feat: implement remaining TODO.md feature ideas + fix mobile headers

Implements the six previously-unscoped feature ideas plus a mobile layout fix reported via screenshot: - Mobile: Recipes/Collections/Pantry/Meal Plan/Shopping Lists headers now stack and wrap instead of clipping buttons on narrow viewports. - Recipe diff/compare view: word/list diff against any past version, next to Restore in version history. - Shared meal plans & shopping lists: new shoppingListMembers/ mealPlanMembers tables (viewer/editor roles, mirrors collectionMembers), share dialogs, membership-checked routes. - PDF cookbook export: /print/collection/[id] renders a whole collection with page breaks, using the existing print-CSS pattern instead of adding a PDF rendering dependency. - Grocery delivery handoff: shopping lists can copy-as-text (works today) or send to Instacart once INSTACART_API_KEY is configured (stub adapter — real API needs a partner agreement). - Personalized "For You" feed tab: ranks public recipes by tag/ dietary overlap with the user's favorited/highly-rated history. - PWA: added manifest.json + icons on top of the existing service worker so the app is installable; cook-mode pages were already cached for offline use. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-02 12:13:00 +02:00
parent d2faf98ac1
commit e5d1080fb9
56 changed files with 6096 additions and 74 deletions
@@ -0,0 +1,137 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { NextRequest } from "next/server";
+
+const mockSession = { user: { id: "user-1" } };
+
+vi.mock("@/lib/api-auth", () => ({
+  requireSession: vi.fn(),
+}));
+
+const { mockPlanFindFirst, mockMemberFindFirst, mockMemberFindMany, mockUserFindFirst, mockInsertValues, mockInsertPlanValues, mockDeleteWhere } = vi.hoisted(() => ({
+  mockPlanFindFirst: vi.fn(),
+  mockMemberFindFirst: vi.fn(),
+  mockMemberFindMany: vi.fn(),
+  mockUserFindFirst: vi.fn(),
+  mockInsertValues: vi.fn().mockResolvedValue(undefined),
+  mockInsertPlanValues: vi.fn().mockResolvedValue(undefined),
+  mockDeleteWhere: vi.fn().mockResolvedValue(undefined),
+}));
+
+vi.mock("@epicure/db", () => ({
+  db: {
+    query: {
+      mealPlans: { findFirst: mockPlanFindFirst },
+      mealPlanMembers: { findFirst: mockMemberFindFirst, findMany: mockMemberFindMany },
+      users: { findFirst: mockUserFindFirst },
+    },
+    insert: vi.fn(() => ({ values: mockInsertValues })),
+    delete: vi.fn(() => ({ where: mockDeleteWhere })),
+  },
+  mealPlans: { id: "id", userId: "user_id", weekStart: "week_start" },
+  mealPlanMembers: { id: "id", mealPlanId: "meal_plan_id", userId: "user_id" },
+  users: { id: "id", email: "email" },
+  eq: vi.fn((a, b) => ({ a, b, op: "eq" })),
+  and: vi.fn((...args) => ({ args, op: "and" })),
+}));
+
+const { requireSession } = await import("@/lib/api-auth");
+import { GET, POST, DELETE } from "../route";
+
+const ctx = { params: Promise.resolve({ weekStart: "2026-06-01" }) };
+
+function makeRequest(method: string, body?: unknown, search = "") {
+  return new NextRequest(`http://localhost/api/v1/meal-plans/2026-06-01/members${search}`, {
+    method,
+    headers: { "Content-Type": "application/json" },
+    body: body ? JSON.stringify(body) : undefined,
+  });
+}
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  vi.mocked(requireSession).mockResolvedValue({ session: mockSession as never, response: null });
+});
+
+describe("GET /api/v1/meal-plans/[weekStart]/members", () => {
+  it("returns an empty list when the owner has no plan for this week yet", async () => {
+    mockPlanFindFirst.mockResolvedValue(undefined);
+    const res = await GET(makeRequest("GET"), ctx);
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual([]);
+  });
+
+  it("returns members for an existing plan", async () => {
+    mockPlanFindFirst.mockResolvedValue({ id: "plan-1", userId: "user-1" });
+    mockMemberFindMany.mockResolvedValue([
+      { id: "m1", userId: "user-2", role: "editor", createdAt: new Date(), user: { name: "Bob", username: null, avatarUrl: null } },
+    ]);
+    const res = await GET(makeRequest("GET"), ctx);
