phase 4

backend/tests/api/test_boards.py

@@ -0,0 +1,558 @@
+"""Integration tests for board API endpoints."""
+
+import pytest
+from fastapi import status
+from fastapi.testclient import TestClient
+
+
+@pytest.fixture
+def authenticated_client(client: TestClient, test_user_data: dict) -> tuple[TestClient, dict]:
+    """
+    Create authenticated client with token.
+
+    Returns:
+        Tuple of (client, auth_headers)
+    """
+    # Register and login
+    client.post("/api/v1/auth/register", json=test_user_data)
+    login_response = client.post("/api/v1/auth/login", json=test_user_data)
+
+    token = login_response.json()["access_token"]
+    headers = {"Authorization": f"Bearer {token}"}
+
+    return client, headers
+
+
+class TestCreateBoardEndpoint:
+    """Test POST /boards endpoint."""
+
+    def test_create_board_success(self, authenticated_client: tuple[TestClient, dict]):
+        """Test successful board creation."""
+        client, headers = authenticated_client
+
+        board_data = {"title": "My First Board", "description": "Test description"}
+
+        response = client.post("/api/v1/boards", json=board_data, headers=headers)
+
+        assert response.status_code == status.HTTP_201_CREATED
+
+        data = response.json()
+        assert "id" in data
+        assert data["title"] == "My First Board"
+        assert data["description"] == "Test description"
+        assert "viewport_state" in data
+        assert data["viewport_state"]["zoom"] == 1.0
+        assert data["is_deleted"] is False
+
+    def test_create_board_minimal(self, authenticated_client: tuple[TestClient, dict]):
+        """Test creating board with only title."""
+        client, headers = authenticated_client
+
+        board_data = {"title": "Minimal Board"}
+
+        response = client.post("/api/v1/boards", json=board_data, headers=headers)
+
+        assert response.status_code == status.HTTP_201_CREATED
+
+        data = response.json()
+        assert data["title"] == "Minimal Board"
+        assert data["description"] is None
+
+    def test_create_board_empty_title(self, authenticated_client: tuple[TestClient, dict]):
+        """Test that empty title is rejected."""
+        client, headers = authenticated_client
+
+        board_data = {"title": ""}
+
+        response = client.post("/api/v1/boards", json=board_data, headers=headers)
+
+        assert response.status_code == status.HTTP_422_UNPROCESSABLE_ENTITY
+
+    def test_create_board_missing_title(self, authenticated_client: tuple[TestClient, dict]):
+        """Test that missing title is rejected."""
+        client, headers = authenticated_client
+
+        board_data = {"description": "No title"}
+
+        response = client.post("/api/v1/boards", json=board_data, headers=headers)
+
+        assert response.status_code == status.HTTP_422_UNPROCESSABLE_ENTITY
+
+    def test_create_board_unauthenticated(self, client: TestClient):
+        """Test that unauthenticated users can't create boards."""
+        board_data = {"title": "Unauthorized Board"}
+
+        response = client.post("/api/v1/boards", json=board_data)
+
+        assert response.status_code == status.HTTP_401_UNAUTHORIZED
+
+
+class TestListBoardsEndpoint:
+    """Test GET /boards endpoint."""
+
+    def test_list_boards_empty(self, authenticated_client: tuple[TestClient, dict]):
+        """Test listing boards when user has none."""
+        client, headers = authenticated_client
+
+        response = client.get("/api/v1/boards", headers=headers)
+
+        assert response.status_code == status.HTTP_200_OK
+
+        data = response.json()
+        assert data["boards"] == []
+        assert data["total"] == 0
+        assert data["limit"] == 50
+        assert data["offset"] == 0
+
+    def test_list_boards_multiple(self, authenticated_client: tuple[TestClient, dict]):
+        """Test listing multiple boards."""
+        client, headers = authenticated_client
+
+        # Create 3 boards
+        for i in range(3):
+            client.post(
+                "/api/v1/boards", json={"title": f"Board {i}"}, headers=headers
+            )
+
+        response = client.get("/api/v1/boards", headers=headers)
+
+        assert response.status_code == status.HTTP_200_OK
+
+        data = response.json()
+        assert len(data["boards"]) == 3
+        assert data["total"] == 3
+
+    def test_list_boards_pagination(self, authenticated_client: tuple[TestClient, dict]):
+        """Test board pagination."""
+        client, headers = authenticated_client
+
+        # Create 5 boards
+        for i in range(5):
+            client.post(
+                "/api/v1/boards", json={"title": f"Board {i}"}, headers=headers
+            )
+
+        # Get first page
+        response1 = client.get("/api/v1/boards?limit=2&offset=0", headers=headers)
+        data1 = response1.json()
+
+        assert len(data1["boards"]) == 2
+        assert data1["total"] == 5
+        assert data1["limit"] == 2
+        assert data1["offset"] == 0
+
+        # Get second page
+        response2 = client.get("/api/v1/boards?limit=2&offset=2", headers=headers)
+        data2 = response2.json()
+
+        assert len(data2["boards"]) == 2
+        assert data2["total"] == 5
+
+    def test_list_boards_unauthenticated(self, client: TestClient):
+        """Test that unauthenticated users can't list boards."""
+        response = client.get("/api/v1/boards")
+
+        assert response.status_code == status.HTTP_401_UNAUTHORIZED
+
+
+class TestGetBoardEndpoint:
+    """Test GET /boards/{board_id} endpoint."""
+
+    def test_get_board_success(self, authenticated_client: tuple[TestClient, dict]):
+        """Test getting existing board."""
+        client, headers = authenticated_client
+
+        # Create board
+        create_response = client.post(
+            "/api/v1/boards", json={"title": "Test Board"}, headers=headers
+        )
+        board_id = create_response.json()["id"]
+
+        # Get board
+        response = client.get(f"/api/v1/boards/{board_id}", headers=headers)
+
+        assert response.status_code == status.HTTP_200_OK
+
+        data = response.json()
+        assert data["id"] == board_id
+        assert data["title"] == "Test Board"
+
+    def test_get_board_not_found(self, authenticated_client: tuple[TestClient, dict]):
+        """Test getting nonexistent board."""
+        client, headers = authenticated_client
+
+        fake_id = "00000000-0000-0000-0000-000000000000"
+
+        response = client.get(f"/api/v1/boards/{fake_id}", headers=headers)
+
+        assert response.status_code == status.HTTP_404_NOT_FOUND
+
+    def test_get_board_unauthenticated(self, client: TestClient):
+        """Test that unauthenticated users can't get boards."""
+        fake_id = "00000000-0000-0000-0000-000000000000"
+
+        response = client.get(f"/api/v1/boards/{fake_id}")
+
+        assert response.status_code == status.HTTP_401_UNAUTHORIZED
+
+
+class TestUpdateBoardEndpoint:
+    """Test PATCH /boards/{board_id} endpoint."""
+
+    def test_update_board_title(self, authenticated_client: tuple[TestClient, dict]):
+        """Test updating board title."""
+        client, headers = authenticated_client
+
+        # Create board
+        create_response = client.post(
+            "/api/v1/boards", json={"title": "Original Title"}, headers=headers
+        )
+        board_id = create_response.json()["id"]
+
+        # Update title
+        update_data = {"title": "Updated Title"}
+        response = client.patch(f"/api/v1/boards/{board_id}", json=update_data, headers=headers)
+
+        assert response.status_code == status.HTTP_200_OK
+
+        data = response.json()
+        assert data["title"] == "Updated Title"
+
+    def test_update_board_description(self, authenticated_client: tuple[TestClient, dict]):
+        """Test updating board description."""
+        client, headers = authenticated_client
+
+        # Create board
+        create_response = client.post(
+            "/api/v1/boards", json={"title": "Test Board"}, headers=headers
+        )
+        board_id = create_response.json()["id"]
+
+        # Update description
+        update_data = {"description": "New description"}
+        response = client.patch(f"/api/v1/boards/{board_id}", json=update_data, headers=headers)
+
+        assert response.status_code == status.HTTP_200_OK
+
+        data = response.json()
+        assert data["description"] == "New description"
+
+    def test_update_board_viewport(self, authenticated_client: tuple[TestClient, dict]):
+        """Test updating viewport state."""
+        client, headers = authenticated_client
+
+        # Create board
+        create_response = client.post(
+            "/api/v1/boards", json={"title": "Test Board"}, headers=headers
+        )
+        board_id = create_response.json()["id"]
+
+        # Update viewport
+        update_data = {"viewport_state": {"x": 100, "y": 200, "zoom": 1.5, "rotation": 45}}
+        response = client.patch(f"/api/v1/boards/{board_id}", json=update_data, headers=headers)
+
+        assert response.status_code == status.HTTP_200_OK
+
+        data = response.json()
+        assert data["viewport_state"]["x"] == 100
+        assert data["viewport_state"]["y"] == 200
+        assert data["viewport_state"]["zoom"] == 1.5
+        assert data["viewport_state"]["rotation"] == 45
+
+    def test_update_board_invalid_viewport(self, authenticated_client: tuple[TestClient, dict]):
+        """Test that invalid viewport values are rejected."""
+        client, headers = authenticated_client
+
+        # Create board
+        create_response = client.post(
+            "/api/v1/boards", json={"title": "Test Board"}, headers=headers
+        )
+        board_id = create_response.json()["id"]
+
+        # Try invalid zoom (out of range)
+        update_data = {"viewport_state": {"x": 0, "y": 0, "zoom": 10.0, "rotation": 0}}
+        response = client.patch(f"/api/v1/boards/{board_id}", json=update_data, headers=headers)
+
+        assert response.status_code == status.HTTP_422_UNPROCESSABLE_ENTITY
+
+    def test_update_board_not_found(self, authenticated_client: tuple[TestClient, dict]):
+        """Test updating nonexistent board."""
+        client, headers = authenticated_client
+
+        fake_id = "00000000-0000-0000-0000-000000000000"
+        update_data = {"title": "Updated"}
+
+        response = client.patch(f"/api/v1/boards/{fake_id}", json=update_data, headers=headers)
+
+        assert response.status_code == status.HTTP_404_NOT_FOUND
+
+
+class TestDeleteBoardEndpoint:
+    """Test DELETE /boards/{board_id} endpoint."""
+
+    def test_delete_board_success(self, authenticated_client: tuple[TestClient, dict]):
+        """Test successfully deleting a board."""
+        client, headers = authenticated_client
+
+        # Create board
+        create_response = client.post(
+            "/api/v1/boards", json={"title": "Test Board"}, headers=headers
+        )
+        board_id = create_response.json()["id"]
