test: cover chat moderation and the embed endpoints

- CanModerateMessage: group conversations only, chat members only
- parseEmbedRefs, embedKey, escapeLike
- /chat/embeds and /chat/embeds/resolve: 401, 422 before the
  database, 503 without one

controllers/api/handlers_test.go

@@ -60,6 +60,37 @@ func handlers(h *api.Handlers) map[string]http.HandlerFunc {
 	}
 }
 
+// bodyRequest is a handler that validates its query or body before the
+// database, with a request that passes that validation.
+type bodyRequest struct {
+	fn     http.HandlerFunc
+	method string
+	target string
+	body   string
+}
+
+func bodyHandlers(h *api.Handlers) map[string]bodyRequest {
+	return map[string]bodyRequest{
+		"chat-embeds":  {h.ChatEmbeds, http.MethodGet, "/?type=deadline&q=esej", ""},
+		"chat-resolve": {h.ResolveChatEmbeds, http.MethodPost, "/", `{"refs":[{"type":"reading","id":1}]}`},
+	}
+}
+
+func serveBody(t *testing.T, b bodyRequest, user *bouncer.Principal) (int, map[string]any) {
+	t.Helper()
+	req := httptest.NewRequest(b.method, b.target, strings.NewReader(b.body))
+	if user != nil {
+		req = req.WithContext(bouncer.WithUser(req.Context(), user))
+	}
+	rec := httptest.NewRecorder()
+	b.fn(rec, req)
+	var body map[string]any
+	if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
+		t.Fatalf("%s %s: body is not JSON: %v\n%s", b.method, b.target, err, rec.Body.String())
+	}
+	return rec.Code, body
+}
+
 func TestEveryHandlerNeedsACaller(t *testing.T) {
 	for name, fn := range handlers(noDB()) {
 		code, body := serve(t, fn, http.MethodGet, "/", nil, map[string]string{"id": "1"})
@@ -67,6 +98,12 @@ func TestEveryHandlerNeedsACaller(t *testing.T) {
 			t.Errorf("%s without a principal = %d %v, want 401", name, code, body)
 		}
 	}
+	for name, b := range bodyHandlers(noDB()) {
+		code, body := serveBody(t, b, nil)
+		if code != http.StatusUnauthorized || body["error"] != true {
+			t.Errorf("%s without a principal = %d %v, want 401", name, code, body)
+		}
+	}
 }
 
 func TestEveryHandlerNeedsADatabase(t *testing.T) {
@@ -77,6 +114,12 @@ func TestEveryHandlerNeedsADatabase(t *testing.T) {
 			t.Errorf("%s without a database = %d %v, want 503", name, code, body)
 		}
 	}
+	for name, b := range bodyHandlers(noDB()) {
+		code, body := serveBody(t, b, user)
+		if code != http.StatusServiceUnavailable {
+			t.Errorf("%s without a database = %d %v, want 503", name, code, body)
+		}
+	}
 	// A nil DB func is the same as an unpublished database.
 	code, _ := serve(t, (&api.Handlers{}).Meetings, http.MethodGet, "/", user, nil)
 	if code != http.StatusServiceUnavailable {