diff --git a/backend-spec.md b/backend-spec.md index 8b259e6..af8b0bd 100644 --- a/backend-spec.md +++ b/backend-spec.md @@ -3,6 +3,9 @@ - POST `/api/v1/households/{householdSlug}/meals/{mealId}/consumed` marks a meal consumed within the household; validates timezone on provided `consumedDate`; clears outstanding meal requests only within that household. - POST `/api/v1/households/{householdSlug}/shopping/current/meals/me` requests a meal under the household scope; visible only within that household in GET current. - DELETE `/api/v1/households/{householdSlug}/shopping/current/meals/{mealId}` unrequests the meal (scoped) and returns `{ ok: true }`. + - POST `/api/v1/households/{householdSlug}/shopping/current/ingredients` requests an ad‑hoc ingredient scoped to household+user; duplicates deduped per user per household. + - DELETE `/api/v1/households/{householdSlug}/shopping/current/ingredients` removes an ad‑hoc ingredient request for the current user in this household; idempotent. + - POST `/api/v1/households/{householdSlug}/recipes/parse-from-url` returns structured JSON‑LD recipe data for a URL (stateless; household auth enforced). - Comprehensive v2 coverage exists for scoping, purchases, request/unrequest, meals CRUD/consumed, and OpenAPI security. PASS. # Backend Specification: Household Multi-Tenancy (v2) @@ -39,7 +42,7 @@ Special-case 401: Removed. v1 cookie-based auth and routes have been retired in - Recipes (`api/recipes.py`) - GET `/api/v1/recipes` → `Page`; loads ingredients per page. - GET `/api/v1/recipes/{id}` → full recipe (ingredients + createdBy). - - GET `/api/v1/recipes/parse?url=...` (auth required) → scrape/parse a recipe; 400 if not found. + - POST `/api/v1/households/{householdSlug}/recipes/parse-from-url` (auth required) → scrape/parse a recipe URL; 404 if not found. - GET `/api/v1/recipes/ingredients/parse?ingredients=...&ingredients=...` → parse raw ingredient lines (no auth); matches existing products. - POST `/api/v1/recipes` (auth required) → validate (≥1 ingredient), perform versioning (hide base if id≥0), set createdById, insert ingredients; sets `Location` header. - DELETE `/api/v1/recipes/{id}` (auth required) → soft-delete (hide) recipe. @@ -165,6 +168,7 @@ Household-scoped routes (implemented): Shopping requests parity (preserved in v2): - Request meal: `POST /api/v1/households/{householdSlug}/shopping/current/meals/me` (scoped) and unrequest `DELETE /current/meals/{mealId}`. - Request individual ingredient: `POST /api/v1/households/{householdSlug}/shopping/current/ingredients` (scoped). Response is `ListIngredientItem`; item appears in `GET /current` under `outstandingItems`. Household isolation enforced. Duplicate requests for the same ingredient by the same user within the same household return the existing request (no duplicate rows). Covered by `tests/test_shopping_request_ingredient_dedupe_v2.py`. + - Unrequest individual ingredient: `DELETE /api/v1/households/{householdSlug}/shopping/current/ingredients` (scoped). Body `{ ingredientId }`. Returns `{ ok: true }` even if nothing was deleted. Repositories accept `household_id` and filter by it across `meals`, `recipes`, and `shopping` domains. diff --git a/tests/test_recipes_parse_from_url_v2.py b/tests/test_recipes_parse_from_url_v2.py new file mode 100644 index 0000000..7b6bf66 --- /dev/null +++ b/tests/test_recipes_parse_from_url_v2.py @@ -0,0 +1,80 @@ +import unittest +from fastapi.testclient import TestClient + +import main +from db import connect, create +from scripts.migration_to_households import run_migration + + +class TestRecipesParseFromUrlV2(unittest.IsolatedAsyncioTestCase): + async def asyncSetUp(self): + self.conn = await connect(":memory:") + await create(self.conn) + await run_migration(self.conn) + + async def override_get_db(): + try: + yield self.conn + finally: + pass + + main.app.dependency_overrides[main.get_db] = override_get_db + self.client = TestClient(main.app) + + # Register user and create household + r = self.client.post( + "/api/v1/auth/register", + json={"email": "parse@test.com", "password": "pw", "displayName": "Parse"}, + ) + assert r.status_code == 200, r.text + token = r.json()["accessToken"] + self.headers = {"Authorization": f"Bearer {token}"} + + r = self.client.post("/api/v1/households", headers=self.headers, json={"name": "H"}) + assert r.status_code == 200, r.text + self.slug = r.json()["slug"] + + async def asyncTearDown(self): + await self.conn.close() + main.app.dependency_overrides.clear() + + def test_parse_from_url_success_and_not_found(self): + # Monkeypatch scraper to avoid network + import recipes.scraping as scraping + + async def fake_scrape(url: str): + assert url == "https://example.com/recipe" + return {"@type": "Recipe", "name": "Example"} + + async def fake_scrape_none(url: str): + return None + + # Success case + orig = scraping.scrape_recipe_ldata + scraping.scrape_recipe_ldata = fake_scrape + try: + r = self.client.post( + f"/api/v1/households/{self.slug}/recipes/parse-from-url", + headers=self.headers, + json={"url": "https://example.com/recipe"}, + ) + assert r.status_code == 200, r.text + body = r.json() + assert body.get("@type") == "Recipe" + assert body.get("name") == "Example" + finally: + scraping.scrape_recipe_ldata = orig + + # Not found case + scraping.scrape_recipe_ldata = fake_scrape_none + try: + r2 = self.client.post( + f"/api/v1/households/{self.slug}/recipes/parse-from-url", + headers=self.headers, + json={"url": "https://example.com/missing"}, + ) + assert r2.status_code == 404, r2.text + pb = r2.json() + assert pb.get("status") == 404 + finally: + scraping.scrape_recipe_ldata = orig diff --git a/tests/test_shopping_unrequest_ingredient_v2.py b/tests/test_shopping_unrequest_ingredient_v2.py new file mode 100644 index 0000000..8a09a55 --- /dev/null +++ b/tests/test_shopping_unrequest_ingredient_v2.py @@ -0,0 +1,119 @@ +import unittest +from fastapi.testclient import TestClient + +import main +from db import connect, create +from scripts.migration_to_households import run_migration + + +class TestShoppingUnrequestIngredientV2(unittest.IsolatedAsyncioTestCase): + async def asyncSetUp(self): + self.conn = await connect(":memory:") + await create(self.conn) + await run_migration(self.conn) + + async def override_get_db(): + try: + yield self.conn + finally: + pass + + main.app.dependency_overrides[main.get_db] = override_get_db + self.client = TestClient(main.app) + + # Register user and create two households + r = self.client.post( + "/api/v1/auth/register", + json={"email": "unreq@test.com", "password": "pw", "displayName": "UnReq"}, + ) + assert r.status_code == 200, r.text + token = r.json()["accessToken"] + self.headers = {"Authorization": f"Bearer {token}"} + + r = self.client.post("/api/v1/households", headers=self.headers, json={"name": "H1"}) + assert r.status_code == 200, r.text + self.h1 = r.json()["slug"] + r = self.client.post("/api/v1/households", headers=self.headers, json={"name": "H2"}) + assert r.status_code == 200, r.text + self.h2 = r.json()["slug"] + + # Resolve household ids + async with self.conn.execute("SELECT id FROM Household WHERE slug = ?", (self.h1,)) as c: + row = await c.fetchone() + assert row is not None + self.h1_id = int(row[0]) + async with self.conn.execute("SELECT id FROM Household WHERE slug = ?", (self.h2,)) as c: + row = await c.fetchone() + assert row is not None + self.h2_id = int(row[0]) + + # Seed one ingredient in both households + await self.conn.execute( + "INSERT INTO Ingredient (name, line, unit, quantity, recipe_id, meal_id, household_id) VALUES ('Milk', '1L milk', 'L', 1, NULL, NULL, ?)", + (self.h1_id,), + ) + async with self.conn.execute("SELECT last_insert_rowid()") as c: + row = await c.fetchone() + assert row is not None + self.milk_h1_id = int(row[0]) + await self.conn.execute( + "INSERT INTO Ingredient (name, line, unit, quantity, recipe_id, meal_id, household_id) VALUES ('Milk', '1L milk', 'L', 1, NULL, NULL, ?)", + (self.h2_id,), + ) + async with self.conn.execute("SELECT last_insert_rowid()") as c: + row = await c.fetchone() + assert row is not None + self.milk_h2_id = int(row[0]) + await self.conn.commit() + + async def asyncTearDown(self): + await self.conn.close() + main.app.dependency_overrides.clear() + + def test_unrequest_ingredient_idempotent_and_scoped(self): + # Request ingredient in H1 + r = self.client.post( + f"/api/v1/households/{self.h1}/shopping/current/ingredients", + headers=self.headers, + json={"ingredientId": self.milk_h1_id}, + ) + assert r.status_code == 200, r.text + + # Ensure it shows up in H1 current + cur = self.client.get( + f"/api/v1/households/{self.h1}/shopping/current", headers=self.headers + ).json() + assert any(i.get("ingredientId") == self.milk_h1_id for i in cur["outstandingItems"]) + + # Delete it via new endpoint + d = self.client.request( + "DELETE", + f"/api/v1/households/{self.h1}/shopping/current/ingredients", + headers=self.headers, + json={"ingredientId": self.milk_h1_id}, + ) + assert d.status_code == 200, d.text + assert d.json()["ok"] is True + + # It disappears from H1 current + cur = self.client.get( + f"/api/v1/households/{self.h1}/shopping/current", headers=self.headers + ).json() + assert not any(i.get("ingredientId") == self.milk_h1_id for i in cur["outstandingItems"]) + + # Idempotent: delete again + d2 = self.client.request( + "DELETE", + f"/api/v1/households/{self.h1}/shopping/current/ingredients", + headers=self.headers, + json={"ingredientId": self.milk_h1_id}, + ) + assert d2.status_code == 200, d2.text + assert d2.json()["ok"] is True + + # Ensure H2 unaffected + cur2 = self.client.get( + f"/api/v1/households/{self.h2}/shopping/current", headers=self.headers + ).json() + # No request in H2, so still absent + assert not any(i.get("ingredientId") == self.milk_h2_id for i in cur2["outstandingItems"])