()
+
+	// Create a test host user
+	user, err := ts.CreateHostUser(ctx, "test_user")
+	require.NoError(t, err)
+
+	// Create user context for authentication
+	userCtx := ts.CreateUserContext(ctx, user.ID)
+
+	// Create a memo with a single tag
+	memo, err := ts.Store.CreateMemo(ctx, &store.Memo{
+		UID:        "test-memo-1",
+		CreatorID:  user.ID,
+		Content:    "This is a test memo with #test tag",
+		Visibility: store.Public,
+		Payload: &storepb.MemoPayload{
+			Tags: []string{"test"},
+		},
+	})
+	require.NoError(t, err)
+	require.NotNil(t, memo)
+
+	// Test GetUserStats
+	userName := fmt.Sprintf("users/%d", user.ID)
+	response, err := ts.Service.GetUserStats(userCtx, &v1pb.GetUserStatsRequest{
+		Name: userName,
+	})
+	require.NoError(t, err)
+	require.NotNil(t, response)
+
+	// Check that the tag count is exactly 1, not 2
+	require.Contains(t, response.TagCount, "test")
+	require.Equal(t, int32(1), response.TagCount["test"], "Tag count should be 1 for a single occurrence")
+
+	// Create another memo with the same tag
+	memo2, err := ts.Store.CreateMemo(ctx, &store.Memo{
+		UID:        "test-memo-2",
+		CreatorID:  user.ID,
+		Content:    "Another memo with #test tag",
+		Visibility: store.Public,
+		Payload: &storepb.MemoPayload{
+			Tags: []string{"test"},
+		},
+	})
+	require.NoError(t, err)
+	require.NotNil(t, memo2)
+
+	// Test GetUserStats again
+	response2, err := ts.Service.GetUserStats(userCtx, &v1pb.GetUserStatsRequest{
+		Name: userName,
+	})
+	require.NoError(t, err)
+	require.NotNil(t, response2)
+
+	// Check that the tag count is exactly 2, not 3
+	require.Contains(t, response2.TagCount, "test")
+	require.Equal(t, int32(2), response2.TagCount["test"], "Tag count should be 2 for two occurrences")
+
+	// Test with a new unique tag
+	memo3, err := ts.Store.CreateMemo(ctx, &store.Memo{
+		UID:        "test-memo-3",
+		CreatorID:  user.ID,
+		Content:    "Memo with #unique tag",
+		Visibility: store.Public,
+		Payload: &storepb.MemoPayload{
+			Tags: []string{"unique"},
+		},
+	})
+	require.NoError(t, err)
+	require.NotNil(t, memo3)
+
+	// Test GetUserStats for the new tag
+	response3, err := ts.Service.GetUserStats(userCtx, &v1pb.GetUserStatsRequest{
+		Name: userName,
+	})
+	require.NoError(t, err)
+	require.NotNil(t, response3)
+
+	// Check that the unique tag count is exactly 1
+	require.Contains(t, response3.TagCount, "unique")
+	require.Equal(t, int32(1), response3.TagCount["unique"], "New tag count should be 1 for first occurrence")
+
+	// The original test tag should still be 2
+	require.Contains(t, response3.TagCount, "test")
+	require.Equal(t, int32(2), response3.TagCount["test"], "Original tag count should remain 2")
+}

server/router/api/v1/test/webhook_service_test.go

@@ -0,0 +1,406 @@
+package v1
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/types/known/fieldmaskpb"
+
+	v1pb "github.com/usememos/memos/proto/gen/api/v1"
+)
+
+func TestCreateWebhook(t *testing.T) {
+	ctx := context.Background()
+	t.Run("CreateWebhook with host user", func(t *testing.T) {
+		// Create test service for this specific test
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create and authenticate as host user
+		hostUser, err := ts.CreateHostUser(ctx, "admin")
+		require.NoError(t, err)
+
+		userCtx := ts.CreateUserContext(ctx, hostUser.ID)
+
+		// Create a webhook
+		req := &v1pb.CreateWebhookRequest{
+			Parent: fmt.Sprintf("users/%d", hostUser.ID),
+			Webhook: &v1pb.Webhook{
+				DisplayName: "Test Webhook",