+    const body = await res.json() as unknown[];
+    expect(body).toHaveLength(1);
+  });
+});
+
+describe("POST /api/v1/meal-plans/[weekStart]/members", () => {
+  it("returns 400 on invalid body", async () => {
+    const res = await POST(makeRequest("POST", { role: "viewer" }), ctx);
+    expect(res.status).toBe(400);
+  });
+
+  it("returns 404 when the target user doesn't exist", async () => {
+    mockUserFindFirst.mockResolvedValue(undefined);
+    const res = await POST(makeRequest("POST", { email: "b@test.com", role: "viewer" }), ctx);
+    expect(res.status).toBe(404);
+  });
+
+  it("returns 400 when inviting yourself", async () => {
+    mockUserFindFirst.mockResolvedValue({ id: "user-1" });
+    const res = await POST(makeRequest("POST", { email: "a@test.com", role: "viewer" }), ctx);
+    expect(res.status).toBe(400);
+  });
+
+  it("auto-creates the plan for the week and invites the member", async () => {
+    mockUserFindFirst.mockResolvedValue({ id: "user-2" });
+    mockPlanFindFirst.mockResolvedValue(undefined); // no plan yet for this week
+    mockMemberFindFirst.mockResolvedValue(undefined);
+    const res = await POST(makeRequest("POST", { email: "b@test.com", role: "editor" }), ctx);
+    expect(res.status).toBe(201);
+    expect(mockInsertValues).toHaveBeenCalledWith(expect.objectContaining({ userId: "user-1", weekStart: "2026-06-01" }));
+    expect(mockInsertValues).toHaveBeenCalledWith(expect.objectContaining({ userId: "user-2", role: "editor" }));
+  });
+
+  it("returns 409 when already a member", async () => {
+    mockUserFindFirst.mockResolvedValue({ id: "user-2" });
+    mockPlanFindFirst.mockResolvedValue({ id: "plan-1", userId: "user-1", weekStart: "2026-06-01" });
+    mockMemberFindFirst.mockResolvedValue({ id: "existing" });
+    const res = await POST(makeRequest("POST", { email: "b@test.com", role: "viewer" }), ctx);
+    expect(res.status).toBe(409);
+  });
+});
+
+describe("DELETE /api/v1/meal-plans/[weekStart]/members", () => {
+  it("returns 400 when memberId is missing", async () => {
+    const res = await DELETE(makeRequest("DELETE"), ctx);
+    expect(res.status).toBe(400);
+  });
+
+  it("returns 404 when the owner has no plan for this week", async () => {
+    mockPlanFindFirst.mockResolvedValue(undefined);
+    const res = await DELETE(makeRequest("DELETE", undefined, "?memberId=m1"), ctx);
+    expect(res.status).toBe(404);
+  });
+
+  it("returns 403 when caller is neither owner nor the member themselves", async () => {
+    mockPlanFindFirst.mockResolvedValue({ id: "plan-1", userId: "user-1" });
+    mockMemberFindFirst.mockResolvedValue({ id: "m1", userId: "user-2" });
+    vi.mocked(requireSession).mockResolvedValue({ session: { user: { id: "user-3" } } as never, response: null });
+    const res = await DELETE(makeRequest("DELETE", undefined, "?memberId=m1"), ctx);
+    expect(res.status).toBe(403);
+  });
+
+  it("allows the owner to remove a member", async () => {
+    mockPlanFindFirst.mockResolvedValue({ id: "plan-1", userId: "user-1" });
+    mockMemberFindFirst.mockResolvedValue({ id: "m1", userId: "user-2" });
+    const res = await DELETE(makeRequest("DELETE", undefined, "?memberId=m1"), ctx);
+    expect(res.status).toBe(204);
+  });
+});
@@ -0,0 +1,122 @@
+import { NextRequest, NextResponse } from "next/server";
+import { z } from "zod";
+import { db, mealPlans, mealPlanMembers, users, eq, and } from "@epicure/db";
+import { requireSession } from "@/lib/api-auth";
+
+type Params = { params: Promise<{ weekStart: string }> };
+
+async function getOrCreatePlan(userId: string, weekStart: string) {
+  const existing = await db.query.mealPlans.findFirst({
+    where: and(eq(mealPlans.userId, userId), eq(mealPlans.weekStart, weekStart)),
+  });
+  if (existing) return existing;
+
+  const id = crypto.randomUUID();
+  await db.insert(mealPlans).values({ id, userId, weekStart });
+  return { id, userId, weekStart, createdAt: new Date() };
+}
+
+// ─── GET /api/v1/meal-plans/[weekStart]/members ──────────────────────────────
+// Owner only — returns members joined with basic user info.