+
+        # Delete board
+        response = client.delete(f"/api/v1/boards/{board_id}", headers=headers)
+
+        assert response.status_code == status.HTTP_204_NO_CONTENT
+
+        # Verify board is gone from listings
+        list_response = client.get("/api/v1/boards", headers=headers)
+        boards = list_response.json()["boards"]
+        assert not any(b["id"] == board_id for b in boards)
+
+    def test_delete_board_not_found(self, authenticated_client: tuple[TestClient, dict]):
+        """Test deleting nonexistent board."""
+        client, headers = authenticated_client
+
+        fake_id = "00000000-0000-0000-0000-000000000000"
+
+        response = client.delete(f"/api/v1/boards/{fake_id}", headers=headers)
+
+        assert response.status_code == status.HTTP_404_NOT_FOUND
+
+    def test_delete_board_unauthenticated(self, client: TestClient):
+        """Test that unauthenticated users can't delete boards."""
+        fake_id = "00000000-0000-0000-0000-000000000000"
+
+        response = client.delete(f"/api/v1/boards/{fake_id}")
+
+        assert response.status_code == status.HTTP_401_UNAUTHORIZED
+
+
+class TestBoardOwnershipIsolation:
+    """Test that users can only access their own boards."""
+
+    def test_users_cannot_see_each_others_boards(self, client: TestClient):
+        """Test that users only see their own boards in listings."""
+        # Create user1 and boards
+        user1_data = {"email": "user1@example.com", "password": "Password123"}
+        client.post("/api/v1/auth/register", json=user1_data)
+        login1 = client.post("/api/v1/auth/login", json=user1_data)
+        token1 = login1.json()["access_token"]
+        headers1 = {"Authorization": f"Bearer {token1}"}
+
+        client.post("/api/v1/boards", json={"title": "User 1 Board"}, headers=headers1)
+
+        # Create user2 and boards
+        user2_data = {"email": "user2@example.com", "password": "Password456"}
+        client.post("/api/v1/auth/register", json=user2_data)
+        login2 = client.post("/api/v1/auth/login", json=user2_data)
+        token2 = login2.json()["access_token"]
+        headers2 = {"Authorization": f"Bearer {token2}"}
+
+        client.post("/api/v1/boards", json={"title": "User 2 Board"}, headers=headers2)
+
+        # User1 should only see their board
+        response1 = client.get("/api/v1/boards", headers=headers1)
+        boards1 = response1.json()["boards"]
+        assert len(boards1) == 1
+        assert boards1[0]["title"] == "User 1 Board"
+
+        # User2 should only see their board
+        response2 = client.get("/api/v1/boards", headers=headers2)
+        boards2 = response2.json()["boards"]
+        assert len(boards2) == 1
+        assert boards2[0]["title"] == "User 2 Board"
+
+    def test_users_cannot_access_each_others_boards_directly(self, client: TestClient):
+        """Test that users can't access boards they don't own."""
+        # Create user1 and board
+        user1_data = {"email": "user1@example.com", "password": "Password123"}
+        client.post("/api/v1/auth/register", json=user1_data)
+        login1 = client.post("/api/v1/auth/login", json=user1_data)
+        token1 = login1.json()["access_token"]
+        headers1 = {"Authorization": f"Bearer {token1}"}
+
+        create_response = client.post(
+            "/api/v1/boards", json={"title": "User 1 Board"}, headers=headers1
+        )
+        board_id = create_response.json()["id"]
+
+        # Create user2
+        user2_data = {"email": "user2@example.com", "password": "Password456"}
+        client.post("/api/v1/auth/register", json=user2_data)
+        login2 = client.post("/api/v1/auth/login", json=user2_data)
+        token2 = login2.json()["access_token"]
+        headers2 = {"Authorization": f"Bearer {token2}"}
+
+        # User2 tries to access User1's board
+        response = client.get(f"/api/v1/boards/{board_id}", headers=headers2)
+
+        assert response.status_code == status.HTTP_404_NOT_FOUND
+
+    def test_users_cannot_update_each_others_boards(self, client: TestClient):
+        """Test that users can't update boards they don't own."""
+        # Create user1 and board
+        user1_data = {"email": "user1@example.com", "password": "Password123"}
+        client.post("/api/v1/auth/register", json=user1_data)
+        login1 = client.post("/api/v1/auth/login", json=user1_data)
+        token1 = login1.json()["access_token"]
+        headers1 = {"Authorization": f"Bearer {token1}"}
+
+        create_response = client.post(
+            "/api/v1/boards", json={"title": "User 1 Board"}, headers=headers1
+        )
+        board_id = create_response.json()["id"]
+
+        # Create user2
+        user2_data = {"email": "user2@example.com", "password": "Password456"}
+        client.post("/api/v1/auth/register", json=user2_data)
+        login2 = client.post("/api/v1/auth/login", json=user2_data)
+        token2 = login2.json()["access_token"]
+        headers2 = {"Authorization": f"Bearer {token2}"}
+
+        # User2 tries to update User1's board
+        response = client.patch(
+            f"/api/v1/boards/{board_id}", json={"title": "Hacked Title"}, headers=headers2
+        )
+
+        assert response.status_code == status.HTTP_404_NOT_FOUND
+
+        # Verify original board unchanged
+        original = client.get(f"/api/v1/boards/{board_id}", headers=headers1)
+        assert original.json()["title"] == "User 1 Board"
+
+    def test_users_cannot_delete_each_others_boards(self, client: TestClient):
+        """Test that users can't delete boards they don't own."""
+        # Create user1 and board
+        user1_data = {"email": "user1@example.com", "password": "Password123"}
+        client.post("/api/v1/auth/register", json=user1_data)
+        login1 = client.post("/api/v1/auth/login", json=user1_data)
+        token1 = login1.json()["access_token"]
+        headers1 = {"Authorization": f"Bearer {token1}"}
+
+        create_response = client.post(
+            "/api/v1/boards", json={"title": "User 1 Board"}, headers=headers1
+        )
+        board_id = create_response.json()["id"]
+
+        # Create user2
+        user2_data = {"email": "user2@example.com", "password": "Password456"}
+        client.post("/api/v1/auth/register", json=user2_data)
+        login2 = client.post("/api/v1/auth/login", json=user2_data)
+        token2 = login2.json()["access_token"]
+        headers2 = {"Authorization": f"Bearer {token2}"}
+
+        # User2 tries to delete User1's board
+        response = client.delete(f"/api/v1/boards/{board_id}", headers=headers2)
+
+        assert response.status_code == status.HTTP_404_NOT_FOUND
+
+        # Verify board still exists for user1
+        still_exists = client.get(f"/api/v1/boards/{board_id}", headers=headers1)
+        assert still_exists.status_code == status.HTTP_200_OK
+
+
+class TestBoardCRUDFlow:
+    """Test complete board CRUD flow."""
+
+    def test_complete_board_lifecycle(self, authenticated_client: tuple[TestClient, dict]):
+        """Test create → read → update → delete flow."""
+        client, headers = authenticated_client
+
+        # CREATE
+        create_data = {"title": "My Board", "description": "Initial description"}
+        create_response = client.post("/api/v1/boards", json=create_data, headers=headers)
+
+        assert create_response.status_code == status.HTTP_201_CREATED
+        board_id = create_response.json()["id"]
+
+        # READ
+        get_response = client.get(f"/api/v1/boards/{board_id}", headers=headers)
+
+        assert get_response.status_code == status.HTTP_200_OK
+        assert get_response.json()["title"] == "My Board"
+
+        # UPDATE
+        update_data = {"title": "Updated Board", "description": "Updated description"}
+        update_response = client.patch(
+            f"/api/v1/boards/{board_id}", json=update_data, headers=headers
+        )
+
+        assert update_response.status_code == status.HTTP_200_OK
+        assert update_response.json()["title"] == "Updated Board"
+
+        # DELETE
+        delete_response = client.delete(f"/api/v1/boards/{board_id}", headers=headers)
+
+        assert delete_response.status_code == status.HTTP_204_NO_CONTENT
+
+        # VERIFY DELETED
+        get_deleted = client.get(f"/api/v1/boards/{board_id}", headers=headers)
+        assert get_deleted.status_code == status.HTTP_404_NOT_FOUND
+
+    def test_board_appears_in_list_after_creation(self, authenticated_client: tuple[TestClient, dict]):
+        """Test that newly created board appears in list."""
+        client, headers = authenticated_client
+
+        # List should be empty
+        initial_list = client.get("/api/v1/boards", headers=headers)
+        assert initial_list.json()["total"] == 0
+
+        # Create board
+        client.post("/api/v1/boards", json={"title": "New Board"}, headers=headers)
+
+        # List should now contain 1 board
+        updated_list = client.get("/api/v1/boards", headers=headers)
+        data = updated_list.json()
+
+        assert data["total"] == 1
+        assert data["boards"][0]["title"] == "New Board"
+
+    def test_board_updates_reflect_in_list(self, authenticated_client: tuple[TestClient, dict]):
+        """Test that board updates are reflected in the list."""
+        client, headers = authenticated_client
+
+        # Create board
+        create_response = client.post(
+            "/api/v1/boards", json={"title": "Original"}, headers=headers
+        )
+        board_id = create_response.json()["id"]
+
+        # Update board
+        client.patch(f"/api/v1/boards/{board_id}", json={"title": "Updated"}, headers=headers)
+
+        # Check list
+        list_response = client.get("/api/v1/boards", headers=headers)
+        boards = list_response.json()["boards"]
+
+        assert len(boards) == 1
+        assert boards[0]["title"] == "Updated"
+
+    def test_viewport_state_persists(self, authenticated_client: tuple[TestClient, dict]):
+        """Test that viewport state persists across updates."""
+        client, headers = authenticated_client
+
+        # Create board
+        create_response = client.post(
+            "/api/v1/boards", json={"title": "Test Board"}, headers=headers
+        )
+        board_id = create_response.json()["id"]
+
+        # Update viewport
+        viewport1 = {"x": 100, "y": 100, "zoom": 2.0, "rotation": 90}
+        client.patch(
+            f"/api/v1/boards/{board_id}", json={"viewport_state": viewport1}, headers=headers
+        )
+
+        # Update title (shouldn't affect viewport)
+        client.patch(f"/api/v1/boards/{board_id}", json={"title": "New Title"}, headers=headers)
+
+        # Get board and verify viewport persisted
+        get_response = client.get(f"/api/v1/boards/{board_id}", headers=headers)
+        data = get_response.json()
+
+        assert data["title"] == "New Title"
+        assert data["viewport_state"]["x"] == 100
+        assert data["viewport_state"]["zoom"] == 2.0
+

