Cospend: reject empty payed_for; add update_member activated round-trip test

Author: oleksandr-nc

src/nc_mcp_server/tools/cospend.py

@@ -422,8 +422,10 @@ async def create_cospend_bill(
             what: Short description of the expense (e.g. "Pizza").
             amount: Total amount paid.
             payer: Member id of the person who paid.
-            payed_for: List of member ids who share the cost. Pass [] only for
-                a personal expense (rare).
+            payed_for: Non-empty list of member ids who share the cost.
+                Cospend requires at least one ower per bill — passing [] raises
+                ValueError (the server would reject it on create and silently
+                no-op on update, so we reject it up front for both).
             date: Date string "YYYY-MM-DD". Defaults to today (UTC) if both
                 date and timestamp are omitted; the underlying API requires one.
             timestamp: Alternative to date — Unix seconds. If both are set, the
@@ -445,6 +447,8 @@ async def create_cospend_bill(
         Returns:
             JSON {"bill_id": <int>} — the integer id of the new bill.
         """
+        if not payed_for:
+            raise ValueError("payed_for must be a non-empty list of member ids")
         client = get_client()
         if timestamp is None and date is None:
             date = datetime.now(UTC).date().isoformat()
@@ -497,7 +501,10 @@ async def update_cospend_bill(
             what: New description.
             amount: New amount.
             payer: New payer member id.
-            payed_for: New list of ower member ids (replaces, doesn't merge).
+            payed_for: New non-empty list of ower member ids (replaces,
+                doesn't merge). Passing [] raises ValueError — the server
+                no-ops silently on empty payedFor, which would look like a
+                successful update but leave owers unchanged.
             date: New "YYYY-MM-DD" date.
             timestamp: Alternative to date.
             comment: New comment.
@@ -513,6 +520,8 @@ async def update_cospend_bill(
         Returns:
             JSON {"bill_id": <int>} confirming the updated bill id.
         """
+        if payed_for is not None and not payed_for:
+            raise ValueError("payed_for must be a non-empty list of member ids")
         client = get_client()
         body = _body(
             what=what,

tests/integration/test_cospend.py

@@ -188,6 +188,40 @@ async def test_update_weight_persists(self, nc_mcp: McpTestHelper) -> None:
         )
         assert updated["weight"] == 3.5
 
+    @pytest.mark.asyncio
+    async def test_update_activated_false_then_true_round_trip(self, nc_mcp: McpTestHelper) -> None:
+        """Soft-disable via update path, then re-enable. Catches the create/update field-name asymmetry
+        (create uses `active` int, update uses `activated` bool)."""
+        pid = "mcp-test-mem-toggle"
+        await _make_project(nc_mcp, pid)
+        member = await _make_member(nc_mcp, pid, "Toggle")
+        bob = await _make_member(nc_mcp, pid, "Bob")
+        # Member must own a bill so update(activated=False) soft-disables instead of deleting
+        await _make_bill(nc_mcp, pid, "Lunch", 10.0, payer=member["id"], payed_for=[member["id"], bob["id"]])
+
+        disabled = json.loads(
+            await nc_mcp.call(
+                "update_cospend_member",
+                project_id=pid,
+                member_id=member["id"],
+                activated=False,
+            )
+        )
+        assert disabled is not None, "member with bills should be returned as soft-disabled, not deleted"
+        assert disabled["activated"] is False
+        members = json.loads(await nc_mcp.call("list_cospend_members", project_id=pid))
+        assert next(m for m in members if m["id"] == member["id"])["activated"] is False
+
+        re_enabled = json.loads(
+            await nc_mcp.call(
+                "update_cospend_member",
+                project_id=pid,
+                member_id=member["id"],
+                activated=True,
+            )
+        )
+        assert re_enabled["activated"] is True
+
     @pytest.mark.asyncio
     async def test_delete_removes_member_with_no_bills(self, nc_mcp: McpTestHelper) -> None:
         await _make_project(nc_mcp, "mcp-test-mem-del")
@@ -465,6 +499,34 @@ async def test_get_bill_with_bad_id_raises(self, nc_mcp: McpTestHelper) -> None:
         with pytest.raises((ToolError, NextcloudError)):
             await nc_mcp.call("get_cospend_bill", project_id="mcp-test-bad-bill", bill_id=999_999_999)
 
+    @pytest.mark.asyncio
+    async def test_create_bill_with_empty_payed_for_rejected(self, nc_mcp: McpTestHelper) -> None:
+        """payed_for=[] is rejected client-side — server would 400, we fail fast with a clearer message."""
+        pid = "mcp-test-bill-empty-create"
+        await _make_project(nc_mcp, pid)
+        alice = await _make_member(nc_mcp, pid, "Alice")
+        with pytest.raises(ToolError, match="non-empty"):
+            await nc_mcp.call(
+                "create_cospend_bill",
+                project_id=pid,
+                what="X",
+                amount=1.0,
+                payer=alice["id"],
+                payed_for=[],
+            )
+
+    @pytest.mark.asyncio
+    async def test_update_bill_with_empty_payed_for_rejected(self, nc_mcp: McpTestHelper) -> None:
+        """payed_for=[] on update is rejected — server would silently no-op (200 OK with owers unchanged),
+        which would look like a successful update. We reject up front instead."""
+        pid = "mcp-test-bill-empty-update"
+        await _make_project(nc_mcp, pid)
+        alice = await _make_member(nc_mcp, pid, "Alice")
+        bob = await _make_member(nc_mcp, pid, "Bob")
+        bill_id = await _make_bill(nc_mcp, pid, "X", 1.0, alice["id"], [alice["id"], bob["id"]])
+        with pytest.raises(ToolError, match="non-empty"):
+            await nc_mcp.call("update_cospend_bill", project_id=pid, bill_id=bill_id, payed_for=[])
+
 
 class TestToolRegistration:
     """Confirm all expected tools are registered (catches accidental drops)."""