+export async function GET(_req: NextRequest, { params }: Params) {
+  const { session, response } = await requireSession();
+  if (response) return response;
+  const { weekStart } = await params;
+
+  const plan = await db.query.mealPlans.findFirst({
+    where: and(eq(mealPlans.userId, session!.user.id), eq(mealPlans.weekStart, weekStart)),
+  });
+  if (!plan) return NextResponse.json([]);
+
+  const members = await db.query.mealPlanMembers.findMany({
+    where: eq(mealPlanMembers.mealPlanId, plan.id),
+    with: { user: true },
+  });
+
+  return NextResponse.json(
+    members.map((m) => ({
+      id: m.id,
+      userId: m.userId,
+      role: m.role,
+      createdAt: m.createdAt,
+      user: { name: m.user.name, username: m.user.username, avatarUrl: m.user.avatarUrl },
+    }))
+  );
+}
+
+// ─── POST /api/v1/meal-plans/[weekStart]/members ─────────────────────────────
+// Owner only — invite by email or userId. Auto-creates the plan for this week if missing.
+const InviteSchema = z
+  .object({
+    email: z.string().email().optional(),
+    userId: z.string().optional(),
+    role: z.enum(["viewer", "editor"]),
+  })
+  .refine((d) => d.email !== undefined || d.userId !== undefined, {
+    message: "Provide either email or userId",
+  });
+
+export async function POST(req: NextRequest, { params }: Params) {
+  const { session, response } = await requireSession();
+  if (response) return response;
+  const { weekStart } = await params;
+
+  const body = await req.json() as unknown;
+  const parsed = InviteSchema.safeParse(body);
+  if (!parsed.success) return NextResponse.json({ error: "Validation error" }, { status: 400 });
+
+  const { email, userId, role } = parsed.data;
+
+  const targetUser = await db.query.users.findFirst({
+    where: email ? eq(users.email, email) : eq(users.id, userId!),
+  });
+  if (!targetUser) return NextResponse.json({ error: "User not found" }, { status: 404 });
+
+  if (targetUser.id === session!.user.id) {
+    return NextResponse.json({ error: "Cannot invite yourself" }, { status: 400 });
+  }
+
+  const plan = await getOrCreatePlan(session!.user.id, weekStart);
+
+  const existing = await db.query.mealPlanMembers.findFirst({
+    where: and(eq(mealPlanMembers.mealPlanId, plan.id), eq(mealPlanMembers.userId, targetUser.id)),
+  });
+  if (existing) return NextResponse.json({ error: "Already a member" }, { status: 409 });
+
+  const memberId = crypto.randomUUID();
+  await db.insert(mealPlanMembers).values({
+    id: memberId,
+    mealPlanId: plan.id,
+    userId: targetUser.id,
+    role,
+  });
+
+  return NextResponse.json({ id: memberId, mealPlanId: plan.id }, { status: 201 });
+}
+
+// ─── DELETE /api/v1/meal-plans/[weekStart]/members?memberId=… ────────────────
+// Owner OR the member themselves can remove.