backend/tests/boards/__init__.py

@@ -0,0 +1,2 @@
+"""Board module tests."""
+

backend/tests/boards/test_repository.py

@@ -0,0 +1,442 @@
+"""Unit tests for board repository."""
+
+from uuid import uuid4
+
+import pytest
+from sqlalchemy.orm import Session
+
+from app.boards.repository import BoardRepository
+from app.database.models.board import Board
+from app.database.models.user import User
+
+
+@pytest.fixture
+def test_user(db: Session) -> User:
+    """Create a test user."""
+    user = User(email="test@example.com", password_hash="hashed_password")
+    db.add(user)
+    db.commit()
+    db.refresh(user)
+    return user
+
+
+@pytest.fixture
+def board_repo(db: Session) -> BoardRepository:
+    """Create a board repository instance."""
+    return BoardRepository(db)
+
+
+class TestCreateBoard:
+    """Test board creation."""
+
+    def test_create_board_minimal(self, board_repo: BoardRepository, test_user: User):
+        """Test creating board with only required fields."""
+        board = board_repo.create_board(user_id=test_user.id, title="Test Board")
+
+        assert board.id is not None
+        assert board.user_id == test_user.id
+        assert board.title == "Test Board"
+        assert board.description is None
+        assert board.is_deleted is False
+        assert board.created_at is not None
+        assert board.updated_at is not None
+
+    def test_create_board_with_description(self, board_repo: BoardRepository, test_user: User):
+        """Test creating board with description."""
+        board = board_repo.create_board(
+            user_id=test_user.id, title="Test Board", description="This is a test description"
+        )
+
+        assert board.description == "This is a test description"
+
+    def test_create_board_default_viewport(self, board_repo: BoardRepository, test_user: User):
+        """Test that board is created with default viewport state."""
+        board = board_repo.create_board(user_id=test_user.id, title="Test Board")
+
+        assert board.viewport_state is not None
+        assert board.viewport_state["x"] == 0
+        assert board.viewport_state["y"] == 0
+        assert board.viewport_state["zoom"] == 1.0
+        assert board.viewport_state["rotation"] == 0
+
+    def test_create_board_custom_viewport(self, board_repo: BoardRepository, test_user: User):
+        """Test creating board with custom viewport state."""
+        custom_viewport = {"x": 100, "y": 200, "zoom": 2.0, "rotation": 45}
+
+        board = board_repo.create_board(
+            user_id=test_user.id, title="Test Board", viewport_state=custom_viewport
+        )
+
+        assert board.viewport_state == custom_viewport
+
+    def test_create_multiple_boards(self, board_repo: BoardRepository, test_user: User):
+        """Test creating multiple boards for same user."""
+        board1 = board_repo.create_board(user_id=test_user.id, title="Board 1")
+        board2 = board_repo.create_board(user_id=test_user.id, title="Board 2")
+        board3 = board_repo.create_board(user_id=test_user.id, title="Board 3")
+
+        assert board1.id != board2.id
+        assert board2.id != board3.id
+        assert all(b.user_id == test_user.id for b in [board1, board2, board3])
+
+
+class TestGetBoardById:
+    """Test retrieving board by ID."""
+
+    def test_get_existing_board(self, board_repo: BoardRepository, test_user: User):
+        """Test getting existing board owned by user."""
+        created = board_repo.create_board(user_id=test_user.id, title="Test Board")
+
+        retrieved = board_repo.get_board_by_id(board_id=created.id, user_id=test_user.id)
+
+        assert retrieved is not None
+        assert retrieved.id == created.id
+        assert retrieved.title == created.title
+
+    def test_get_nonexistent_board(self, board_repo: BoardRepository, test_user: User):
+        """Test getting board that doesn't exist."""
+        fake_id = uuid4()
+
+        result = board_repo.get_board_by_id(board_id=fake_id, user_id=test_user.id)
+
+        assert result is None
+
+    def test_get_board_wrong_owner(self, board_repo: BoardRepository, test_user: User, db: Session):
+        """Test that users can't access boards they don't own."""
+        # Create another user
+        other_user = User(email="other@example.com", password_hash="hashed")
+        db.add(other_user)
+        db.commit()
+        db.refresh(other_user)
+
+        # Create board owned by test_user
+        board = board_repo.create_board(user_id=test_user.id, title="Test Board")
+
+        # Try to get with other_user
+        result = board_repo.get_board_by_id(board_id=board.id, user_id=other_user.id)
+
+        assert result is None
+
+    def test_get_deleted_board(self, board_repo: BoardRepository, test_user: User):
+        """Test that soft-deleted boards are not returned."""
+        board = board_repo.create_board(user_id=test_user.id, title="Test Board")
+
+        # Delete the board
+        board_repo.delete_board(board_id=board.id, user_id=test_user.id)
+
+        # Try to get it
+        result = board_repo.get_board_by_id(board_id=board.id, user_id=test_user.id)
+
+        assert result is None
+
+
+class TestGetUserBoards:
+    """Test listing user's boards."""
+
+    def test_get_user_boards_empty(self, board_repo: BoardRepository, test_user: User):
+        """Test getting boards when user has none."""
+        boards, total = board_repo.get_user_boards(user_id=test_user.id)
+
+        assert boards == []
+        assert total == 0
+
+    def test_get_user_boards_multiple(self, board_repo: BoardRepository, test_user: User):
+        """Test getting multiple boards."""
+        board1 = board_repo.create_board(user_id=test_user.id, title="Board 1")
+        board2 = board_repo.create_board(user_id=test_user.id, title="Board 2")
+        board3 = board_repo.create_board(user_id=test_user.id, title="Board 3")
+
+        boards, total = board_repo.get_user_boards(user_id=test_user.id)
+
+        assert len(boards) == 3
+        assert total == 3
+        assert {b.id for b in boards} == {board1.id, board2.id, board3.id}
+
+    def test_get_user_boards_pagination(self, board_repo: BoardRepository, test_user: User):
+        """Test pagination of board list."""
+        # Create 5 boards
+        for i in range(5):
+            board_repo.create_board(user_id=test_user.id, title=f"Board {i}")
+
+        # Get first 2
+        boards_page1, total = board_repo.get_user_boards(user_id=test_user.id, limit=2, offset=0)
+
+        assert len(boards_page1) == 2
+        assert total == 5
+
+        # Get next 2
+        boards_page2, total = board_repo.get_user_boards(user_id=test_user.id, limit=2, offset=2)
+
+        assert len(boards_page2) == 2
+        assert total == 5
+
+        # Ensure no overlap
+        page1_ids = {b.id for b in boards_page1}
+        page2_ids = {b.id for b in boards_page2}
+        assert page1_ids.isdisjoint(page2_ids)
+
+    def test_get_user_boards_sorted_by_update(self, board_repo: BoardRepository, test_user: User):
+        """Test that boards are sorted by updated_at descending."""
+        board1 = board_repo.create_board(user_id=test_user.id, title="Oldest")
+        board2 = board_repo.create_board(user_id=test_user.id, title="Middle")
+        board3 = board_repo.create_board(user_id=test_user.id, title="Newest")
+
+        boards, _ = board_repo.get_user_boards(user_id=test_user.id)
+
+        # Most recently updated should be first
+        assert boards[0].id == board3.id
+        assert boards[1].id == board2.id
+        assert boards[2].id == board1.id
+
+    def test_get_user_boards_excludes_deleted(self, board_repo: BoardRepository, test_user: User):
+        """Test that soft-deleted boards are excluded."""
+        board1 = board_repo.create_board(user_id=test_user.id, title="Board 1")
+        board2 = board_repo.create_board(user_id=test_user.id, title="Board 2")
+        board3 = board_repo.create_board(user_id=test_user.id, title="Board 3")
+
+        # Delete board2
+        board_repo.delete_board(board_id=board2.id, user_id=test_user.id)
+
+        boards, total = board_repo.get_user_boards(user_id=test_user.id)
+
+        assert len(boards) == 2
+        assert total == 2
+        assert {b.id for b in boards} == {board1.id, board3.id}
+
+    def test_get_user_boards_isolation(self, board_repo: BoardRepository, test_user: User, db: Session):
+        """Test that users only see their own boards."""
+        # Create another user
+        other_user = User(email="other@example.com", password_hash="hashed")
+        db.add(other_user)
+        db.commit()
+        db.refresh(other_user)
+
+        # Create boards for both users
+        test_board = board_repo.create_board(user_id=test_user.id, title="Test Board")
+        other_board = board_repo.create_board(user_id=other_user.id, title="Other Board")
+
+        # Get test_user's boards
+        test_boards, _ = board_repo.get_user_boards(user_id=test_user.id)
+
+        assert len(test_boards) == 1
+        assert test_boards[0].id == test_board.id
+
+        # Get other_user's boards
+        other_boards, _ = board_repo.get_user_boards(user_id=other_user.id)
+
+        assert len(other_boards) == 1
+        assert other_boards[0].id == other_board.id
+
+
+class TestUpdateBoard:
+    """Test board updates."""
+
+    def test_update_board_title(self, board_repo: BoardRepository, test_user: User):
+        """Test updating board title."""
+        board = board_repo.create_board(user_id=test_user.id, title="Original Title")
+
+        updated = board_repo.update_board(
+            board_id=board.id, user_id=test_user.id, title="Updated Title"
+        )
+
+        assert updated is not None
+        assert updated.title == "Updated Title"
+        assert updated.id == board.id
+
+    def test_update_board_description(self, board_repo: BoardRepository, test_user: User):
+        """Test updating board description."""
+        board = board_repo.create_board(user_id=test_user.id, title="Test Board")
+
+        updated = board_repo.update_board(
+            board_id=board.id, user_id=test_user.id, description="New description"
+        )
+
+        assert updated is not None
+        assert updated.description == "New description"
+
+    def test_update_board_viewport(self, board_repo: BoardRepository, test_user: User):
+        """Test updating viewport state."""
+        board = board_repo.create_board(user_id=test_user.id, title="Test Board")
+
+        new_viewport = {"x": 100, "y": 200, "zoom": 1.5, "rotation": 90}
+        updated = board_repo.update_board(
+            board_id=board.id, user_id=test_user.id, viewport_state=new_viewport
+        )
+
+        assert updated is not None
+        assert updated.viewport_state == new_viewport
+
+    def test_update_multiple_fields(self, board_repo: BoardRepository, test_user: User):
+        """Test updating multiple fields at once."""
+        board = board_repo.create_board(user_id=test_user.id, title="Original")
+
+        updated = board_repo.update_board(
+            board_id=board.id,
+            user_id=test_user.id,
+            title="Updated Title",
+            description="Updated Description",
+            viewport_state={"x": 50, "y": 50, "zoom": 2.0, "rotation": 45},
+        )
+
+        assert updated is not None
+        assert updated.title == "Updated Title"
+        assert updated.description == "Updated Description"
+        assert updated.viewport_state["zoom"] == 2.0
+
+    def test_update_nonexistent_board(self, board_repo: BoardRepository, test_user: User):
+        """Test updating board that doesn't exist."""
+        fake_id = uuid4()
+
+        result = board_repo.update_board(board_id=fake_id, user_id=test_user.id, title="New Title")
+
+        assert result is None
+
+    def test_update_board_wrong_owner(self, board_repo: BoardRepository, test_user: User, db: Session):
+        """Test that users can't update boards they don't own."""
+        # Create another user
+        other_user = User(email="other@example.com", password_hash="hashed")
+        db.add(other_user)
+        db.commit()
+        db.refresh(other_user)
+
+        # Create board owned by test_user
+        board = board_repo.create_board(user_id=test_user.id, title="Test Board")
+
+        # Try to update with other_user
+        result = board_repo.update_board(
+            board_id=board.id, user_id=other_user.id, title="Hacked Title"
+        )
+
+        assert result is None
+
+        # Verify original board unchanged
+        original = board_repo.get_board_by_id(board_id=board.id, user_id=test_user.id)
+        assert original.title == "Test Board"
+
+    def test_update_board_partial_update(self, board_repo: BoardRepository, test_user: User):
+        """Test that partial updates don't affect unspecified fields."""
+        board = board_repo.create_board(
+            user_id=test_user.id, title="Original Title", description="Original Description"
+        )
+
+        # Update only title
+        updated = board_repo.update_board(board_id=board.id, user_id=test_user.id, title="New Title")
+
+        assert updated is not None
+        assert updated.title == "New Title"
+        assert updated.description == "Original Description"  # Should be unchanged
+
+
+class TestDeleteBoard:
+    """Test board deletion."""
+
+    def test_delete_board_success(self, board_repo: BoardRepository, test_user: User):
+        """Test successfully deleting a board."""
+        board = board_repo.create_board(user_id=test_user.id, title="Test Board")
+
+        success = board_repo.delete_board(board_id=board.id, user_id=test_user.id)
+
+        assert success is True
+
+    def test_delete_board_soft_delete(self, board_repo: BoardRepository, test_user: User, db: Session):
+        """Test that delete is a soft delete (sets flag instead of removing)."""
+        board = board_repo.create_board(user_id=test_user.id, title="Test Board")
+
+        board_repo.delete_board(board_id=board.id, user_id=test_user.id)
+
+        # Board should still exist in database but marked as deleted
+        db_board = db.get(Board, board.id)
+        assert db_board is not None
+        assert db_board.is_deleted is True
+
+    def test_delete_board_not_in_listings(self, board_repo: BoardRepository, test_user: User):
+        """Test that deleted boards don't appear in listings."""
+        board1 = board_repo.create_board(user_id=test_user.id, title="Board 1")
+        board2 = board_repo.create_board(user_id=test_user.id, title="Board 2")
+
+        # Delete board1
+        board_repo.delete_board(board_id=board1.id, user_id=test_user.id)
+
+        boards, total = board_repo.get_user_boards(user_id=test_user.id)
+
+        assert len(boards) == 1
+        assert total == 1
+        assert boards[0].id == board2.id
+
+    def test_delete_nonexistent_board(self, board_repo: BoardRepository, test_user: User):
+        """Test deleting board that doesn't exist."""
+        fake_id = uuid4()
+
+        success = board_repo.delete_board(board_id=fake_id, user_id=test_user.id)
+
+        assert success is False
+
+    def test_delete_board_wrong_owner(self, board_repo: BoardRepository, test_user: User, db: Session):
+        """Test that users can't delete boards they don't own."""
+        # Create another user
+        other_user = User(email="other@example.com", password_hash="hashed")
+        db.add(other_user)
+        db.commit()
+        db.refresh(other_user)
+
+        # Create board owned by test_user
+        board = board_repo.create_board(user_id=test_user.id, title="Test Board")
+
+        # Try to delete with other_user
+        success = board_repo.delete_board(board_id=board.id, user_id=other_user.id)
+
+        assert success is False
+
+        # Verify board still exists for original owner
+        still_exists = board_repo.get_board_by_id(board_id=board.id, user_id=test_user.id)
+        assert still_exists is not None
+        assert still_exists.is_deleted is False
+
+
+class TestBoardExists:
+    """Test board existence check."""
+
+    def test_board_exists_true(self, board_repo: BoardRepository, test_user: User):
+        """Test checking if board exists."""
+        board = board_repo.create_board(user_id=test_user.id, title="Test Board")
+
+        exists = board_repo.board_exists(board_id=board.id, user_id=test_user.id)
+
+        assert exists is True
+
+    def test_board_exists_false(self, board_repo: BoardRepository, test_user: User):
+        """Test checking if board doesn't exist."""
+        fake_id = uuid4()
+
+        exists = board_repo.board_exists(board_id=fake_id, user_id=test_user.id)
+
+        assert exists is False
+
+    def test_board_exists_wrong_owner(self, board_repo: BoardRepository, test_user: User, db: Session):
+        """Test that board_exists returns False for wrong owner."""
+        # Create another user
+        other_user = User(email="other@example.com", password_hash="hashed")
+        db.add(other_user)
+        db.commit()
+        db.refresh(other_user)
+
+        # Create board owned by test_user
+        board = board_repo.create_board(user_id=test_user.id, title="Test Board")
+
+        # Check with wrong owner
+        exists = board_repo.board_exists(board_id=board.id, user_id=other_user.id)
+
+        assert exists is False
+
+    def test_board_exists_deleted(self, board_repo: BoardRepository, test_user: User):
+        """Test that deleted boards return False for existence check."""
+        board = board_repo.create_board(user_id=test_user.id, title="Test Board")
+
+        # Delete board
+        board_repo.delete_board(board_id=board.id, user_id=test_user.id)
+
+        # Check existence
+        exists = board_repo.board_exists(board_id=board.id, user_id=test_user.id)
+
+        assert exists is False
+

