Cibello-app/apps/api/test/recommendations.test.ts

import "./setup-env.js";
import { describe, expect, it, beforeAll, afterAll } from "vitest";
import { and, eq, inArray } from "drizzle-orm";
import { buildServer } from "../src/server.js";
import { loadConfig } from "../src/config.js";
import { createDatabase, closeDatabase, schema } from "@app/database";

/**
 * Regression test: what-to-eat must work for a brand-new user who has not
 * created a household yet (empty pantry, single-person context).
 */
describe("what-to-eat without household", () => {
  const testDb = createDatabase(process.env.TEST_DATABASE_URL!);
  const config = loadConfig();
  let app: Awaited<ReturnType<typeof buildServer>>;
  let accessToken: string;
  const userEmail = "what-to-eat-repro@example.invalid";

  async function cleanup() {
    const emails = [userEmail, "goals-multi@example.invalid", "auto-household@example.invalid"];
    const existing = await testDb.db
      .select({ id: schema.users.id })
      .from(schema.users)
      .where(inArray(schema.users.email, emails));
    for (const u of existing) {
      await testDb.db.delete(schema.householdMembers).where(eq(schema.householdMembers.userId, u.id));
      const ownedHouseholds = await testDb.db
        .select({ id: schema.households.id })
        .from(schema.households)
        .innerJoin(
          schema.householdMembers,
          eq(schema.householdMembers.householdId, schema.households.id),
        )
        .where(and(eq(schema.householdMembers.userId, u.id), eq(schema.householdMembers.role, "owner")));
      for (const h of ownedHouseholds) {
        await testDb.db.delete(schema.storageLocations).where(eq(schema.storageLocations.householdId, h.id));
        await testDb.db.delete(schema.households).where(eq(schema.households.id, h.id));
      }
      await testDb.db.delete(schema.userPreferences).where(eq(schema.userPreferences.userId, u.id));
      await testDb.db.delete(schema.users).where(eq(schema.users.id, u.id));
    }
  }

  beforeAll(async () => {
    await cleanup();
    app = await buildServer(config);
    await app.ready();

    const res = await app.inject({
      method: "POST",
      url: "/v1/auth/register",
      payload: { email: userEmail, password: "Password123!", displayName: "Repro" },
    });
    const body = JSON.parse(res.body) as { accessToken: string };
    accessToken = body.accessToken;

    await testDb.db
      .insert(schema.userPreferences)
      .values({ userId: (JSON.parse(atob(accessToken.split(".")[1]!)) as { sub: string }).sub, primaryGoal: "cook_more" })
      .onConflictDoNothing();
  });

  afterAll(async () => {
    await cleanup();
    await closeDatabase();
    await app.close();
  });

  it("returns recommendations for a new user without a household and a craving set", async () => {
    const res = await app.inject({
      method: "GET",
      url: "/v1/recommendations/what-to-eat?limit=5&craving=asiatiskt",
      headers: { authorization: `Bearer ${accessToken}` },
    });

    expect(res.statusCode).toBe(200);
    const body = JSON.parse(res.body) as {
      recommendations: unknown[];
      mealBoxSuggestions: unknown[];
      context: { persons: number; craving: { cuisine: string } | null };
    };
    expect(body.recommendations).toBeDefined();
    expect(body.mealBoxSuggestions).toBeDefined();
    expect(body.context.persons).toBe(1);
    expect(body.context.craving).not.toBeNull();
    expect(body.context.craving?.cuisine).toBe("thai");
  });

  it("quick-start stores goals array and sets primaryGoal to the first goal", async () => {
    const registerRes = await app.inject({
      method: "POST",
      url: "/v1/auth/register",
      payload: { email: "goals-multi@example.invalid", password: "Password123!", displayName: "Goals" },
    });
    const { accessToken: token } = JSON.parse(registerRes.body) as { accessToken: string };
    const userId = (JSON.parse(atob(token.split(".")[1]!)) as { sub: string }).sub;

    const quickRes = await app.inject({
      method: "POST",
      url: "/v1/onboarding/quick-start",
      headers: { authorization: `Bearer ${token}` },
      payload: { goals: ["cook_more", "less_waste"], precisionMode: "simple" },
    });
    expect(quickRes.statusCode).toBe(200);

