Add JSON response format for full SDK/CLI coverage (#2675)

* Add JSON response format to void-response controller actions

Add respond_to blocks with JSON format to 14 controllers that
previously only rendered HTML or Turbo Stream responses. JSON
callers get head :no_content (or :created/:ok for push
subscriptions, distinguishing new vs existing).

Covers: board involvements, board/account entropies, column
reordering, card readings, card publishing, user roles, user
avatars, account settings, notification settings, join codes
(with 422 error branch), and push subscriptions.

* Add steps index endpoint with JSON view

Add index action to Cards::StepsController so SDK/CLI callers
can list all steps for a card. Reuses the existing _step.json
partial.

* Add JSON views for paginated card list endpoints

Add show.json.jbuilder for stream, not-now, and closed column
endpoints. No controller changes needed — set_page_and_extract_
portion_from and fresh_when already work format-agnostically.

* Add JSON search endpoint with distinct-card pagination

JSON search paginates distinct Card records (via the existing
Card.mentioning scope with .distinct) rather than Search::Record
objects. This ensures page boundaries, Link headers, and counts
reflect unique cards — no short pages from post-pagination dedup.

ID-match searches return a uniform single-element Card[] array
through the same pagination path.

* Add JSON views for settings and configuration endpoints

Add show.json.jbuilder for account settings (name), join codes
(code, usage_count, usage_limit, url, active), and notification
settings (bundle_email_frequency). Tests for show and update
were added in the void-response commit.

* Add JSON response format to data exports

Create returns 201 with export id, status, and created_at so
callers can poll. Show returns any-status exports for JSON (not
just completed) with a download_url when ready, or 404 for
missing/other-user exports.

* Extend access token JSON API

Add index.json and _access_token.json partial for listing tokens.
Add JSON format to destroy. Include id and created_at in the
create response alongside the existing token/description/permission
fields.

* Fix ambiguous precedence warning in export JSON view

* Assert X-Total-Count pagination header in streams JSON test

* Address review feedback

- Guard steps index against HTML requests (redirect to card)
- Normalize created_at to UTC in access token and export JSON
- Add deterministic ordering (.latest) to search JSON pagination

* Return 406 for HTML requests to steps index instead of redirect

* Add wrap_parameters for flat SDK JSON payload compatibility

Five controllers infer the wrong wrapper key from their class
name, so flat JSON bodies like {"role":"admin"} fail with 400.
Add explicit wrap_parameters declarations:

- Users::RolesController → :user
- Notifications::SettingsController → :user_settings
- Account::JoinCodesController → :account_join_code
- Account::SettingsController → :account
- Boards::EntropiesController → :board

Add integration tests that send flat (unwrapped) JSON payloads
for all seven param-bearing endpoints to prove SDK compatibility.

* Address PR review feedback

- Use 201 Created (not 204) for all create actions: publishes, readings,
  left/right positions, push subscriptions
- Simplify push subscription to always return :created (no 200/201 variance)
- Remove superfluous respond_to block from steps#index
- Merge exports#show into single respond_to block
- Move export download_url conditional out of inline args
- Ensure join code active is explicitly boolean
- Remove extra parens from search controller assignment
- Add blank lines between format blocks for readability

* Return JSON bodies on create actions

Create actions for boards, cards, columns, comments, and steps now
render the resource as JSON (via their show views) instead of returning
empty 201 responses with only a Location header. SDKs expect a JSON
body they can deserialize into the created resource.

* Return JSON bodies on reaction create actions

Card and comment reaction creates now render the reaction as JSON
instead of returning empty 201 responses, consistent with the other
resource-creating endpoints.

* Allow access tokens API without account scope

Access tokens are identity-level (not account-scoped), so the
controller needs to work with bearer token auth and no account slug
in the URL. Skip require_account so the bearer token auth path
can proceed.