frontend/src/routes/boards/+page.svelte

@@ -0,0 +1,218 @@
+<script lang="ts">
+  import { onMount } from 'svelte';
+  import { goto } from '$app/navigation';
+  import { boards, boardsList, boardsLoading, boardsError } from '$lib/stores/boards';
+  import BoardCard from '$lib/components/boards/BoardCard.svelte';
+  import CreateBoardModal from '$lib/components/boards/CreateBoardModal.svelte';
+
+  let showCreateModal = false;
+  let deleteConfirmId: string | null = null;
+
+  onMount(() => {
+    boards.load();
+  });
+
+  function openCreateModal() {
+    showCreateModal = true;
+  }
+
+  function closeCreateModal() {
+    showCreateModal = false;
+  }
+
+  async function handleCreate(event: CustomEvent<{ title: string; description?: string }>) {
+    try {
+      const board = await boards.create(event.detail);
+      closeCreateModal();
+      goto(`/boards/${board.id}`);
+    } catch (error) {
+      console.error('Failed to create board:', error);
+    }
+  }
+
+  async function handleDelete(boardId: string) {
+    if (!confirm('Are you sure you want to delete this board? This action cannot be undone.')) {
+      return;
+    }
+
+    try {
+      await boards.delete(boardId);
+    } catch (error) {
+      console.error('Failed to delete board:', error);
+    }
+  }
+</script>
+
+<div class="boards-page">
+  <header class="page-header">
+    <h1>My Boards</h1>
+    <button on:click={openCreateModal} class="btn-primary">
+      <span class="icon">+</span>
+      New Board
+    </button>
+  </header>
+
+  {#if $boardsError}
+    <div class="error-banner">
+      <span class="error-icon">⚠</span>
+      {$boardsError}
+      <button on:click={() => boards.clearError()} class="close-btn">×</button>
+    </div>
+  {/if}
+
+  {#if $boardsLoading}
+    <div class="loading">
+      <div class="spinner"></div>
+      <p>Loading boards...</p>
+    </div>
+  {:else if $boardsList.length === 0}
+    <div class="empty-state">
+      <div class="empty-icon">📋</div>
+      <h2>No boards yet</h2>
+      <p>Create your first reference board to get started</p>
+      <button on:click={openCreateModal} class="btn-primary">Create Board</button>
+    </div>
+  {:else}
+    <div class="boards-grid">
+      {#each $boardsList as board (board.id)}
+        <BoardCard {board} on:delete={() => handleDelete(board.id)} />
+      {/each}
+    </div>
+  {/if}
+</div>
+
+{#if showCreateModal}
+  <CreateBoardModal on:create={handleCreate} on:close={closeCreateModal} />
+{/if}
+
+<style>
+  .boards-page {
+    max-width: 1200px;
+    margin: 0 auto;
+    padding: 2rem;
+  }
+
+  .page-header {
+    display: flex;
+    justify-content: space-between;
+    align-items: center;
+    margin-bottom: 2rem;
+  }
+
+  .page-header h1 {
+    font-size: 2rem;
+    font-weight: 700;
+    color: #1f2937;
+    margin: 0;
+  }
+
+  .btn-primary {
+    display: flex;
+    align-items: center;
+    gap: 0.5rem;
+    padding: 0.75rem 1.5rem;
+    background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
+    color: white;
+    border: none;
+    border-radius: 8px;
+    font-size: 1rem;
+    font-weight: 600;
+    cursor: pointer;
+    transition: transform 0.2s, box-shadow 0.2s;
+  }
+
+  .btn-primary:hover {
+    transform: translateY(-2px);
+    box-shadow: 0 4px 12px rgba(102, 126, 234, 0.4);
+  }
+
+  .icon {
+    font-size: 1.25rem;
+  }
+
+  .error-banner {
+    display: flex;
+    align-items: center;
+    gap: 0.75rem;
+    padding: 1rem;
+    background: #fee2e2;
+    border: 1px solid #fca5a5;
+    border-radius: 8px;
+    color: #991b1b;
+    margin-bottom: 1.5rem;
+  }
+
+  .error-icon {
+    font-size: 1.25rem;
+  }
+
+  .close-btn {
+    margin-left: auto;
+    background: none;
+    border: none;
+    font-size: 1.5rem;
+    color: #991b1b;
+    cursor: pointer;
+    padding: 0;
+    line-height: 1;
+  }
+
+  .loading {
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    justify-content: center;
+    padding: 4rem;
+    color: #6b7280;
+  }
+
+  .spinner {
+    width: 48px;
+    height: 48px;
+    border: 4px solid #e5e7eb;
+    border-top-color: #667eea;
+    border-radius: 50%;
+    animation: spin 0.8s linear infinite;
+    margin-bottom: 1rem;
+  }
+
+  @keyframes spin {
+    to {
+      transform: rotate(360deg);
+    }
+  }
+
+  .empty-state {
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    justify-content: center;
+    padding: 4rem;
+    text-align: center;
+  }
+
+  .empty-icon {
+    font-size: 4rem;
+    margin-bottom: 1rem;
+    opacity: 0.5;
+  }
+
+  .empty-state h2 {
+    font-size: 1.5rem;
+    font-weight: 600;
+    color: #374151;
+    margin: 0 0 0.5rem 0;
+  }
+
+  .empty-state p {
+    color: #6b7280;
+    margin: 0 0 2rem 0;
+  }
+
+  .boards-grid {
+    display: grid;
+    grid-template-columns: repeat(auto-fill, minmax(280px, 1fr));
+    gap: 1.5rem;
+  }
+</style>
+

