feat(worker): S3 3b härda UPDATE_USER_MEMORY — budget, kostnad, anti-påhitt, GDPR-regression

apps/api/test/me.test.ts

@@ -3,7 +3,7 @@ import { describe, expect, it, beforeAll, afterAll, vi } from "vitest";
 import { eq, inArray } from "drizzle-orm";
 import { buildServer } from "../src/server.js";
 import { loadConfig } from "../src/config.js";
-import { createDatabase, closeDatabase, schema } from "@app/database";
+import { createDatabase, closeDatabase, eraseUser, schema } from "@app/database";
 
 describe("DELETE /v1/me — GDPR-radering", () => {
   const testDb = createDatabase(process.env.TEST_DATABASE_URL!);
@@ -213,4 +213,90 @@ describe("DELETE /v1/me — GDPR-radering", () => {
     deleteSpy.mockRestore();
     await cleanupUser(email);
   });
+
+  it("raderar memoryItems och tasteSignals vid DELETE /v1/me", async () => {
+    const email = "gdpr-memory-signals@example.invalid";
+    await cleanupUser(email);
+    const { token, userId } = await registerUser(email);
+
+    await testDb.db.insert(schema.memoryItems).values({
+      userId,
+      kind: "structured_fact",
+      key: "favorite-cuisine-italian",
+      summarySv: "Gillar italienskt",
+      value: { favoriteCuisine: "italian" },
+      origin: "user_stated",
+      confidence: 1,
+    });
+
+    await testDb.db.insert(schema.tasteSignals).values({
+      userId,
+      axis: "spice",
+      direction: 1,
+      strength: 0.8,
+      origin: "user_stated",
+    });
+
+    const res = await app.inject({
+      method: "DELETE",
+      url: "/v1/me",
+      headers: { authorization: `Bearer ${token}` },
+    });
+
+    expect(res.statusCode).toBe(200);
+
+    const remainingMemory = await testDb.db
+      .select({ id: schema.memoryItems.id })
+      .from(schema.memoryItems)
+      .where(eq(schema.memoryItems.userId, userId));
+    expect(remainingMemory).toHaveLength(0);
+
+    const remainingSignals = await testDb.db
+      .select({ id: schema.tasteSignals.id })
+      .from(schema.tasteSignals)
+      .where(eq(schema.tasteSignals.userId, userId));
+    expect(remainingSignals).toHaveLength(0);
+
+    await cleanupUser(email);
+  });
+
+  it("eraseUser raderar memoryItems och tasteSignals (GDPR-regression)", async () => {
+    const email = "gdpr-erase-user-memory@example.invalid";
+    await cleanupUser(email);
+    const { userId } = await registerUser(email);
+
+    await testDb.db.insert(schema.memoryItems).values({
+      userId,
+      kind: "structured_fact",
+      key: "dislikes-broccoli",
+      summarySv: "Ogillar broccoli",
+      value: { dislikedIngredient: "broccoli" },
+      origin: "user_stated",
+      confidence: 1,
+    });
+
+    await testDb.db.insert(schema.tasteSignals).values({
+      userId,
+      axis: "garlic",
+      direction: -1,
+      strength: 0.9,
+      origin: "user_stated",
+    });
+
+    await eraseUser(testDb.db, userId);
+
+    const remainingMemory = await testDb.db
+      .select({ id: schema.memoryItems.id })
+      .from(schema.memoryItems)
+      .where(eq(schema.memoryItems.userId, userId));
+    expect(remainingMemory).toHaveLength(0);
+
+    const remainingSignals = await testDb.db
+      .select({ id: schema.tasteSignals.id })
+      .from(schema.tasteSignals)
+      .where(eq(schema.tasteSignals.userId, userId));
+    expect(remainingSignals).toHaveLength(0);
+
+    await cleanupUser(email);
+  });
 });