+				Url:         "https://example.com/webhook",
+			},
+		}
+
+		resp, err := ts.Service.CreateWebhook(userCtx, req)
+
+		// Verify response
+		require.NoError(t, err)
+		require.NotNil(t, resp)
+		require.Equal(t, "Test Webhook", resp.DisplayName)
+		require.Equal(t, "https://example.com/webhook", resp.Url)
+		require.Contains(t, resp.Name, "webhooks/")
+		require.Contains(t, resp.Name, fmt.Sprintf("users/%d", hostUser.ID))
+	})
+
+	t.Run("CreateWebhook fails without authentication", func(t *testing.T) {
+		// Create test service for this specific test
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+		// Try to create webhook without authentication
+		req := &v1pb.CreateWebhookRequest{
+			Parent: "users/1", // Dummy parent since we don't have a real user
+			Webhook: &v1pb.Webhook{
+				DisplayName: "Test Webhook",
+				Url:         "https://example.com/webhook",
+			},
+		}
+
+		_, err := ts.Service.CreateWebhook(ctx, req)
+
+		// Should fail with permission denied or unauthenticated
+		require.Error(t, err)
+	})
+
+	t.Run("CreateWebhook fails with regular user", func(t *testing.T) {
+		// Create test service for this specific test
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create and authenticate as regular user
+		regularUser, err := ts.CreateRegularUser(ctx, "user1")
+		require.NoError(t, err)
+
+		userCtx := ts.CreateUserContext(ctx, regularUser.ID)
+		// Try to create webhook as regular user
+		req := &v1pb.CreateWebhookRequest{
+			Parent: fmt.Sprintf("users/%d", regularUser.ID),
+			Webhook: &v1pb.Webhook{
+				DisplayName: "Test Webhook",
+				Url:         "https://example.com/webhook",
+			},
+		}
+
+		_, err = ts.Service.CreateWebhook(userCtx, req)
+
+		// Should fail with permission denied
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "permission denied")
+	})
+
+	t.Run("CreateWebhook validates required fields", func(t *testing.T) {
+		// Create test service for this specific test
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create and authenticate as host user
+		hostUser, err := ts.CreateHostUser(ctx, "admin")
+		require.NoError(t, err)
+
+		userCtx := ts.CreateUserContext(ctx, hostUser.ID)
+		// Try to create webhook with missing URL
+		req := &v1pb.CreateWebhookRequest{
+			Parent: fmt.Sprintf("users/%d", hostUser.ID),
+			Webhook: &v1pb.Webhook{
+				DisplayName: "Test Webhook",
+				// URL missing
+			},
+		}
+
+		_, err = ts.Service.CreateWebhook(userCtx, req)
+
+		// Should fail with validation error
+		require.Error(t, err)
+	})
+}
+
+func TestListWebhooks(t *testing.T) {
+	ctx := context.Background()
+
+	t.Run("ListWebhooks returns empty list initially", func(t *testing.T) {
+		// Create test service for this specific test
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create host user for authentication
+		hostUser, err := ts.CreateHostUser(ctx, "admin")
+		require.NoError(t, err)
+
+		userCtx := ts.CreateUserContext(ctx, hostUser.ID)
+		// List webhooks
+		req := &v1pb.ListWebhooksRequest{
+			Parent: fmt.Sprintf("users/%d", hostUser.ID),
+		}
+		resp, err := ts.Service.ListWebhooks(userCtx, req)
+
+		// Verify response
+		require.NoError(t, err)
+		require.NotNil(t, resp)
+		require.Empty(t, resp.Webhooks)
+	})
+
+	t.Run("ListWebhooks returns created webhooks", func(t *testing.T) {
+		// Create test service for this specific test
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create host user and authenticate
+		hostUser, err := ts.CreateHostUser(ctx, "admin")