frontend/src/routes/boards/[id]/edit/+page.svelte

@@ -0,0 +1,381 @@
+<script lang="ts">
+  import { onMount } from 'svelte';
+  import { goto } from '$app/navigation';
+  import { page } from '$app/stores';
+  import { boards, currentBoard } from '$lib/stores/boards';
+
+  let title = '';
+  let description = '';
+  let isLoading = true;
+  let isSubmitting = false;
+  let errors: Record<string, string> = {};
+
+  $: boardId = $page.params.id;
+
+  onMount(async () => {
+    try {
+      await boards.loadBoard(boardId);
+
+      if ($currentBoard) {
+        title = $currentBoard.title;
+        description = $currentBoard.description || '';
+      }
+    } catch (error) {
+      console.error('Failed to load board:', error);
+      errors.general = 'Failed to load board';
+    } finally {
+      isLoading = false;
+    }
+  });
+
+  function validate(): boolean {
+    errors = {};
+
+    if (!title.trim()) {
+      errors.title = 'Title is required';
+    } else if (title.length > 255) {
+      errors.title = 'Title must be 255 characters or less';
+    }
+
+    if (description.length > 1000) {
+      errors.description = 'Description must be 1000 characters or less';
+    }
+
+    return Object.keys(errors).length === 0;
+  }
+
+  async function handleSubmit() {
+    if (!validate()) return;
+
+    isSubmitting = true;
+
+    try {
+      await boards.update(boardId, {
+        title: title.trim(),
+        description: description.trim() || undefined,
+      });
+
+      // Navigate back to board view
+      goto(`/boards/${boardId}`);
+    } catch (error) {
+      console.error('Failed to update board:', error);
+      errors.general = error instanceof Error ? error.message : 'Failed to update board';
+    } finally {
+      isSubmitting = false;
+    }
+  }
+
+  function handleCancel() {
+    goto(`/boards/${boardId}`);
+  }
+</script>
+
+<svelte:head>
+  <title>Edit Board - Reference Board Viewer</title>
+</svelte:head>
+
+<div class="edit-board-page">
+  <div class="page-container">
+    <header class="page-header">
+      <button class="back-btn" on:click={handleCancel} aria-label="Go back">
+        ← Back to Board
+      </button>
+      <h1>Edit Board</h1>
+    </header>
+
+    {#if isLoading}
+      <div class="loading">
+        <div class="spinner"></div>
+        <p>Loading board...</p>
+      </div>
+    {:else if errors.general}
+      <div class="error-banner">
+        <span class="error-icon">⚠</span>
+        {errors.general}
+        <button class="back-btn-inline" on:click={() => goto('/boards')}>
+          Return to Boards
+        </button>
+      </div>
+    {:else}
+      <form on:submit|preventDefault={handleSubmit} class="board-form">
+        <div class="form-group">
+          <label for="title">Board Title <span class="required">*</span></label>
+          <input
+            id="title"
+            type="text"
+            bind:value={title}
+            disabled={isSubmitting}
+            placeholder="e.g., Character Design References"
+            class:error={errors.title}
+            maxlength="255"
+            required
+          />
+          {#if errors.title}
+            <span class="error-text">{errors.title}</span>
+          {:else}
+            <span class="help-text">{title.length}/255 characters</span>
+          {/if}
+        </div>
+
+        <div class="form-group">
+          <label for="description">Description (optional)</label>
+          <textarea
+            id="description"
+            bind:value={description}
+            disabled={isSubmitting}
+            placeholder="Add a description to help organize your boards..."
+            rows="4"
+            maxlength="1000"
+            class:error={errors.description}
+          />
+          {#if errors.description}
+            <span class="error-text">{errors.description}</span>
+          {:else}
+            <span class="help-text">{description.length}/1000 characters</span>
+          {/if}
+        </div>
+
+        <div class="form-actions">
+          <button
+            type="button"
+            class="btn-secondary"
+            on:click={handleCancel}
+            disabled={isSubmitting}
+          >
+            Cancel
+          </button>
+          <button type="submit" class="btn-primary" disabled={isSubmitting}>
+            {#if isSubmitting}
+              <span class="spinner-small"></span>
+              Saving...
+            {:else}
+              Save Changes
+            {/if}
+          </button>
+        </div>
+      </form>
+    {/if}
+  </div>
+</div>
+
+<style>
+  .edit-board-page {
+    min-height: 100vh;
+    background: #f9fafb;
+    padding: 2rem;
+  }
+
+  .page-container {
+    max-width: 600px;
+    margin: 0 auto;
+  }
+
+  .page-header {
+    margin-bottom: 2rem;
+  }
+
+  .back-btn {
+    background: none;
+    border: none;
+    color: #667eea;
+    font-size: 0.95rem;
+    cursor: pointer;
+    padding: 0.5rem 0;
+    margin-bottom: 1rem;
+    display: inline-flex;
+    align-items: center;
+    transition: color 0.2s;
+  }
+
+  .back-btn:hover {
+    color: #764ba2;
+  }
+
+  .page-header h1 {
+    font-size: 2rem;
+    font-weight: 700;
+    color: #1f2937;
+    margin: 0;
+  }
+
+  .loading {
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    justify-content: center;
+    padding: 4rem;
+    color: #6b7280;
+  }
+
+  .spinner {
+    width: 48px;
+    height: 48px;
+    border: 4px solid #e5e7eb;
+    border-top-color: #667eea;
+    border-radius: 50%;
+    animation: spin 0.8s linear infinite;
+    margin-bottom: 1rem;
+  }
+
+  .error-banner {
+    display: flex;
+    align-items: center;
+    gap: 0.75rem;
+    padding: 1rem;
+    background: #fee2e2;
+    border: 1px solid #fca5a5;
+    border-radius: 8px;
+    color: #991b1b;
+    margin-bottom: 1.5rem;
+  }
+
+  .error-icon {
+    font-size: 1.25rem;
+  }
+
+  .back-btn-inline {
+    margin-left: auto;
+    background: none;
+    border: none;
+    color: #991b1b;
+    text-decoration: underline;
+    cursor: pointer;
+    padding: 0;
+  }
+
+  .board-form {
+    background: white;
+    border-radius: 12px;
+    padding: 2rem;
+    box-shadow: 0 1px 3px rgba(0, 0, 0, 0.1);
+  }
+
+  .form-group {
+    margin-bottom: 1.5rem;
+  }
+
+  label {
+    display: block;
+    font-weight: 500;
+    color: #374151;
+    margin-bottom: 0.5rem;
+    font-size: 0.95rem;
+  }
+
+  .required {
+    color: #ef4444;
+  }
+
+  input,
+  textarea {
+    width: 100%;
+    padding: 0.75rem;
+    border: 1px solid #d1d5db;
+    border-radius: 8px;
+    font-size: 1rem;
+    font-family: inherit;
+    transition: all 0.2s;
+  }
+
+  input:focus,
+  textarea:focus {
+    outline: none;
+    border-color: #667eea;
+    box-shadow: 0 0 0 3px rgba(102, 126, 234, 0.1);
+  }
+
+  input.error,
+  textarea.error {
+    border-color: #ef4444;
+  }
+
+  input:disabled,
+  textarea:disabled {
+    background-color: #f9fafb;
+    cursor: not-allowed;
+  }
+
+  textarea {
+    resize: vertical;
+    min-height: 100px;
+  }
+
+  .error-text {
+    display: block;
+    color: #ef4444;
+    font-size: 0.875rem;
+    margin-top: 0.25rem;
+  }
+
+  .help-text {
+    display: block;
+    color: #6b7280;
+    font-size: 0.875rem;
+    margin-top: 0.25rem;
+  }
+
+  .form-actions {
+    display: flex;
+    gap: 1rem;
+    justify-content: flex-end;
+    margin-top: 2rem;
+    padding-top: 1.5rem;
+    border-top: 1px solid #e5e7eb;
+  }
+
+  .btn-primary,
+  .btn-secondary {
+    padding: 0.75rem 1.5rem;
+    border-radius: 8px;
+    font-size: 1rem;
+    font-weight: 600;
+    cursor: pointer;
+    transition: all 0.2s;
+    border: none;
+    display: flex;
+    align-items: center;
+    gap: 0.5rem;
+  }
+
+  .btn-primary {
+    background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
+    color: white;
+  }
+
+  .btn-primary:hover:not(:disabled) {
+    transform: translateY(-1px);
+    box-shadow: 0 4px 12px rgba(102, 126, 234, 0.4);
+  }
+
+  .btn-primary:disabled {
+    opacity: 0.6;
+    cursor: not-allowed;
+    transform: none;
+  }
+
+  .btn-secondary {
+    background: white;
+    color: #374151;
+    border: 1px solid #d1d5db;
+  }
+
+  .btn-secondary:hover:not(:disabled) {
+    background: #f9fafb;
+  }
+
+  .spinner-small {
+    width: 16px;
+    height: 16px;
+    border: 2px solid rgba(255, 255, 255, 0.3);
+    border-top-color: white;
+    border-radius: 50%;
+    animation: spin 0.8s linear infinite;
+  }
+
+  @keyframes spin {
+    to {
+      transform: rotate(360deg);
+    }
+  }
+</style>
+