apps/api/test/memory.test.ts

@@ -214,3 +214,109 @@ describe("memory i18n parity", () => {
     }
   });
 });
+
+describe("DELETE /v1/me/memory GDPR-regression", () => {
+  let app: Awaited<ReturnType<typeof buildServer>>;
+
+  beforeAll(async () => {
+    app = await buildServer(config);
+    await app.ready();
+  });
+
+  afterAll(async () => {
+    await app.close();
+  });
+
+  async function cleanup(email: string) {
+    const existing = await testDb.db
+      .select({ id: schema.users.id })
+      .from(schema.users)
+      .where(eq(schema.users.email, email));
+    for (const u of existing) {
+      await testDb.db.delete(schema.memoryItems).where(eq(schema.memoryItems.userId, u.id));
+      await testDb.db.delete(schema.tasteSignals).where(eq(schema.tasteSignals.userId, u.id));
+      await testDb.db.delete(schema.userConsents).where(eq(schema.userConsents.userId, u.id));
+      await testDb.db.delete(schema.userPreferences).where(eq(schema.userPreferences.userId, u.id));
+      await testDb.db.delete(schema.householdMembers).where(eq(schema.householdMembers.userId, u.id));
+      const ownedHouseholds = await testDb.db
+        .select({ id: schema.households.id })
+        .from(schema.households)
+        .innerJoin(
+          schema.householdMembers,
+          eq(schema.householdMembers.householdId, schema.households.id),
+        )
+        .where(
+          and(eq(schema.householdMembers.userId, u.id), eq(schema.householdMembers.role, "owner")),
+        );
+      for (const h of ownedHouseholds) {
+        await testDb.db.delete(schema.storageLocations).where(eq(schema.storageLocations.householdId, h.id));
+        await testDb.db.delete(schema.households).where(eq(schema.households.id, h.id));
+      }
+      await testDb.db.delete(schema.users).where(eq(schema.users.id, u.id));
+    }
+  }
+
+  async function registerUser(email: string) {
+    await cleanup(email);
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/auth/register",
+      payload: { email, password: "Password123!", displayName: "Memory GDPR Test" },
+    });
+    const body = JSON.parse(res.body) as { accessToken: string };
+    const token = body.accessToken;
+    const userId = (JSON.parse(atob(token.split(".")[1]!)) as { sub: string }).sub;
+    await app.inject({
+      method: "POST",
+      url: "/v1/onboarding/quick-start",
+      headers: { authorization: `Bearer ${token}` },
+      payload: { goals: ["cook_more"], precisionMode: "simple" },
+    });
+    return { token, userId };
+  }
+
+  it("tömmer memoryItems och tasteSignals", async () => {
+    const email = "memory-delete-all@example.invalid";
+    const { token, userId } = await registerUser(email);
+
+    await testDb.db.insert(schema.memoryItems).values({
+      userId,
+      kind: "structured_fact",
+      key: "likes-pasta",
+      summarySv: "Gillar pasta",
+      value: { favoriteCuisine: "italian" },
+      origin: "user_stated",
+      confidence: 1,
+    });
+
+    await testDb.db.insert(schema.tasteSignals).values({
+      userId,
+      axis: "spice",
+      direction: 1,
+      strength: 0.8,
+      origin: "user_stated",
+    });
+
+    const res = await app.inject({
+      method: "DELETE",
+      url: "/v1/me/memory",
+      headers: { authorization: `Bearer ${token}` },
+    });
+
+    expect(res.statusCode).toBe(200);
+
+    const remainingMemory = await testDb.db
+      .select({ id: schema.memoryItems.id })
+      .from(schema.memoryItems)
+      .where(eq(schema.memoryItems.userId, userId));
+    expect(remainingMemory).toHaveLength(0);
+
+    const remainingSignals = await testDb.db
+      .select({ id: schema.tasteSignals.id })
+      .from(schema.tasteSignals)
+      .where(eq(schema.tasteSignals.userId, userId));
+    expect(remainingSignals).toHaveLength(0);
+
+    await cleanup(email);
+  });
+});