From c5c61b6e9d300f6e9bfdc21c4c693649cb797c4c Mon Sep 17 00:00:00 2001
From: gamer147 <gamer147@gmail.com>
Date: Sat, 13 Jun 2026 08:13:49 -0400
Subject: [PATCH] feat(degree): /degree/update_degree sets
 viewer.SelectedDegree (ownership-validated)

---
 .../Controllers/DegreeController.cs           | 19 ++++++
 .../Requests/Degree/DegreeUpdateRequest.cs    | 12 ++++
 .../DegreeControllerUpdateTests.cs            | 58 +++++++++++++++++++
 3 files changed, 89 insertions(+)
 create mode 100644 SVSim.EmulatedEntrypoint/Models/Dtos/Requests/Degree/DegreeUpdateRequest.cs
 create mode 100644 SVSim.UnitTests/Controllers/DegreeControllerUpdateTests.cs

diff --git a/SVSim.EmulatedEntrypoint/Controllers/DegreeController.cs b/SVSim.EmulatedEntrypoint/Controllers/DegreeController.cs
index 3a601f11..c6b2863f 100644
--- a/SVSim.EmulatedEntrypoint/Controllers/DegreeController.cs
+++ b/SVSim.EmulatedEntrypoint/Controllers/DegreeController.cs
@@ -48,4 +48,23 @@ public class DegreeController : SVSimController
         // via the shared Wizard/FavoriteTask.cs Kind enum).
         return new EmptyResponse();
     }
+
+    [HttpPost("update_degree")]
+    public async Task<ActionResult<EmptyResponse>> Update(DegreeUpdateRequest request, CancellationToken ct)
+    {
+        if (!TryGetViewerId(out long viewerId)) return Unauthorized();
+
+        var viewer = await _db.Viewers
+            .Include(v => v.Degrees)
+            .FirstOrDefaultAsync(v => v.Id == viewerId, ct);
+        if (viewer is null) return Unauthorized();
+
+        var owned = viewer.Degrees.FirstOrDefault(d => d.Id == request.DegreeId);
+        if (owned is null)
+            return BadRequest(new { error = "degree_not_owned" });
+
+        viewer.Info.SelectedDegree = owned;
+        await _db.SaveChangesAsync(ct);
+        return new EmptyResponse();
+    }
 }
diff --git a/SVSim.EmulatedEntrypoint/Models/Dtos/Requests/Degree/DegreeUpdateRequest.cs b/SVSim.EmulatedEntrypoint/Models/Dtos/Requests/Degree/DegreeUpdateRequest.cs
new file mode 100644
index 00000000..05574dd5
--- /dev/null
+++ b/SVSim.EmulatedEntrypoint/Models/Dtos/Requests/Degree/DegreeUpdateRequest.cs
@@ -0,0 +1,12 @@
+using MessagePack;
+using System.Text.Json.Serialization;
+
+namespace SVSim.EmulatedEntrypoint.Models.Dtos.Requests.Degree;
+
+[MessagePackObject]
+public class DegreeUpdateRequest : BaseRequest
+{
+    [JsonPropertyName("degree_id")]
+    [Key("degree_id")]
+    public int DegreeId { get; set; }
+}
diff --git a/SVSim.UnitTests/Controllers/DegreeControllerUpdateTests.cs b/SVSim.UnitTests/Controllers/DegreeControllerUpdateTests.cs
new file mode 100644
index 00000000..79539162
--- /dev/null
+++ b/SVSim.UnitTests/Controllers/DegreeControllerUpdateTests.cs
@@ -0,0 +1,58 @@
+using System.Net;
+using System.Text;
+using NUnit.Framework;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.DependencyInjection;
+using SVSim.Database;
+using SVSim.Database.Models;
+using SVSim.UnitTests.Infrastructure;
+
+namespace SVSim.UnitTests.Controllers;
+
+public class DegreeControllerUpdateTests
+{
+    [Test]
+    public async Task Update_persists_selected_degree_when_owned()
+    {
+        using var factory = new SVSimTestFactory();
+        long viewerId = await factory.SeedViewerAsync(tutorialState: 0);
+
+        using (var scope = factory.Services.CreateScope())
+        {
+            var db = scope.ServiceProvider.GetRequiredService<SVSimDbContext>();
+            var viewer = await db.Viewers.Include(v => v.Degrees).FirstAsync(v => v.Id == viewerId);
+            var d500 = await db.Set<DegreeEntry>().FirstOrDefaultAsync(d => d.Id == 500)
+                       ?? db.Set<DegreeEntry>().Add(new DegreeEntry { Id = 500 }).Entity;
+            viewer.Degrees.Add(d500);
+            await db.SaveChangesAsync();
+        }
+
+        using var client = factory.CreateAuthenticatedClient(viewerId);
+        var requestJson = """{"degree_id":500,"viewer_id":"0","steam_id":0,"steam_session_ticket":""}""";
+        var response = await client.PostAsync("/degree/update_degree",
+            new StringContent(requestJson, Encoding.UTF8, "application/json"));
+
+        Assert.That(response.StatusCode, Is.EqualTo(HttpStatusCode.OK));
+
+        using var scope2 = factory.Services.CreateScope();
+        var db2 = scope2.ServiceProvider.GetRequiredService<SVSimDbContext>();
+        var viewer2 = await db2.Viewers
+            .Include(v => v.Info.SelectedDegree)
+            .FirstAsync(v => v.Id == viewerId);
+        Assert.That(viewer2.Info.SelectedDegree.Id, Is.EqualTo(500));
+    }
+
+    [Test]
+    public async Task Update_rejects_unowned_degree()
+    {
+        using var factory = new SVSimTestFactory();
+        long viewerId = await factory.SeedViewerAsync(tutorialState: 0);
+        using var client = factory.CreateAuthenticatedClient(viewerId);
+
+        var requestJson = """{"degree_id":99999,"viewer_id":"0","steam_id":0,"steam_session_ticket":""}""";
+        var response = await client.PostAsync("/degree/update_degree",
+            new StringContent(requestJson, Encoding.UTF8, "application/json"));
+
+        Assert.That(response.StatusCode, Is.EqualTo(HttpStatusCode.BadRequest));
+    }
+}