frontend/src/routes/boards/new/+page.svelte

@@ -0,0 +1,319 @@
+<script lang="ts">
+  import { goto } from '$app/navigation';
+  import { boards } from '$lib/stores/boards';
+
+  let title = '';
+  let description = '';
+  let isSubmitting = false;
+  let errors: Record<string, string> = {};
+
+  function validate(): boolean {
+    errors = {};
+
+    if (!title.trim()) {
+      errors.title = 'Title is required';
+    } else if (title.length > 255) {
+      errors.title = 'Title must be 255 characters or less';
+    }
+
+    if (description.length > 1000) {
+      errors.description = 'Description must be 1000 characters or less';
+    }
+
+    return Object.keys(errors).length === 0;
+  }
+
+  async function handleSubmit() {
+    if (!validate()) return;
+
+    isSubmitting = true;
+
+    try {
+      const board = await boards.create({
+        title: title.trim(),
+        description: description.trim() || undefined,
+      });
+
+      // Navigate to the new board
+      goto(`/boards/${board.id}`);
+    } catch (error) {
+      console.error('Failed to create board:', error);
+      errors.general = error instanceof Error ? error.message : 'Failed to create board';
+    } finally {
+      isSubmitting = false;
+    }
+  }
+
+  function handleCancel() {
+    goto('/boards');
+  }
+</script>
+
+<svelte:head>
+  <title>New Board - Reference Board Viewer</title>
+</svelte:head>
+
+<div class="new-board-page">
+  <div class="page-container">
+    <header class="page-header">
+      <button class="back-btn" on:click={handleCancel} aria-label="Go back">
+        ← Back to Boards
+      </button>
+      <h1>Create New Board</h1>
+    </header>
+
+    {#if errors.general}
+      <div class="error-banner">
+        <span class="error-icon">⚠</span>
+        {errors.general}
+      </div>
+    {/if}
+
+    <form on:submit|preventDefault={handleSubmit} class="board-form">
+      <div class="form-group">
+        <label for="title">Board Title <span class="required">*</span></label>
+        <input
+          id="title"
+          type="text"
+          bind:value={title}
+          disabled={isSubmitting}
+          placeholder="e.g., Character Design References"
+          class:error={errors.title}
+          maxlength="255"
+          required
+          autofocus
+        />
+        {#if errors.title}
+          <span class="error-text">{errors.title}</span>
+        {:else}
+          <span class="help-text">{title.length}/255 characters</span>
+        {/if}
+      </div>
+
+      <div class="form-group">
+        <label for="description">Description (optional)</label>
+        <textarea
+          id="description"
+          bind:value={description}
+          disabled={isSubmitting}
+          placeholder="Add a description to help organize your boards..."
+          rows="4"
+          maxlength="1000"
+          class:error={errors.description}
+        />
+        {#if errors.description}
+          <span class="error-text">{errors.description}</span>
+        {:else}
+          <span class="help-text">{description.length}/1000 characters</span>
+        {/if}
+      </div>
+
+      <div class="form-actions">
+        <button type="button" class="btn-secondary" on:click={handleCancel} disabled={isSubmitting}>
+          Cancel
+        </button>
+        <button type="submit" class="btn-primary" disabled={isSubmitting}>
+          {#if isSubmitting}
+            <span class="spinner"></span>
+            Creating...
+          {:else}
+            Create Board
+          {/if}
+        </button>
+      </div>
+    </form>
+  </div>
+</div>
+
+<style>
+  .new-board-page {
+    min-height: 100vh;
+    background: #f9fafb;
+    padding: 2rem;
+  }
+
+  .page-container {
+    max-width: 600px;
+    margin: 0 auto;
+  }
+
+  .page-header {
+    margin-bottom: 2rem;
+  }
+
+  .back-btn {
+    background: none;
+    border: none;
+    color: #667eea;
+    font-size: 0.95rem;
+    cursor: pointer;
+    padding: 0.5rem 0;
+    margin-bottom: 1rem;
+    display: inline-flex;
+    align-items: center;
+    transition: color 0.2s;
+  }
+
+  .back-btn:hover {
+    color: #764ba2;
+  }
+
+  .page-header h1 {
+    font-size: 2rem;
+    font-weight: 700;
+    color: #1f2937;
+    margin: 0;
+  }
+
+  .error-banner {
+    display: flex;
+    align-items: center;
+    gap: 0.75rem;
+    padding: 1rem;
+    background: #fee2e2;
+    border: 1px solid #fca5a5;
+    border-radius: 8px;
+    color: #991b1b;
+    margin-bottom: 1.5rem;
+  }
+
+  .error-icon {
+    font-size: 1.25rem;
+  }
+
+  .board-form {
+    background: white;
+    border-radius: 12px;
+    padding: 2rem;
+    box-shadow: 0 1px 3px rgba(0, 0, 0, 0.1);
+  }
+
+  .form-group {
+    margin-bottom: 1.5rem;
+  }
+
+  label {
+    display: block;
+    font-weight: 500;
+    color: #374151;
+    margin-bottom: 0.5rem;
+    font-size: 0.95rem;
+  }
+
+  .required {
+    color: #ef4444;
+  }
+
+  input,
+  textarea {
+    width: 100%;
+    padding: 0.75rem;
+    border: 1px solid #d1d5db;
+    border-radius: 8px;
+    font-size: 1rem;
+    font-family: inherit;
+    transition: all 0.2s;
+  }
+
+  input:focus,
+  textarea:focus {
+    outline: none;
+    border-color: #667eea;
+    box-shadow: 0 0 0 3px rgba(102, 126, 234, 0.1);
+  }
+
+  input.error,
+  textarea.error {
+    border-color: #ef4444;
+  }
+
+  input:disabled,
+  textarea:disabled {
+    background-color: #f9fafb;
+    cursor: not-allowed;
+  }
+
+  textarea {
+    resize: vertical;
+    min-height: 100px;
+  }
+
+  .error-text {
+    display: block;
+    color: #ef4444;
+    font-size: 0.875rem;
+    margin-top: 0.25rem;
+  }
+
+  .help-text {
+    display: block;
+    color: #6b7280;
+    font-size: 0.875rem;
+    margin-top: 0.25rem;
+  }
+
+  .form-actions {
+    display: flex;
+    gap: 1rem;
+    justify-content: flex-end;
+    margin-top: 2rem;
+    padding-top: 1.5rem;
+    border-top: 1px solid #e5e7eb;
+  }
+
+  .btn-primary,
+  .btn-secondary {
+    padding: 0.75rem 1.5rem;
+    border-radius: 8px;
+    font-size: 1rem;
+    font-weight: 600;
+    cursor: pointer;
+    transition: all 0.2s;
+    border: none;
+    display: flex;
+    align-items: center;
+    gap: 0.5rem;
+  }
+
+  .btn-primary {
+    background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
+    color: white;
+  }
+
+  .btn-primary:hover:not(:disabled) {
+    transform: translateY(-1px);
+    box-shadow: 0 4px 12px rgba(102, 126, 234, 0.4);
+  }
+
+  .btn-primary:disabled {
+    opacity: 0.6;
+    cursor: not-allowed;
+    transform: none;
+  }
+
+  .btn-secondary {
+    background: white;
+    color: #374151;
+    border: 1px solid #d1d5db;
+  }
+
+  .btn-secondary:hover:not(:disabled) {
+    background: #f9fafb;
+  }
+
+  .spinner {
+    width: 16px;
+    height: 16px;
+    border: 2px solid rgba(255, 255, 255, 0.3);
+    border-top-color: white;
+    border-radius: 50%;
+    animation: spin 0.8s linear infinite;
+  }
+
+  @keyframes spin {
+    to {
+      transform: rotate(360deg);
+    }
+  }
+</style>
+

