import "./setup-env.js"; import { describe, expect, it, beforeAll, afterAll } from "vitest"; import { and, eq, inArray } from "drizzle-orm"; import { buildServer } from "../src/server.js"; import { loadConfig } from "../src/config.js"; import { createDatabase, closeDatabase, schema } from "@app/database"; /** * Regression test: what-to-eat must work for a brand-new user who has not * created a household yet (empty pantry, single-person context). */ describe("what-to-eat without household", () => { const testDb = createDatabase(process.env.TEST_DATABASE_URL!); const config = loadConfig(); let app: Awaited>; let accessToken: string; const userEmail = "what-to-eat-repro@example.invalid"; async function cleanup() { const emails = [userEmail, "goals-multi@example.invalid", "auto-household@example.invalid"]; const existing = await testDb.db .select({ id: schema.users.id }) .from(schema.users) .where(inArray(schema.users.email, emails)); for (const u of existing) { await testDb.db.delete(schema.householdMembers).where(eq(schema.householdMembers.userId, u.id)); const ownedHouseholds = await testDb.db .select({ id: schema.households.id }) .from(schema.households) .innerJoin( schema.householdMembers, eq(schema.householdMembers.householdId, schema.households.id), ) .where(and(eq(schema.householdMembers.userId, u.id), eq(schema.householdMembers.role, "owner"))); for (const h of ownedHouseholds) { await testDb.db.delete(schema.storageLocations).where(eq(schema.storageLocations.householdId, h.id)); await testDb.db.delete(schema.households).where(eq(schema.households.id, h.id)); } await testDb.db.delete(schema.userPreferences).where(eq(schema.userPreferences.userId, u.id)); await testDb.db.delete(schema.users).where(eq(schema.users.id, u.id)); } } beforeAll(async () => { await cleanup(); app = await buildServer(config); await app.ready(); const res = await app.inject({ method: "POST", url: "/v1/auth/register", payload: { email: userEmail, password: "Password123!", displayName: "Repro" }, }); const body = JSON.parse(res.body) as { accessToken: string }; accessToken = body.accessToken; await testDb.db .insert(schema.userPreferences) .values({ userId: (JSON.parse(atob(accessToken.split(".")[1]!)) as { sub: string }).sub, primaryGoal: "cook_more" }) .onConflictDoNothing(); }); afterAll(async () => { await cleanup(); await closeDatabase(); await app.close(); }); it("returns recommendations for a new user without a household and a craving set", async () => { const res = await app.inject({ method: "GET", url: "/v1/recommendations/what-to-eat?limit=5&craving=asiatiskt", headers: { authorization: `Bearer ${accessToken}` }, }); expect(res.statusCode).toBe(200); const body = JSON.parse(res.body) as { recommendations: unknown[]; mealBoxSuggestions: unknown[]; context: { persons: number; craving: { cuisine: string } | null }; }; expect(body.recommendations).toBeDefined(); expect(body.mealBoxSuggestions).toBeDefined(); expect(body.context.persons).toBe(1); expect(body.context.craving).not.toBeNull(); expect(body.context.craving?.cuisine).toBe("thai"); }); it("quick-start stores goals array and sets primaryGoal to the first goal", async () => { const registerRes = await app.inject({ method: "POST", url: "/v1/auth/register", payload: { email: "goals-multi@example.invalid", password: "Password123!", displayName: "Goals" }, }); const { accessToken: token } = JSON.parse(registerRes.body) as { accessToken: string }; const userId = (JSON.parse(atob(token.split(".")