+		require.NoError(t, err)
+		userCtx := ts.CreateUserContext(ctx, hostUser.ID)
+		// Create a webhook
+		createReq := &v1pb.CreateWebhookRequest{
+			Parent: fmt.Sprintf("users/%d", hostUser.ID),
+			Webhook: &v1pb.Webhook{
+				DisplayName: "Test Webhook",
+				Url:         "https://example.com/webhook",
+			},
+		}
+		createdWebhook, err := ts.Service.CreateWebhook(userCtx, createReq)
+		require.NoError(t, err)
+
+		// List webhooks
+		listReq := &v1pb.ListWebhooksRequest{
+			Parent: fmt.Sprintf("users/%d", hostUser.ID),
+		}
+		resp, err := ts.Service.ListWebhooks(userCtx, listReq)
+
+		// Verify response
+		require.NoError(t, err)
+		require.NotNil(t, resp)
+		require.Len(t, resp.Webhooks, 1)
+		require.Equal(t, createdWebhook.Name, resp.Webhooks[0].Name)
+		require.Equal(t, createdWebhook.Url, resp.Webhooks[0].Url)
+	})
+
+	t.Run("ListWebhooks fails without authentication", func(t *testing.T) {
+		// Create test service for this specific test
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+		// Try to list webhooks without authentication
+		req := &v1pb.ListWebhooksRequest{
+			Parent: "users/1", // Dummy parent since we don't have a real user
+		}
+		_, err := ts.Service.ListWebhooks(ctx, req)
+
+		// Should fail with permission denied or unauthenticated
+		require.Error(t, err)
+	})
+}
+
+func TestGetWebhook(t *testing.T) {
+	ctx := context.Background()
+
+	t.Run("GetWebhook returns webhook by name", func(t *testing.T) {
+		// Create test service for this specific test
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create host user and authenticate
+		hostUser, err := ts.CreateHostUser(ctx, "admin")
+		require.NoError(t, err)
+		userCtx := ts.CreateUserContext(ctx, hostUser.ID)
+		// Create a webhook
+		createReq := &v1pb.CreateWebhookRequest{
+			Parent: fmt.Sprintf("users/%d", hostUser.ID),
+			Webhook: &v1pb.Webhook{
+				DisplayName: "Test Webhook",
+				Url:         "https://example.com/webhook",
+			},
+		}
+		createdWebhook, err := ts.Service.CreateWebhook(userCtx, createReq)
+		require.NoError(t, err)
+
+		// Get the webhook
+		getReq := &v1pb.GetWebhookRequest{
+			Name: createdWebhook.Name,
+		}
+		resp, err := ts.Service.GetWebhook(userCtx, getReq)
+		// Verify response
+		require.NoError(t, err)
+		require.NotNil(t, resp)
+		require.Equal(t, createdWebhook.Name, resp.Name)
+		require.Equal(t, createdWebhook.Url, resp.Url)
+	})
+
+	t.Run("GetWebhook fails with invalid name", func(t *testing.T) {
+		// Create test service for this specific test
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create host user and authenticate
+		hostUser, err := ts.CreateHostUser(ctx, "admin")
+		require.NoError(t, err)
+		userCtx := ts.CreateUserContext(ctx, hostUser.ID)
+
+		// Try to get webhook with invalid name
+		req := &v1pb.GetWebhookRequest{
+			Name: "invalid/webhook/name",
+		}
+		_, err = ts.Service.GetWebhook(userCtx, req)
+
+		// Should return an error
+		require.Error(t, err)
+	})
+
+	t.Run("GetWebhook fails with non-existent webhook", func(t *testing.T) {
+		// Create test service for this specific test
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create host user and authenticate
+		hostUser, err := ts.CreateHostUser(ctx, "admin")
+		require.NoError(t, err)
+		userCtx := ts.CreateUserContext(ctx, hostUser.ID)
+		// Try to get non-existent webhook
+		req := &v1pb.GetWebhookRequest{
+			Name: fmt.Sprintf("users/%d/webhooks/999", hostUser.ID),
+		}
+		_, err = ts.Service.GetWebhook(userCtx, req)