Also fix involvement test to send params in JSON body (not query
string) to match real SDK usage.

app/controllers/account/entropies_controller.rb

@@ -3,7 +3,11 @@ class Account::EntropiesController < ApplicationController
 
   def update
     Current.account.entropy.update!(entropy_params)
-    redirect_to account_settings_path, notice: "Account updated"
+
+    respond_to do |format|
+      format.html { redirect_to account_settings_path, notice: "Account updated" }
+      format.json { head :no_content }
+    end
   end
 
   private

app/controllers/account/exports_controller.rb

@@ -6,11 +6,20 @@ class Account::ExportsController < ApplicationController
   CURRENT_EXPORT_LIMIT = 10
 
   def show
+    respond_to do |format|
+      format.html
+      format.json { @export ? render(:show) : head(:not_found) }
+    end
   end
 
   def create
-    Current.account.exports.create!(user: Current.user).build_later
-    redirect_to account_settings_path, notice: "Export started. You'll receive an email when it's ready."
+    @export = Current.account.exports.create!(user: Current.user)
+    @export.build_later
+
+    respond_to do |format|
+      format.html { redirect_to account_settings_path, notice: "Export started. You'll receive an email when it's ready." }
+      format.json { render :show, status: :created }
+    end
   end
 
   private
@@ -23,6 +32,7 @@ class Account::ExportsController < ApplicationController
     end
 
     def set_export
-      @export = Current.account.exports.completed.find_by(id: params[:id], user: Current.user)
+      scope = request.format.json? ? Current.account.exports : Current.account.exports.completed
+      @export = scope.find_by(id: params[:id], user: Current.user)
     end
 end

app/controllers/account/join_codes_controller.rb

@@ -1,4 +1,6 @@
 class Account::JoinCodesController < ApplicationController
+  wrap_parameters :account_join_code
+
   before_action :set_join_code
   before_action :ensure_admin, only: %i[ update destroy ]
 
@@ -10,15 +12,25 @@ class Account::JoinCodesController < ApplicationController
 
   def update
     if @join_code.update(join_code_params)
-      redirect_to account_join_code_path
+      respond_to do |format|
+        format.html { redirect_to account_join_code_path }
+        format.json { head :no_content }
+      end
     else
-      render :edit, status: :unprocessable_entity
+      respond_to do |format|
+        format.html { render :edit, status: :unprocessable_entity }
+        format.json { render json: @join_code.errors, status: :unprocessable_entity }
+      end
     end
   end
 
   def destroy
     @join_code.reset
-    redirect_to account_join_code_path
+
+    respond_to do |format|
+      format.html { redirect_to account_join_code_path }
+      format.json { head :no_content }
+    end
   end
 
   private

app/controllers/account/settings_controller.rb

@@ -1,4 +1,6 @@
 class Account::SettingsController < ApplicationController
+  wrap_parameters :account
+
   before_action :ensure_admin, only: :update
   before_action :set_account
 
@@ -8,7 +10,11 @@ class Account::SettingsController < ApplicationController
 
   def update
     @account.update!(account_params)
-    redirect_to account_settings_path
+
+    respond_to do |format|
+      format.html { redirect_to account_settings_path }
+      format.json { head :no_content }
+    end
   end
 
   private

app/controllers/boards/columns_controller.rb

@@ -18,7 +18,7 @@ class Boards::ColumnsController < ApplicationController
 
     respond_to do |format|
       format.turbo_stream
-      format.json { head :created, location: board_column_path(@board, @column, format: :json) }
+      format.json { render :show, status: :created, location: board_column_path(@board, @column, format: :json) }
     end
   end
 

app/controllers/boards/entropies_controller.rb

@@ -1,10 +1,17 @@
 class Boards::EntropiesController < ApplicationController
+  wrap_parameters :board
+
   include BoardScoped
 
   before_action :ensure_permission_to_admin_board
 
   def update
     @board.update!(entropy_params)
+
+    respond_to do |format|
+      format.turbo_stream
+      format.json { head :no_content }
+    end
   end
 
   private

app/controllers/boards/involvements_controller.rb

@@ -3,5 +3,11 @@ class Boards::InvolvementsController < ApplicationController
 
   def update
     @board.access_for(Current.user).update!(involvement: params[:involvement])
+
+    respond_to do |format|
+      format.html
+      format.turbo_stream
+      format.json { head :no_content }
+    end
   end
 end

