From 06b81f0b2a833a90a9781b6a172baca4ba78314b Mon Sep 17 00:00:00 2001 From: jableader Date: Sat, 1 Nov 2025 17:41:09 +1100 Subject: [PATCH] Spec updates, remove email requirement --- backend-spec.md | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/backend-spec.md b/backend-spec.md index 42c97c8..671d3a5 100644 --- a/backend-spec.md +++ b/backend-spec.md @@ -277,13 +277,21 @@ Status summary: - Security: Password hashing now prefers Argon2 for new accounts with PBKDF2 verification fallback. - New: Household members listing `GET /api/v1/households/{householdSlug}/members` returning [{ id, displayName, role }]. - Preserved: camelCase responses, `Page` semantics, `Location` headers on create, shopping storeName normalization ("home"). + - Codebase cleanup: v2 routers are inlined as canonical modules; legacy `*_v2.py` files removed. v1 cookie auth and routers are not mounted. + - Current v2 recipes shape: `createdBy`/`hiddenBy` are currently omitted from outward Recipe responses; they will be reintroduced (as MemberRef) once persons are fully retired. Remaining work (prioritized cleanup to final state): -1. Remove the `persons/` package and all code references. Replace Person usages in domain models/services with `users`/household members. This includes any remaining dependencies in `api/recipes.py` and services still typed with `persons.Person`. -2. Recipes outward schema: replace `createdBy`/`hiddenBy` Person references with a `MemberRef`-style DTO (user/member) to fully eliminate Person from API responses. -3. Delete or port legacy v1 test modules that are currently skipped (`tests/test_main.py`, `tests/test_v1.py`). Either migrate assertions to v2 routes or remove them so the full test run has no skips. -4. Invitations: integrate an email delivery provider and track send status/expiry enforcement; add tests. -5. Database polish: add composite indices like `(household_id, id)` for pagination; consider adding explicit FK constraints from tenant tables to `Household(id)` where safe. +1. Remove the `persons/` package and all code references across domains (recipes, meals, shopping). Replace `Person` with `users`/HouseholdMember everywhere: + - Code hotspots today: `recipes/models.py` (imports Person), `recipes/repository.py` (FKs, hide_recipe signature), `meals/models.py` (participants as List[Person]), `api/shopping_models.py` and `shopping/models.py` (ShoppingList.purchased_by typed as Person), and `shopping/repository.py` (FKs to Person). + - Replace internal usages with `user_id`/`MemberRef` where outward, and update repository DDL to stop referencing `Person`. + - Remove `api.deps.cookie_person` once no tests or code depend on it. +2. Recipes outward schema: add `createdBy`/`hiddenBy` back as `MemberRef`-style DTOs (user/member) so the API exposes user info without `Person`. Populate from the authenticated user and (when hiding) the acting member; keep fields optional. +3. Shopping outward DTOs: change `ShoppingListOut.purchasedBy` from `Person` to `MemberRef` and adjust mapping code in `api/shopping_models.py`; ensure OpenAPI reflects the new shape. Consider exposing only `purchasedById` initially if membership lookup isn’t available. +4. Delete or port legacy v1 test modules that are currently skipped (`tests/test_main.py`, `tests/test_v1.py`). Either migrate assertions to v2 routes or remove them so the full test run has no skips. Then remove the last vestiges of v1-only helpers. +5. Database polish: + - Add composite indices like `(household_id, id)` where pagination benefits (e.g., Recipe, Meal, ShoppingListItem). + - Add explicit FK constraints from tenant tables to `Household(id)` where safe. + - Ensure fresh bootstraps include `household_id` in table DDL (e.g., `recipes.repository.create`), not just via migration. ---