+
+		// Should return not found error
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "not found")
+	})
+}
+
+func TestUpdateWebhook(t *testing.T) {
+	ctx := context.Background()
+
+	t.Run("UpdateWebhook updates webhook properties", func(t *testing.T) {
+		// Create test service for this specific test
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create host user and authenticate
+		hostUser, err := ts.CreateHostUser(ctx, "admin")
+		require.NoError(t, err)
+		userCtx := ts.CreateUserContext(ctx, hostUser.ID)
+		// Create a webhook
+		createReq := &v1pb.CreateWebhookRequest{
+			Parent: fmt.Sprintf("users/%d", hostUser.ID),
+			Webhook: &v1pb.Webhook{
+				DisplayName: "Original Webhook",
+				Url:         "https://example.com/webhook",
+			},
+		}
+		createdWebhook, err := ts.Service.CreateWebhook(userCtx, createReq)
+		require.NoError(t, err)
+
+		// Update the webhook
+		updateReq := &v1pb.UpdateWebhookRequest{
+			Webhook: &v1pb.Webhook{
+				Name: createdWebhook.Name,
+				Url:  "https://updated.example.com/webhook",
+			},
+			UpdateMask: &fieldmaskpb.FieldMask{
+				Paths: []string{"url"},
+			},
+		}
+		resp, err := ts.Service.UpdateWebhook(userCtx, updateReq)
+
+		// Verify response
+		require.NoError(t, err)
+		require.NotNil(t, resp)
+		require.Equal(t, createdWebhook.Name, resp.Name)
+		require.Equal(t, "https://updated.example.com/webhook", resp.Url)
+	})
+
+	t.Run("UpdateWebhook fails without authentication", func(t *testing.T) {
+		// Create test service for this specific test
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+		// Try to update webhook without authentication
+		req := &v1pb.UpdateWebhookRequest{
+			Webhook: &v1pb.Webhook{
+				Name: "users/1/webhooks/1",
+				Url:  "https://updated.example.com/webhook",
+			},
+		}
+
+		_, err := ts.Service.UpdateWebhook(ctx, req)
+
+		// Should fail with permission denied or unauthenticated
+		require.Error(t, err)
+	})
+}
+
+func TestDeleteWebhook(t *testing.T) {
+	ctx := context.Background()
+	t.Run("DeleteWebhook removes webhook", func(t *testing.T) {
+		// Create test service for this specific test
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create host user and authenticate
+		hostUser, err := ts.CreateHostUser(ctx, "admin")
+		require.NoError(t, err)
+		userCtx := ts.CreateUserContext(ctx, hostUser.ID)
+
+		// Create a webhook
+		createReq := &v1pb.CreateWebhookRequest{
+			Parent: fmt.Sprintf("users/%d", hostUser.ID),
+			Webhook: &v1pb.Webhook{
+				DisplayName: "Test Webhook",
+				Url:         "https://example.com/webhook",
+			},
+		}
+		createdWebhook, err := ts.Service.CreateWebhook(userCtx, createReq)
+		require.NoError(t, err)
+
+		// Delete the webhook
+		deleteReq := &v1pb.DeleteWebhookRequest{
+			Name: createdWebhook.Name,
+		}
+		_, err = ts.Service.DeleteWebhook(userCtx, deleteReq)
+
+		// Verify deletion
+		require.NoError(t, err)
+
+		// Try to get the deleted webhook
+		getReq := &v1pb.GetWebhookRequest{
+			Name: createdWebhook.Name,
+		}
+		_, err = ts.Service.GetWebhook(userCtx, getReq)
+
+		// Should return not found error
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "not found")
+	})
+
+	t.Run("DeleteWebhook fails without authentication", func(t *testing.T) {
+		// Create test service for this specific test
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+		// Try to delete webhook without authentication
+		req := &v1pb.DeleteWebhookRequest{
+			Name: "users/1/webhooks/1",
+		}
+