[1]!)) as { sub: string }).sub; const quickRes = await app.inject({ method: "POST", url: "/v1/onboarding/quick-start", headers: { authorization: `Bearer ${token}` }, payload: { goals: ["cook_more", "less_waste"], precisionMode: "simple" }, }); expect(quickRes.statusCode).toBe(200); const [prefs] = await testDb.db .select() .from(schema.userPreferences) .where(eq(schema.userPreferences.userId, userId)) .limit(1); expect(prefs?.goals).toEqual(["cook_more", "less_waste"]); expect(prefs?.primaryGoal).toBe("cook_more"); }); it("personalization is gated by consent: no provenance without granted consent", async () => { const registerRes = await app.inject({ method: "POST", url: "/v1/auth/register", payload: { email: "personalization-gate@example.invalid", password: "Password123!", displayName: "Gate" }, }); const { accessToken: token } = JSON.parse(registerRes.body) as { accessToken: string }; const userId = (JSON.parse(atob(token.split(".")[1]!)) as { sub: string }).sub; await app.inject({ method: "POST", url: "/v1/onboarding/quick-start", headers: { authorization: `Bearer ${token}` }, payload: { goals: ["cook_more"], persons: 2, precisionMode: "simple" }, }); // Without personalization consent: no personal signals read, no provenance. const withoutConsent = await app.inject({ method: "GET", url: "/v1/recommendations/what-to-eat?limit=5", headers: { authorization: `Bearer ${token}` }, }); expect(withoutConsent.statusCode).toBe(200); const bodyWithout = JSON.parse(withoutConsent.body) as { recommendations: Array<{ provenance?: unknown[]; whySv: string }>; }; expect(bodyWithout.recommendations.length).toBeGreaterThan(0); for (const r of bodyWithout.recommendations) { expect(r.provenance ?? []).toHaveLength(0); expect(r.whySv).not.toContain("berättat"); } // Grant personalization consent. await testDb.db .insert(schema.userConsents) .values({ userId, kind: "personalization", status: "granted" }) .onConflictDoUpdate({ target: [schema.userConsents.userId, schema.userConsents.kind], set: { status: "granted" }, }); const withConsent = await app.inject({ method: "GET", url: "/v1/recommendations/what-to-eat?limit=5", headers: { authorization: `Bearer ${token}` }, }); expect(withConsent.statusCode).toBe(200); const bodyWith = JSON.parse(withConsent.body) as { recommendations: Array<{ recipeId: string; provenance?: unknown[]; score: number }>; }; expect(bodyWith.recommendations.length).toBeGreaterThan(0); // Consent alone does not guarantee provenance; it just enables the path. // We verify determinism: same call twice = same order. const second = await app.inject({ method: "GET", url: "/v1/recommendations/what-to-eat?limit=5", headers: { authorization: `Bearer ${token}` }, }); const bodySecond = JSON.parse(second.body) as { recommendations: Array<{ recipeId: string; score: number }>; }; expect(bodyWith.recommendations.map((r) => r.recipeId)).toEqual( bodySecond.recommendations.map((r) => r.recipeId), ); }); it("quick-start auto-creates a household with default storage locations", async () => { const registerRes = await app.inject({ method: "POST", url: "/v1/auth/register", payload: { email: "auto-household@example.invalid", password: "Password123!", displayName: "Auto" }, }); const { accessToken: token } = JSON.parse(registerRes.body) as { accessToken: string }; const userId = (JSON.parse(atob(token.split(".")[1]!)) as { sub: string }).sub; const quickRes = await app.inject({ method: "POST", url: "/v1/onboarding/quick-start", headers: { authorization: `Bearer ${token}` }, payload: { goals: ["cook_more"], persons: 2, precisionMode: "simple" }, }); expect(quickRes.statusCode).toBe(200); const { householdId } = JSON.parse(quickRes.body) as { householdId: string }; expect(householdId).toBeTruthy(); const [household] = await testDb.db .select() .from(schema.households) .where(eq(schema.households.id, householdId)) .limit(1); expect(household).toBeTruthy(); expect(household!.size).toBe(2); const locations = await testDb.db .select() .from(schema.storageLocations) .where(eq(schema.storageLocations.householdId, householdId)); expect(locations.map((l) => l.type).sort()).toEqual(["freezer", "fridge", "pantry"]); }); });