frontend/tests/components/boards.test.ts

@@ -0,0 +1,536 @@
+/**
+ * Component tests for board components
+ * Tests BoardCard, CreateBoardModal, and DeleteConfirmModal
+ */
+
+import { render, fireEvent, screen, waitFor } from '@testing-library/svelte';
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { goto } from '$app/navigation';
+import BoardCard from '$lib/components/boards/BoardCard.svelte';
+import CreateBoardModal from '$lib/components/boards/CreateBoardModal.svelte';
+import DeleteConfirmModal from '$lib/components/common/DeleteConfirmModal.svelte';
+import type { BoardSummary } from '$lib/types/boards';
+
+// Mock $app/navigation
+vi.mock('$app/navigation', () => ({
+  goto: vi.fn(),
+}));
+
+describe('BoardCard', () => {
+  const mockBoard: BoardSummary = {
+    id: '123e4567-e89b-12d3-a456-426614174000',
+    title: 'Test Board',
+    description: 'Test description',
+    image_count: 5,
+    thumbnail_url: 'https://example.com/thumb.jpg',
+    created_at: '2025-11-01T10:00:00Z',
+    updated_at: '2025-11-02T15:30:00Z',
+  };
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  describe('Rendering', () => {
+    it('renders board title', () => {
+      render(BoardCard, { props: { board: mockBoard } });
+
+      expect(screen.getByText('Test Board')).toBeInTheDocument();
+    });
+
+    it('renders board description', () => {
+      render(BoardCard, { props: { board: mockBoard } });
+
+      expect(screen.getByText('Test description')).toBeInTheDocument();
+    });
+
+    it('renders image count', () => {
+      render(BoardCard, { props: { board: mockBoard } });
+
+      expect(screen.getByText('5 images')).toBeInTheDocument();
+    });
+
+    it('renders singular "image" when count is 1', () => {
+      const singleImageBoard = { ...mockBoard, image_count: 1 };
+      render(BoardCard, { props: { board: singleImageBoard } });
+
+      expect(screen.getByText('1 image')).toBeInTheDocument();
+    });
+
+    it('renders thumbnail image when URL provided', () => {
+      render(BoardCard, { props: { board: mockBoard } });
+
+      const img = screen.getByAltText('Test Board');
+      expect(img).toBeInTheDocument();
+      expect(img).toHaveAttribute('src', 'https://example.com/thumb.jpg');
+    });
+
+    it('renders placeholder when no thumbnail', () => {
+      const noThumbBoard = { ...mockBoard, thumbnail_url: null };
+      render(BoardCard, { props: { board: noThumbBoard } });
+
+      expect(screen.getByText('🖼️')).toBeInTheDocument();
+    });
+
+    it('renders formatted update date', () => {
+      render(BoardCard, { props: { board: mockBoard } });
+
+      // Should show "Updated Nov 2, 2025" or similar
+      expect(screen.getByText(/updated/i)).toBeInTheDocument();
+    });
+
+    it('renders without description when null', () => {
+      const noDescBoard = { ...mockBoard, description: null };
+      render(BoardCard, { props: { board: noDescBoard } });
+
+      expect(screen.queryByText('Test description')).not.toBeInTheDocument();
+    });
+  });
+
+  describe('Interactions', () => {
+    it('navigates to board on click', async () => {
+      render(BoardCard, { props: { board: mockBoard } });
+
+      const card = screen.getByRole('button');
+      await fireEvent.click(card);
+
+      expect(goto).toHaveBeenCalledWith('/boards/123e4567-e89b-12d3-a456-426614174000');
+    });
+
+    it('navigates to board on Enter key', async () => {
+      render(BoardCard, { props: { board: mockBoard } });
+
+      const card = screen.getByRole('button');
+      await fireEvent.keyDown(card, { key: 'Enter' });
+
+      expect(goto).toHaveBeenCalledWith('/boards/123e4567-e89b-12d3-a456-426614174000');
+    });
+
+    it('dispatches delete event when delete button clicked', async () => {
+      const { component } = render(BoardCard, { props: { board: mockBoard } });
+
+      const deleteHandler = vi.fn();
+      component.$on('delete', deleteHandler);
+
+      const deleteBtn = screen.getByLabelText('Delete board');
+      await fireEvent.click(deleteBtn);
+
+      expect(deleteHandler).toHaveBeenCalledTimes(1);
+    });
+
+    it('delete button click stops propagation', async () => {
+      render(BoardCard, { props: { board: mockBoard } });
+
+      const deleteBtn = screen.getByLabelText('Delete board');
+      await fireEvent.click(deleteBtn);
+
+      // Card click should not have been triggered (goto should not be called)
+      expect(goto).not.toHaveBeenCalled();
+    });
+
+    it('has proper accessibility attributes', () => {
+      render(BoardCard, { props: { board: mockBoard } });
+
+      const card = screen.getByRole('button');
+      expect(card).toHaveAttribute('tabindex', '0');
+    });
+  });
+});
+
+describe('CreateBoardModal', () => {
+  describe('Rendering', () => {
+    it('renders modal with title', () => {
+      render(CreateBoardModal);
+
+      expect(screen.getByText('Create New Board')).toBeInTheDocument();
+    });
+
+    it('renders all form fields', () => {
+      render(CreateBoardModal);
+
+      expect(screen.getByLabelText(/board title/i)).toBeInTheDocument();
+      expect(screen.getByLabelText(/description/i)).toBeInTheDocument();
+    });
+
+    it('renders create and cancel buttons', () => {
+      render(CreateBoardModal);
+
+      expect(screen.getByRole('button', { name: /create board/i })).toBeInTheDocument();
+      expect(screen.getByRole('button', { name: /cancel/i })).toBeInTheDocument();
+    });
+
+    it('populates initial values when provided', () => {
+      render(CreateBoardModal, {
+        props: { initialTitle: 'My Board', initialDescription: 'My Description' },
+      });
+
+      const titleInput = screen.getByLabelText(/board title/i) as HTMLInputElement;
+      const descInput = screen.getByLabelText(/description/i) as HTMLTextAreaElement;
+
+      expect(titleInput.value).toBe('My Board');
+      expect(descInput.value).toBe('My Description');
+    });
+  });
+
+  describe('Validation', () => {
+    it('shows error when title is empty', async () => {
+      render(CreateBoardModal);
+
+      const submitBtn = screen.getByRole('button', { name: /create board/i });
+      await fireEvent.click(submitBtn);
+
+      expect(await screen.findByText(/title is required/i)).toBeInTheDocument();
+    });
+
+    it('shows error when title is too long', async () => {
+      render(CreateBoardModal);
+
+      const titleInput = screen.getByLabelText(/board title/i);
+      await fireEvent.input(titleInput, { target: { value: 'a'.repeat(256) } });
+
+      const submitBtn = screen.getByRole('button', { name: /create board/i });
+      await fireEvent.click(submitBtn);
+
+      expect(await screen.findByText(/255 characters or less/i)).toBeInTheDocument();
+    });
+
+    it('shows error when description is too long', async () => {
+      render(CreateBoardModal);
+
+      const titleInput = screen.getByLabelText(/board title/i);
+      await fireEvent.input(titleInput, { target: { value: 'Valid Title' } });
+
+      const descInput = screen.getByLabelText(/description/i);
+      await fireEvent.input(descInput, { target: { value: 'a'.repeat(1001) } });
+
+      const submitBtn = screen.getByRole('button', { name: /create board/i });
+      await fireEvent.click(submitBtn);
+
+      expect(await screen.findByText(/1000 characters or less/i)).toBeInTheDocument();
+    });
+
+    it('accepts valid input', async () => {
+      const { component } = render(CreateBoardModal);
+
+      const createHandler = vi.fn();
+      component.$on('create', createHandler);
+
+      const titleInput = screen.getByLabelText(/board title/i);
+      await fireEvent.input(titleInput, { target: { value: 'Valid Board Title' } });
+
+      const descInput = screen.getByLabelText(/description/i);
+      await fireEvent.input(descInput, { target: { value: 'Valid description' } });
+
+      const submitBtn = screen.getByRole('button', { name: /create board/i });
+      await fireEvent.click(submitBtn);
+
+      expect(createHandler).toHaveBeenCalledTimes(1);
+    });
+
+    it('shows character count for title', async () => {
+      render(CreateBoardModal);
+
+      const titleInput = screen.getByLabelText(/board title/i);
+      await fireEvent.input(titleInput, { target: { value: 'Test' } });
+
+      expect(screen.getByText(/4\/255 characters/i)).toBeInTheDocument();
+    });
+
+    it('shows character count for description', async () => {
+      render(CreateBoardModal);
+
+      const descInput = screen.getByLabelText(/description/i);
+      await fireEvent.input(descInput, { target: { value: 'Testing' } });
+
+      expect(screen.getByText(/7\/1000 characters/i)).toBeInTheDocument();
+    });
+  });
+
+  describe('Submission', () => {
+    it('dispatches create event with correct data', async () => {
+      const { component } = render(CreateBoardModal);
+
+      const createHandler = vi.fn();
+      component.$on('create', createHandler);
+
+      const titleInput = screen.getByLabelText(/board title/i);
+      await fireEvent.input(titleInput, { target: { value: 'My Board' } });
+
+      const descInput = screen.getByLabelText(/description/i);
+      await fireEvent.input(descInput, { target: { value: 'My Description' } });
+
+      const submitBtn = screen.getByRole('button', { name: /create board/i });
+      await fireEvent.click(submitBtn);
+
+      await waitFor(() => {
+        expect(createHandler).toHaveBeenCalledTimes(1);
+      });
+
+      const event = createHandler.mock.calls[0][0];
+      expect(event.detail).toEqual({
+        title: 'My Board',
+        description: 'My Description',
+      });
+    });
+
+    it('omits description when empty', async () => {
+      const { component } = render(CreateBoardModal);
+
+      const createHandler = vi.fn();
+      component.$on('create', createHandler);
+
+      const titleInput = screen.getByLabelText(/board title/i);
+      await fireEvent.input(titleInput, { target: { value: 'My Board' } });
+
+      const submitBtn = screen.getByRole('button', { name: /create board/i });
+      await fireEvent.click(submitBtn);
+
+      await waitFor(() => {
+        expect(createHandler).toHaveBeenCalled();
+      });
+
+      const event = createHandler.mock.calls[0][0];
+      expect(event.detail.description).toBeUndefined();
+    });
+
+    it('trims whitespace from inputs', async () => {
+      const { component } = render(CreateBoardModal);
+
+      const createHandler = vi.fn();
+      component.$on('create', createHandler);
+
+      const titleInput = screen.getByLabelText(/board title/i);
+      await fireEvent.input(titleInput, { target: { value: '  My Board  ' } });
+
+      const descInput = screen.getByLabelText(/description/i);
+      await fireEvent.input(descInput, { target: { value: '  My Description  ' } });
+
+      const submitBtn = screen.getByRole('button', { name: /create board/i });
+      await fireEvent.click(submitBtn);
+
+      await waitFor(() => {
+        expect(createHandler).toHaveBeenCalled();
+      });
+
+      const event = createHandler.mock.calls[0][0];
+      expect(event.detail.title).toBe('My Board');
+      expect(event.detail.description).toBe('My Description');
+    });
+  });
+
+  describe('Modal Behavior', () => {
+    it('dispatches close event when cancel clicked', async () => {
+      const { component } = render(CreateBoardModal);
+
+      const closeHandler = vi.fn();
+      component.$on('close', closeHandler);
+
+      const cancelBtn = screen.getByRole('button', { name: /cancel/i });
+      await fireEvent.click(cancelBtn);
+
+      expect(closeHandler).toHaveBeenCalledTimes(1);
+    });
+
+    it('dispatches close event when X button clicked', async () => {
+      const { component } = render(CreateBoardModal);
+
+      const closeHandler = vi.fn();
+      component.$on('close', closeHandler);
+
+      const closeBtn = screen.getByLabelText(/close/i);
+      await fireEvent.click(closeBtn);
+
+      expect(closeHandler).toHaveBeenCalledTimes(1);
+    });
+
+    it('dispatches close event when backdrop clicked', async () => {
+      const { component } = render(CreateBoardModal);
+
+      const closeHandler = vi.fn();
+      component.$on('close', closeHandler);
+
+      const backdrop = screen.getByRole('dialog');
+      await fireEvent.click(backdrop);
+
+      expect(closeHandler).toHaveBeenCalledTimes(1);
+    });
+
+    it('does not close when modal content clicked', async () => {
+      const { component } = render(CreateBoardModal);
+
+      const closeHandler = vi.fn();
+      component.$on('close', closeHandler);
+
+      const modalContent = screen.getByText('Create New Board').closest('.modal-content');
+      if (modalContent) {
+        await fireEvent.click(modalContent);
+      }
+
+      expect(closeHandler).not.toHaveBeenCalled();
+    });
+  });
+});
+
+describe('DeleteConfirmModal', () => {
+  const defaultProps = {
+    title: 'Delete Item',
+    message: 'Are you sure?',
+    itemName: 'Test Item',
+  };
+
+  describe('Rendering', () => {
+    it('renders with provided title', () => {
+      render(DeleteConfirmModal, { props: defaultProps });
+
+      expect(screen.getByText('Delete Item')).toBeInTheDocument();
+    });
+
+    it('renders with provided message', () => {
+      render(DeleteConfirmModal, { props: defaultProps });
+
+      expect(screen.getByText('Are you sure?')).toBeInTheDocument();
+    });
+
+    it('renders item name when provided', () => {
+      render(DeleteConfirmModal, { props: defaultProps });
+
+      expect(screen.getByText('Test Item')).toBeInTheDocument();
+    });
+
+    it('renders without item name when not provided', () => {
+      const props = { ...defaultProps, itemName: '' };
+      render(DeleteConfirmModal, { props });
+
+      expect(screen.queryByRole('strong')).not.toBeInTheDocument();
+    });
+
+    it('renders destructive warning icon by default', () => {
+      render(DeleteConfirmModal, { props: defaultProps });
+
+      expect(screen.getByText('⚠️')).toBeInTheDocument();
+    });
+
+    it('renders info icon when not destructive', () => {
+      const props = { ...defaultProps, isDestructive: false };
+      render(DeleteConfirmModal, { props });
+
+      expect(screen.getByText('ℹ️')).toBeInTheDocument();
+    });
+
+    it('renders custom button text', () => {
+      const props = {
+        ...defaultProps,
+        confirmText: 'Remove',
+        cancelText: 'Keep',
+      };
+      render(DeleteConfirmModal, { props });
+
+      expect(screen.getByRole('button', { name: /remove/i })).toBeInTheDocument();
+      expect(screen.getByRole('button', { name: /keep/i })).toBeInTheDocument();
+    });
+  });
+
+  describe('Interactions', () => {
+    it('dispatches confirm event when confirm button clicked', async () => {
+      const { component } = render(DeleteConfirmModal, { props: defaultProps });
+
+      const confirmHandler = vi.fn();
+      component.$on('confirm', confirmHandler);
+
+      const confirmBtn = screen.getByRole('button', { name: /delete/i });
+      await fireEvent.click(confirmBtn);
+
+      expect(confirmHandler).toHaveBeenCalledTimes(1);
+    });
+
+    it('dispatches cancel event when cancel button clicked', async () => {
+      const { component } = render(DeleteConfirmModal, { props: defaultProps });
+
+      const cancelHandler = vi.fn();
+      component.$on('cancel', cancelHandler);
+
+      const cancelBtn = screen.getByRole('button', { name: /cancel/i });
+      await fireEvent.click(cancelBtn);
+
+      expect(cancelHandler).toHaveBeenCalledTimes(1);
+    });
+
+    it('dispatches cancel when backdrop clicked', async () => {
+      const { component } = render(DeleteConfirmModal, { props: defaultProps });
+
+      const cancelHandler = vi.fn();
+      component.$on('cancel', cancelHandler);
+
+      const backdrop = screen.getByRole('dialog');
+      await fireEvent.click(backdrop);
+
+      expect(cancelHandler).toHaveBeenCalledTimes(1);
+    });
+
+    it('disables buttons when processing', () => {
+      const props = { ...defaultProps, isProcessing: true };
+      render(DeleteConfirmModal, { props });
+
+      const confirmBtn = screen.getByRole('button', { name: /processing/i });
+      const cancelBtn = screen.getByRole('button', { name: /cancel/i });
+
+      expect(confirmBtn).toBeDisabled();
+      expect(cancelBtn).toBeDisabled();
+    });
+
+    it('shows processing state on confirm button', () => {
+      const props = { ...defaultProps, isProcessing: true };
+      render(DeleteConfirmModal, { props });
+
+      expect(screen.getByText(/processing/i)).toBeInTheDocument();
+    });
+
+    it('does not close on backdrop click when processing', async () => {
+      const props = { ...defaultProps, isProcessing: true };
+      const { component } = render(DeleteConfirmModal, { props });
+
+      const cancelHandler = vi.fn();
+      component.$on('cancel', cancelHandler);
+
+      const backdrop = screen.getByRole('dialog');
+      await fireEvent.click(backdrop);
+
+      expect(cancelHandler).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('Styling', () => {
+    it('applies destructive styling to confirm button when isDestructive', () => {
+      render(DeleteConfirmModal, { props: defaultProps });
+
+      const confirmBtn = screen.getByRole('button', { name: /delete/i });
+      expect(confirmBtn).toHaveClass('destructive');
+    });
+
+    it('does not apply destructive styling when not destructive', () => {
+      const props = { ...defaultProps, isDestructive: false };
+      render(DeleteConfirmModal, { props });
+
+      const confirmBtn = screen.getByRole('button', { name: /delete/i });
+      expect(confirmBtn).not.toHaveClass('destructive');
+    });
+  });
+
+  describe('Accessibility', () => {
+    it('has proper ARIA attributes', () => {
+      render(DeleteConfirmModal, { props: defaultProps });
+
+      const dialog = screen.getByRole('dialog');
+      expect(dialog).toHaveAttribute('aria-modal', 'true');
+      expect(dialog).toHaveAttribute('aria-labelledby', 'modal-title');
+    });
+
+    it('modal title has correct ID for aria-labelledby', () => {
+      render(DeleteConfirmModal, { props: defaultProps });
+
+      const title = screen.getByText('Delete Item');
+      expect(title).toHaveAttribute('id', 'modal-title');
+    });
+  });
+});
+