app/controllers/boards_controller.rb

@@ -26,7 +26,7 @@ class BoardsController < ApplicationController
 
     respond_to do |format|
       format.html { redirect_to board_path(@board) }
-      format.json { head :created, location: board_path(@board, format: :json) }
+      format.json { render :show, status: :created, location: board_path(@board, format: :json) }
     end
   end
 

app/controllers/cards/comments/reactions_controller.rb

@@ -22,7 +22,7 @@ class Cards::Comments::ReactionsController < ApplicationController
 
     respond_to do |format|
       format.turbo_stream { render "reactions/create" }
-      format.json { head :created }
+      format.json { render "reactions/show", status: :created }
     end
   end
 

app/controllers/cards/comments_controller.rb

@@ -14,7 +14,7 @@ class Cards::CommentsController < ApplicationController
 
     respond_to do |format|
       format.turbo_stream
-      format.json { head :created, location: card_comment_path(@card, @comment, format: :json) }
+      format.json { render :show, status: :created, location: card_comment_path(@card, @comment, format: :json) }
     end
   end
 

app/controllers/cards/publishes_controller.rb

@@ -4,11 +4,17 @@ class Cards::PublishesController < ApplicationController
   def create
     @card.publish
 
-    if add_another_param?
-      card = @board.cards.create!(status: :drafted)
-      redirect_to card_draft_path(card), notice: "Card added"
-    else
-      redirect_to @card.board
+    respond_to do |format|
+      format.html do
+        if add_another_param?
+          card = @board.cards.create!(status: :drafted)
+          redirect_to card_draft_path(card), notice: "Card added"
+        else
+          redirect_to @card.board
+        end
+      end
+
+      format.json { head :created }
     end
   end
 

app/controllers/cards/reactions_controller.rb

@@ -21,7 +21,7 @@ class Cards::ReactionsController < ApplicationController
 
     respond_to do |format|
       format.turbo_stream { render "reactions/create" }
-      format.json { head :created }
+      format.json { render "reactions/show", status: :created }
     end
   end
 

app/controllers/cards/readings_controller.rb

@@ -4,11 +4,21 @@ class Cards::ReadingsController < ApplicationController
   def create
     @notification = @card.read_by(Current.user)
     record_board_access
+
+    respond_to do |format|
+      format.turbo_stream
+      format.json { head :created }
+    end
   end
 
   def destroy
     @notification = @card.unread_by(Current.user)
     record_board_access
+
+    respond_to do |format|
+      format.turbo_stream
+      format.json { head :no_content }
+    end
   end
 
   private

app/controllers/cards/steps_controller.rb

@@ -3,12 +3,16 @@ class Cards::StepsController < ApplicationController
 
   before_action :set_step, only: %i[ show edit update destroy ]
 
+  def index
+    fresh_when etag: @card.steps
+  end
+
   def create
     @step = @card.steps.create!(step_params)
 
     respond_to do |format|
       format.turbo_stream
-      format.json { head :created, location: card_step_path(@card, @step, format: :json) }
+      format.json { render :show, status: :created, location: card_step_path(@card, @step, format: :json) }
     end
   end
 

app/controllers/cards_controller.rb

@@ -18,8 +18,8 @@ class CardsController < ApplicationController
       end
 
       format.json do
-        card = @board.cards.create! card_params.merge(creator: Current.user, status: "published")
-        head :created, location: card_path(card, format: :json)
+        @card = @board.cards.create! card_params.merge(creator: Current.user, status: "published")
+        render :show, status: :created, location: card_path(@card, format: :json)
       end
     end
   end

app/controllers/columns/left_positions_controller.rb

@@ -4,5 +4,10 @@ class Columns::LeftPositionsController < ApplicationController
   def create
     @left_column = @column.left_column
     @column.move_left
+
+    respond_to do |format|
+      format.turbo_stream
+      format.json { head :created }
+    end
   end
 end

app/controllers/columns/right_positions_controller.rb

@@ -4,5 +4,10 @@ class Columns::RightPositionsController < ApplicationController
   def create
     @right_column = @column.right_column
     @column.move_right
+
+    respond_to do |format|
+      format.turbo_stream
+      format.json { head :created }
+    end
   end
 end

