Add tests for scoped DELETE current ingredient and recipes parse-from-url

backend-spec.md

@@ -3,6 +3,9 @@
   - POST `/api/v1/households/{householdSlug}/meals/{mealId}/consumed` marks a meal consumed within the household; validates timezone on provided `consumedDate`; clears outstanding meal requests only within that household.
   - POST `/api/v1/households/{householdSlug}/shopping/current/meals/me` requests a meal under the household scope; visible only within that household in GET current.
   - DELETE `/api/v1/households/{householdSlug}/shopping/current/meals/{mealId}` unrequests the meal (scoped) and returns `{ ok: true }`.
+  - POST `/api/v1/households/{householdSlug}/shopping/current/ingredients` requests an ad‑hoc ingredient scoped to household+user; duplicates deduped per user per household.
+  - DELETE `/api/v1/households/{householdSlug}/shopping/current/ingredients` removes an ad‑hoc ingredient request for the current user in this household; idempotent.
+  - POST `/api/v1/households/{householdSlug}/recipes/parse-from-url` returns structured JSON‑LD recipe data for a URL (stateless; household auth enforced).
   - Comprehensive v2 coverage exists for scoping, purchases, request/unrequest, meals CRUD/consumed, and OpenAPI security. PASS.
 # Backend Specification: Household Multi-Tenancy (v2)
 
@@ -39,7 +42,7 @@ Special-case 401: Removed. v1 cookie-based auth and routes have been retired in
   - Recipes (`api/recipes.py`)
   - GET `/api/v1/recipes` → `Page<Recipe>`; loads ingredients per page.
   - GET `/api/v1/recipes/{id}` → full recipe (ingredients + createdBy).
-  - GET `/api/v1/recipes/parse?url=...` (auth required) → scrape/parse a recipe; 400 if not found.
+  - POST `/api/v1/households/{householdSlug}/recipes/parse-from-url` (auth required) → scrape/parse a recipe URL; 404 if not found.
   - GET `/api/v1/recipes/ingredients/parse?ingredients=...&ingredients=...` → parse raw ingredient lines (no auth); matches existing products.
   - POST `/api/v1/recipes` (auth required) → validate (≥1 ingredient), perform versioning (hide base if id≥0), set createdById, insert ingredients; sets `Location` header.
   - DELETE `/api/v1/recipes/{id}` (auth required) → soft-delete (hide) recipe.
@@ -165,6 +168,7 @@ Household-scoped routes (implemented):
 Shopping requests parity (preserved in v2):
 - Request meal: `POST /api/v1/households/{householdSlug}/shopping/current/meals/me` (scoped) and unrequest `DELETE /current/meals/{mealId}`.
 - Request individual ingredient: `POST /api/v1/households/{householdSlug}/shopping/current/ingredients` (scoped). Response is `ListIngredientItem`; item appears in `GET /current` under `outstandingItems`. Household isolation enforced. Duplicate requests for the same ingredient by the same user within the same household return the existing request (no duplicate rows). Covered by `tests/test_shopping_request_ingredient_dedupe_v2.py`.
+ - Unrequest individual ingredient: `DELETE /api/v1/households/{householdSlug}/shopping/current/ingredients` (scoped). Body `{ ingredientId }`. Returns `{ ok: true }` even if nothing was deleted.
 
 Repositories accept `household_id` and filter by it across `meals`, `recipes`, and `shopping` domains.
 

tests/test_recipes_parse_from_url_v2.py

@@ -0,0 +1,80 @@
+import unittest
+from fastapi.testclient import TestClient
+
+import main
+from db import connect, create
+from scripts.migration_to_households import run_migration
+
+
+class TestRecipesParseFromUrlV2(unittest.IsolatedAsyncioTestCase):
+    async def asyncSetUp(self):
+        self.conn = await connect(":memory:")
+        await create(self.conn)
+        await run_migration(self.conn)
+
+        async def override_get_db():
+            try:
+                yield self.conn
+            finally:
+                pass
+
+        main.app.dependency_overrides[main.get_db] = override_get_db
+        self.client = TestClient(main.app)
+
+        # Register user and create household
+        r = self.client.post(
+            "/api/v1/auth/register",
+            json={"email": "parse@test.com", "password": "pw", "displayName": "Parse"},
+        )
+        assert r.status_code == 200, r.text
+        token = r.json()["accessToken"]
+        self.headers = {"Authorization": f"Bearer {token}"}
+
+        r = self.client.post("/api/v1/households", headers=self.headers, json={"name": "H"})
+        assert r.status_code == 200, r.text
+        self.slug = r.json()["slug"]
+
+    async def asyncTearDown(self):
+        await self.conn.close()
+        main.app.dependency_overrides.clear()
+
+    def test_parse_from_url_success_and_not_found(self):
+        # Monkeypatch scraper to avoid network
+        import recipes.scraping as scraping
+
+        async def fake_scrape(url: str):
+            assert url == "https://example.com/recipe"
+            return {"@type": "Recipe", "name": "Example"}
+
+        async def fake_scrape_none(url: str):
+            return None
+
+        # Success case
+        orig = scraping.scrape_recipe_ldata
+        scraping.scrape_recipe_ldata = fake_scrape
+        try:
+            r = self.client.post(
+                f"/api/v1/households/{self.slug}/recipes/parse-from-url",
+                headers=self.headers,
+                json={"url": "https://example.com/recipe"},
+            )
+            assert r.status_code == 200, r.text
+            body = r.json()
+            assert body.get("@type") == "Recipe"
+            assert body.get("name") == "Example"
+        finally:
+            scraping.scrape_recipe_ldata = orig
+
+        # Not found case
+        scraping.scrape_recipe_ldata = fake_scrape_none
+        try:
+            r2 = self.client.post(
+                f"/api/v1/households/{self.slug}/recipes/parse-from-url",
+                headers=self.headers,
+                json={"url": "https://example.com/missing"},
+            )
+            assert r2.status_code == 404, r2.text
+            pb = r2.json()
+            assert pb.get("status") == 404
+        finally:
+            scraping.scrape_recipe_ldata = orig