specs/001-reference-board-viewer/tasks.md

@@ -133,16 +133,16 @@ Implementation tasks for the Reference Board Viewer, organized by user story (fu
 
 ---
 
-## Phase 4: Board Management (FR2 - Critical) (Week 3)
+## Phase 4: Board Management (FR2 - Critical) (Week 3) ✅ COMPLETE
 
 **User Story:** Users must be able to create, save, edit, delete, and organize multiple reference boards
 
 **Independent Test Criteria:**
-- [ ] Users can create boards with title
+- [X] Users can create boards with title
-- [ ] Users can list all their boards
+- [X] Users can list all their boards
-- [ ] Users can update board metadata
+- [X] Users can update board metadata
-- [ ] Users can delete boards with confirmation
+- [X] Users can delete boards with confirmation
-- [ ] Board operations enforce ownership
+- [X] Board operations enforce ownership
 
 **Backend Tasks:**
 
@@ -155,20 +155,20 @@ Implementation tasks for the Reference Board Viewer, organized by user story (fu
 - [X] T062 [US2] Implement update board endpoint PATCH /boards/{id} in backend/app/api/boards.py
 - [X] T063 [US2] Implement delete board endpoint DELETE /boards/{id} in backend/app/api/boards.py
 - [X] T064 [US2] Add ownership validation middleware in backend/app/boards/permissions.py
-- [ ] T065 [P] [US2] Write unit tests for board repository in backend/tests/boards/test_repository.py
+- [X] T065 [P] [US2] Write unit tests for board repository in backend/tests/boards/test_repository.py
-- [ ] T066 [P] [US2] Write integration tests for board endpoints in backend/tests/api/test_boards.py
+- [X] T066 [P] [US2] Write integration tests for board endpoints in backend/tests/api/test_boards.py
 
 **Frontend Tasks:**
 
-- [ ] T067 [P] [US2] Create boards API client in frontend/src/lib/api/boards.ts
+- [X] T067 [P] [US2] Create boards API client in frontend/src/lib/api/boards.ts
-- [ ] T068 [P] [US2] Create boards store in frontend/src/lib/stores/boards.ts
+- [X] T068 [P] [US2] Create boards store in frontend/src/lib/stores/boards.ts
-- [ ] T069 [US2] Create board list page in frontend/src/routes/boards/+page.svelte
+- [X] T069 [US2] Create board list page in frontend/src/routes/boards/+page.svelte
-- [ ] T070 [US2] Create new board page in frontend/src/routes/boards/new/+page.svelte
+- [X] T070 [US2] Create new board page in frontend/src/routes/boards/new/+page.svelte
-- [ ] T071 [US2] Create board edit page in frontend/src/routes/boards/[id]/edit/+page.svelte
+- [X] T071 [US2] Create board edit page in frontend/src/routes/boards/[id]/edit/+page.svelte
-- [ ] T072 [P] [US2] Create BoardCard component in frontend/src/lib/components/boards/BoardCard.svelte
+- [X] T072 [P] [US2] Create BoardCard component in frontend/src/lib/components/boards/BoardCard.svelte
-- [ ] T073 [P] [US2] Create CreateBoardModal component in frontend/src/lib/components/boards/CreateBoardModal.svelte
+- [X] T073 [P] [US2] Create CreateBoardModal component in frontend/src/lib/components/boards/CreateBoardModal.svelte
-- [ ] T074 [P] [US2] Create DeleteConfirmModal component in frontend/src/lib/components/common/DeleteConfirmModal.svelte
+- [X] T074 [P] [US2] Create DeleteConfirmModal component in frontend/src/lib/components/common/DeleteConfirmModal.svelte
-- [ ] T075 [P] [US2] Write component tests for board components in frontend/tests/components/boards.test.ts
+- [X] T075 [P] [US2] Write component tests for board components in frontend/tests/components/boards.test.ts
 
 **Deliverables:**
 - Complete board CRUD