    const [prefs] = await testDb.db
      .select()
      .from(schema.userPreferences)
      .where(eq(schema.userPreferences.userId, userId))
      .limit(1);

    expect(prefs?.goals).toEqual(["cook_more", "less_waste"]);
    expect(prefs?.primaryGoal).toBe("cook_more");
  });

  it("personalization is gated by consent: no provenance without granted consent", async () => {
    const registerRes = await app.inject({
      method: "POST",
      url: "/v1/auth/register",
      payload: { email: "personalization-gate@example.invalid", password: "Password123!", displayName: "Gate" },
    });
    const { accessToken: token } = JSON.parse(registerRes.body) as { accessToken: string };
    const userId = (JSON.parse(atob(token.split(".")[1]!)) as { sub: string }).sub;

    await app.inject({
      method: "POST",
      url: "/v1/onboarding/quick-start",
      headers: { authorization: `Bearer ${token}` },
      payload: { goals: ["cook_more"], persons: 2, precisionMode: "simple" },
    });

    // Without personalization consent: no personal signals read, no provenance.
    const withoutConsent = await app.inject({
      method: "GET",
      url: "/v1/recommendations/what-to-eat?limit=5",
      headers: { authorization: `Bearer ${token}` },
    });
    expect(withoutConsent.statusCode).toBe(200);
    const bodyWithout = JSON.parse(withoutConsent.body) as {
      recommendations: Array<{ provenance?: unknown[]; whySv: string }>;
    };
    expect(bodyWithout.recommendations.length).toBeGreaterThan(0);
    for (const r of bodyWithout.recommendations) {
      expect(r.provenance ?? []).toHaveLength(0);
      expect(r.whySv).not.toContain("berättat");
    }

    // Grant personalization consent.
    await testDb.db
      .insert(schema.userConsents)
      .values({ userId, kind: "personalization", status: "granted" })
      .onConflictDoUpdate({
        target: [schema.userConsents.userId, schema.userConsents.kind],
        set: { status: "granted" },
      });

    const withConsent = await app.inject({
      method: "GET",
      url: "/v1/recommendations/what-to-eat?limit=5",
      headers: { authorization: `Bearer ${token}` },
    });
    expect(withConsent.statusCode).toBe(200);
    const bodyWith = JSON.parse(withConsent.body) as {
      recommendations: Array<{ recipeId: string; provenance?: unknown[]; score: number }>;
    };
    expect(bodyWith.recommendations.length).toBeGreaterThan(0);
    // Consent alone does not guarantee provenance; it just enables the path.
    // We verify determinism: same call twice = same order.
    const second = await app.inject({
      method: "GET",
      url: "/v1/recommendations/what-to-eat?limit=5",
      headers: { authorization: `Bearer ${token}` },
    });
    const bodySecond = JSON.parse(second.body) as {
      recommendations: Array<{ recipeId: string; score: number }>;
    };
    expect(bodyWith.recommendations.map((r) => r.recipeId)).toEqual(
      bodySecond.recommendations.map((r) => r.recipeId),
    );
  });

  it("quick-start auto-creates a household with default storage locations", async () => {
    const registerRes = await app.inject({
      method: "POST",
      url: "/v1/auth/register",
      payload: { email: "auto-household@example.invalid", password: "Password123!", displayName: "Auto" },
    });
    const { accessToken: token } = JSON.parse(registerRes.body) as { accessToken: string };
    const userId = (JSON.parse(atob(token.split(".")[1]!)) as { sub: string }).sub;

    const quickRes = await app.inject({
      method: "POST",
      url: "/v1/onboarding/quick-start",
      headers: { authorization: `Bearer ${token}` },
      payload: { goals: ["cook_more"], persons: 2, precisionMode: "simple" },
    });
    expect(quickRes.statusCode).toBe(200);
    const { householdId } = JSON.parse(quickRes.body) as { householdId: string };
    expect(householdId).toBeTruthy();

    const [household] = await testDb.db
      .select()
      .from(schema.households)
      .where(eq(schema.households.id, householdId))
      .limit(1);
    expect(household).toBeTruthy();
    expect(household!.size).toBe(2);

    const locations = await testDb.db
      .select()
      .from(schema.storageLocations)
      .where(eq(schema.storageLocations.householdId, householdId));
    expect(locations.map((l) => l.type).sort()).toEqual(["freezer", "fridge", "pantry"]);
  });
});