tests/test_shopping_unrequest_ingredient_v2.py

@@ -0,0 +1,119 @@
+import unittest
+from fastapi.testclient import TestClient
+
+import main
+from db import connect, create
+from scripts.migration_to_households import run_migration
+
+
+class TestShoppingUnrequestIngredientV2(unittest.IsolatedAsyncioTestCase):
+    async def asyncSetUp(self):
+        self.conn = await connect(":memory:")
+        await create(self.conn)
+        await run_migration(self.conn)
+
+        async def override_get_db():
+            try:
+                yield self.conn
+            finally:
+                pass
+
+        main.app.dependency_overrides[main.get_db] = override_get_db
+        self.client = TestClient(main.app)
+
+        # Register user and create two households
+        r = self.client.post(
+            "/api/v1/auth/register",
+            json={"email": "unreq@test.com", "password": "pw", "displayName": "UnReq"},
+        )
+        assert r.status_code == 200, r.text
+        token = r.json()["accessToken"]
+        self.headers = {"Authorization": f"Bearer {token}"}
+
+        r = self.client.post("/api/v1/households", headers=self.headers, json={"name": "H1"})
+        assert r.status_code == 200, r.text
+        self.h1 = r.json()["slug"]
+        r = self.client.post("/api/v1/households", headers=self.headers, json={"name": "H2"})
+        assert r.status_code == 200, r.text
+        self.h2 = r.json()["slug"]
+
+        # Resolve household ids
+        async with self.conn.execute("SELECT id FROM Household WHERE slug = ?", (self.h1,)) as c:
+            row = await c.fetchone()
+            assert row is not None
+            self.h1_id = int(row[0])
+        async with self.conn.execute("SELECT id FROM Household WHERE slug = ?", (self.h2,)) as c:
+            row = await c.fetchone()
+            assert row is not None
+            self.h2_id = int(row[0])
+
+        # Seed one ingredient in both households
+        await self.conn.execute(
+            "INSERT INTO Ingredient (name, line, unit, quantity, recipe_id, meal_id, household_id) VALUES ('Milk', '1L milk', 'L', 1, NULL, NULL, ?)",
+            (self.h1_id,),
+        )
+        async with self.conn.execute("SELECT last_insert_rowid()") as c:
+            row = await c.fetchone()
+            assert row is not None
+            self.milk_h1_id = int(row[0])
+        await self.conn.execute(
+            "INSERT INTO Ingredient (name, line, unit, quantity, recipe_id, meal_id, household_id) VALUES ('Milk', '1L milk', 'L', 1, NULL, NULL, ?)",
+            (self.h2_id,),
+        )
+        async with self.conn.execute("SELECT last_insert_rowid()") as c:
+            row = await c.fetchone()
+            assert row is not None
+            self.milk_h2_id = int(row[0])
+        await self.conn.commit()
+
+    async def asyncTearDown(self):
+        await self.conn.close()
+        main.app.dependency_overrides.clear()
+
+    def test_unrequest_ingredient_idempotent_and_scoped(self):
+        # Request ingredient in H1
+        r = self.client.post(
+            f"/api/v1/households/{self.h1}/shopping/current/ingredients",
+            headers=self.headers,
+            json={"ingredientId": self.milk_h1_id},
+        )
+        assert r.status_code == 200, r.text
+
+        # Ensure it shows up in H1 current
+        cur = self.client.get(
+            f"/api/v1/households/{self.h1}/shopping/current", headers=self.headers
+        ).json()
+        assert any(i.get("ingredientId") == self.milk_h1_id for i in cur["outstandingItems"])
+
+        # Delete it via new endpoint
+        d = self.client.request(
+            "DELETE",
+            f"/api/v1/households/{self.h1}/shopping/current/ingredients",
+            headers=self.headers,
+            json={"ingredientId": self.milk_h1_id},
+        )
+        assert d.status_code == 200, d.text
+        assert d.json()["ok"] is True
+
+        # It disappears from H1 current
+        cur = self.client.get(
+            f"/api/v1/households/{self.h1}/shopping/current", headers=self.headers
+        ).json()
+        assert not any(i.get("ingredientId") == self.milk_h1_id for i in cur["outstandingItems"])
+
+        # Idempotent: delete again
+        d2 = self.client.request(
+            "DELETE",
+            f"/api/v1/households/{self.h1}/shopping/current/ingredients",
+            headers=self.headers,
+            json={"ingredientId": self.milk_h1_id},
+        )
+        assert d2.status_code == 200, d2.text
+        assert d2.json()["ok"] is True
+
+        # Ensure H2 unaffected
+        cur2 = self.client.get(
+            f"/api/v1/households/{self.h2}/shopping/current", headers=self.headers
+        ).json()
+        # No request in H2, so still absent
+        assert not any(i.get("ingredientId") == self.milk_h2_id for i in cur2["outstandingItems"])