+		_, err := ts.Service.DeleteWebhook(ctx, req)
+
+		// Should fail with permission denied or unauthenticated
+		require.Error(t, err)
+	})
+
+	t.Run("DeleteWebhook fails with non-existent webhook", func(t *testing.T) {
+		// Create test service for this specific test
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create host user and authenticate
+		hostUser, err := ts.CreateHostUser(ctx, "admin")
+		require.NoError(t, err)
+		userCtx := ts.CreateUserContext(ctx, hostUser.ID)
+		// Try to delete non-existent webhook
+		req := &v1pb.DeleteWebhookRequest{
+			Name: fmt.Sprintf("users/%d/webhooks/999", hostUser.ID),
+		}
+		_, err = ts.Service.DeleteWebhook(userCtx, req)
+
+		// Should return not found error
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "not found")
+	})
+}

server/router/api/v1/test/workspace_service_test.go

@@ -0,0 +1,206 @@
+package v1
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	v1pb "github.com/usememos/memos/proto/gen/api/v1"
+)
+
+func TestGetWorkspaceProfile(t *testing.T) {
+	ctx := context.Background()
+
+	t.Run("GetWorkspaceProfile returns workspace profile", func(t *testing.T) {
+		// Create test service for this specific test
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Call GetWorkspaceProfile directly
+		req := &v1pb.GetWorkspaceProfileRequest{}
+		resp, err := ts.Service.GetWorkspaceProfile(ctx, req)
+
+		// Verify response
+		require.NoError(t, err)
+		require.NotNil(t, resp)
+
+		// Verify the response contains expected data
+		require.Equal(t, "test-1.0.0", resp.Version)
+		require.Equal(t, "dev", resp.Mode)
+		require.Equal(t, "http://localhost:8080", resp.InstanceUrl)
+
+		// Owner should be empty since no users are created
+		require.Empty(t, resp.Owner)
+	})
+
+	t.Run("GetWorkspaceProfile with owner", func(t *testing.T) {
+		// Create test service for this specific test
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create a host user in the store
+		hostUser, err := ts.CreateHostUser(ctx, "admin")
+		require.NoError(t, err)
+		require.NotNil(t, hostUser)
+
+		// Call GetWorkspaceProfile directly
+		req := &v1pb.GetWorkspaceProfileRequest{}
+		resp, err := ts.Service.GetWorkspaceProfile(ctx, req)
+
+		// Verify response
+		require.NoError(t, err)
+		require.NotNil(t, resp)
+
+		// Verify the response contains expected data including owner
+		require.Equal(t, "test-1.0.0", resp.Version)
+		require.Equal(t, "dev", resp.Mode)
+		require.Equal(t, "http://localhost:8080", resp.InstanceUrl)
+
+		// User name should be "users/{id}" format where id is the user's ID
+		expectedOwnerName := fmt.Sprintf("users/%d", hostUser.ID)
+		require.Equal(t, expectedOwnerName, resp.Owner)
+	})
+}
+
+func TestGetWorkspaceProfile_Concurrency(t *testing.T) {
+	ctx := context.Background()
+
+	t.Run("Concurrent access to service", func(t *testing.T) {
+		// Create test service for this specific test
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create a host user
+		hostUser, err := ts.CreateHostUser(ctx, "admin")
+		require.NoError(t, err)
+		expectedOwnerName := fmt.Sprintf("users/%d", hostUser.ID)
+
+		// Make concurrent requests
+		numGoroutines := 10
+		results := make(chan *v1pb.WorkspaceProfile, numGoroutines)
+		errors := make(chan error, numGoroutines)
+
+		for i := 0; i < numGoroutines; i++ {
+			go func() {
+				req := &v1pb.GetWorkspaceProfileRequest{}
+				resp, err := ts.Service.GetWorkspaceProfile(ctx, req)
+				if err != nil {
+					errors <- err
+					return
+				}