app/controllers/my/access_tokens_controller.rb

@@ -1,4 +1,6 @@
 class My::AccessTokensController < ApplicationController
+  skip_before_action :require_account
+
   def index
     @access_tokens = my_access_tokens.order(created_at: :desc)
   end
@@ -24,14 +26,19 @@ class My::AccessTokensController < ApplicationController
 
       format.json do
         render status: :created, json: \
-          { token: access_token.token, description: access_token.description, permission: access_token.permission }
+          { id: access_token.id, token: access_token.token, description: access_token.description,
+            permission: access_token.permission, created_at: access_token.created_at.utc }
       end
     end
   end
 
   def destroy
     my_access_tokens.find(params[:id]).destroy!
-    redirect_to my_access_tokens_path
+
+    respond_to do |format|
+      format.html { redirect_to my_access_tokens_path }
+      format.json { head :no_content }
+    end
   end
 
   private

app/controllers/notifications/settings_controller.rb

@@ -1,4 +1,6 @@
 class Notifications::SettingsController < ApplicationController
+  wrap_parameters :user_settings
+
   before_action :set_settings
 
   def show
@@ -7,7 +9,11 @@ class Notifications::SettingsController < ApplicationController
 
   def update
     @settings.update!(settings_params)
-    redirect_to notifications_settings_path, notice: "Settings updated"
+
+    respond_to do |format|
+      format.html { redirect_to notifications_settings_path, notice: "Settings updated" }
+      format.json { head :no_content }
+    end
   end
 
   private

app/controllers/searches_controller.rb

@@ -5,10 +5,22 @@ class SearchesController < ApplicationController
     @query = params[:q].blank? ? nil : params[:q]
 
     if card = Current.user.accessible_cards.find_by_id(@query)
-      @card = card
+      respond_to do |format|
+        format.html { @card = card }
+        format.json { set_page_and_extract_portion_from Current.user.accessible_cards.where(id: card.id) }
+      end
     else
-      set_page_and_extract_portion_from Current.user.search(@query)
-      @recent_search_queries = Current.user.search_queries.order(updated_at: :desc).limit(10)
+      respond_to do |format|
+        format.html do
+          set_page_and_extract_portion_from Current.user.search(@query)
+          @recent_search_queries = Current.user.search_queries.order(updated_at: :desc).limit(10)
+        end
+
+        format.json do
+          set_page_and_extract_portion_from \
+            Current.user.accessible_cards.mentioning(@query, user: Current.user).distinct.latest.preloaded
+        end
+      end
     end
   end
 end

app/controllers/users/avatars_controller.rb

@@ -16,7 +16,11 @@ class Users::AvatarsController < ApplicationController
 
   def destroy
     @user.avatar.destroy
-    redirect_to @user
+
+    respond_to do |format|
+      format.html { redirect_to @user }
+      format.json { head :no_content }
+    end
   end
 
   private

app/controllers/users/push_subscriptions_controller.rb

@@ -5,12 +5,21 @@ class Users::PushSubscriptionsController < ApplicationController
   end
 
   def create
-    @push_subscriptions.create_with(user_agent: request.user_agent).create_or_find_by!(push_subscription_params)
+    subscription = @push_subscriptions.create_with(user_agent: request.user_agent).create_or_find_by!(push_subscription_params)
+
+    respond_to do |format|
+      format.html { head :no_content }
+      format.json { head :created }
+    end
   end
 
   def destroy
     @push_subscriptions.destroy_by(id: params[:id])
-    redirect_to user_push_subscriptions_url
+
+    respond_to do |format|
+      format.html { redirect_to user_push_subscriptions_url }
+      format.json { head :no_content }
+    end
   end
 
   private

app/controllers/users/roles_controller.rb

@@ -1,10 +1,16 @@
 class Users::RolesController < ApplicationController
+  wrap_parameters :user
+
   before_action :set_user
   before_action :ensure_permission_to_administer_user
 
   def update
     @user.update!(role_params)
-    redirect_to account_settings_path
+
+    respond_to do |format|
+      format.html { redirect_to account_settings_path }
+      format.json { head :no_content }
+    end
   end
 
   private