+				results <- resp
+			}()
+		}
+
+		// Collect all results
+		for i := 0; i < numGoroutines; i++ {
+			select {
+			case err := <-errors:
+				t.Fatalf("Goroutine returned error: %v", err)
+			case resp := <-results:
+				require.NotNil(t, resp)
+				require.Equal(t, "test-1.0.0", resp.Version)
+				require.Equal(t, "dev", resp.Mode)
+				require.Equal(t, "http://localhost:8080", resp.InstanceUrl)
+				require.Equal(t, expectedOwnerName, resp.Owner)
+			}
+		}
+	})
+}
+
+func TestGetWorkspaceSetting(t *testing.T) {
+	ctx := context.Background()
+
+	t.Run("GetWorkspaceSetting - general setting", func(t *testing.T) {
+		// Create test service for this specific test
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Call GetWorkspaceSetting for general setting
+		req := &v1pb.GetWorkspaceSettingRequest{
+			Name: "workspace/settings/GENERAL",
+		}
+		resp, err := ts.Service.GetWorkspaceSetting(ctx, req)
+
+		// Verify response
+		require.NoError(t, err)
+		require.NotNil(t, resp)
+		require.Equal(t, "workspace/settings/GENERAL", resp.Name)
+
+		// The general setting should have a general_setting field
+		generalSetting := resp.GetGeneralSetting()
+		require.NotNil(t, generalSetting)
+
+		// General setting should have default values
+		require.False(t, generalSetting.DisallowUserRegistration)
+		require.False(t, generalSetting.DisallowPasswordAuth)
+		require.Empty(t, generalSetting.AdditionalScript)
+	})
+
+	t.Run("GetWorkspaceSetting - storage setting", func(t *testing.T) {
+		// Create test service for this specific test
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Create a host user for storage setting access
+		hostUser, err := ts.CreateHostUser(ctx, "testhost")
+		require.NoError(t, err)
+
+		// Add user to context
+		userCtx := ts.CreateUserContext(ctx, hostUser.ID)
+
+		// Call GetWorkspaceSetting for storage setting
+		req := &v1pb.GetWorkspaceSettingRequest{
+			Name: "workspace/settings/STORAGE",
+		}
+		resp, err := ts.Service.GetWorkspaceSetting(userCtx, req)
+
+		// Verify response
+		require.NoError(t, err)
+		require.NotNil(t, resp)
+		require.Equal(t, "workspace/settings/STORAGE", resp.Name)
+
+		// The storage setting should have a storage_setting field
+		storageSetting := resp.GetStorageSetting()
+		require.NotNil(t, storageSetting)
+	})
+
+	t.Run("GetWorkspaceSetting - memo related setting", func(t *testing.T) {
+		// Create test service for this specific test
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Call GetWorkspaceSetting for memo related setting
+		req := &v1pb.GetWorkspaceSettingRequest{
+			Name: "workspace/settings/MEMO_RELATED",
+		}
+		resp, err := ts.Service.GetWorkspaceSetting(ctx, req)
+
+		// Verify response
+		require.NoError(t, err)
+		require.NotNil(t, resp)
+		require.Equal(t, "workspace/settings/MEMO_RELATED", resp.Name)
+
+		// The memo related setting should have a memo_related_setting field
+		memoRelatedSetting := resp.GetMemoRelatedSetting()
+		require.NotNil(t, memoRelatedSetting)
+	})
+
+	t.Run("GetWorkspaceSetting - invalid setting name", func(t *testing.T) {
+		// Create test service for this specific test
+		ts := NewTestService(t)
+		defer ts.Cleanup()
+
+		// Call GetWorkspaceSetting with invalid name
+		req := &v1pb.GetWorkspaceSettingRequest{
+			Name: "invalid/setting/name",
+		}
+		_, err := ts.Service.GetWorkspaceSetting(ctx, req)
+
+		// Should return an error
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "invalid workspace setting name")
+	})
+}