+export async function DELETE(req: NextRequest, { params }: Params) {
+  const { session, response } = await requireSession();
+  if (response) return response;
+  const { weekStart } = await params;
+  const memberId = req.nextUrl.searchParams.get("memberId");
+  if (!memberId) return NextResponse.json({ error: "memberId required" }, { status: 400 });
+
+  const plan = await db.query.mealPlans.findFirst({
+    where: and(eq(mealPlans.userId, session!.user.id), eq(mealPlans.weekStart, weekStart)),
+  });
+  if (!plan) return NextResponse.json({ error: "Not found" }, { status: 404 });
+
+  const member = await db.query.mealPlanMembers.findFirst({
+    where: and(eq(mealPlanMembers.id, memberId), eq(mealPlanMembers.mealPlanId, plan.id)),
+  });
+  if (!member) return NextResponse.json({ error: "Not found" }, { status: 404 });
+
+  const isOwner = plan.userId === session!.user.id;
+  const isSelf = member.userId === session!.user.id;
+  if (!isOwner && !isSelf) return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+
+  await db.delete(mealPlanMembers).where(eq(mealPlanMembers.id, memberId));
+  return new NextResponse(null, { status: 204 });
+}
@@ -0,0 +1,104 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { NextRequest } from "next/server";
+
+const mockSession = { user: { id: "user-2" } };
+
+vi.mock("@/lib/api-auth", () => ({
+  requireSession: vi.fn(),
+}));
+
+vi.mock("@/lib/webhooks", () => ({
+  dispatchWebhook: vi.fn(),
+}));
+
+const { mockPlanFindFirst, mockMemberFindFirst, mockRecipeFindFirst, mockInsertValues, mockDeleteWhere } = vi.hoisted(() => ({
+  mockPlanFindFirst: vi.fn(),
+  mockMemberFindFirst: vi.fn(),
+  mockRecipeFindFirst: vi.fn(),
+  mockInsertValues: vi.fn().mockResolvedValue(undefined),
+  mockDeleteWhere: vi.fn().mockResolvedValue(undefined),
+}));
+
+vi.mock("@epicure/db", () => ({
+  db: {
+    query: {
+      mealPlans: { findFirst: mockPlanFindFirst },
+      mealPlanMembers: { findFirst: mockMemberFindFirst },
+      recipes: { findFirst: mockRecipeFindFirst },
+    },
+    insert: vi.fn(() => ({ values: mockInsertValues })),
+    delete: vi.fn(() => ({ where: mockDeleteWhere })),
+  },
+  mealPlans: { id: "id", userId: "user_id" },
+  mealPlanMembers: { mealPlanId: "meal_plan_id", userId: "user_id" },
+  mealPlanEntries: { id: "id", mealPlanId: "meal_plan_id", day: "day", mealType: "meal_type" },
+  recipes: { id: "id", authorId: "author_id", visibility: "visibility" },
+  eq: vi.fn((a, b) => ({ a, b, op: "eq" })),
+  and: vi.fn((...args) => ({ args, op: "and" })),
+  or: vi.fn((...args) => ({ args, op: "or" })),
+  ne: vi.fn((a, b) => ({ a, b, op: "ne" })),
+}));
+
+const { requireSession } = await import("@/lib/api-auth");
+import { POST, DELETE } from "../route";
+
+const ctx = { params: Promise.resolve({ mealPlanId: "plan-1" }) };
+
+function makeRequest(method: string, body?: unknown, search = "") {
+  return new NextRequest(`http://localhost/api/v1/meal-plans/shared/plan-1/entries${search}`, {
+    method,
+    headers: { "Content-Type": "application/json" },
+    body: body ? JSON.stringify(body) : undefined,
+  });
+}
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  vi.mocked(requireSession).mockResolvedValue({ session: mockSession as never, response: null });
+  mockPlanFindFirst.mockResolvedValue({ id: "plan-1", userId: "user-1" });
+});
+
+const validBody = { day: "mon", mealType: "dinner", recipeId: "r-1", servings: 2 };
+
+describe("POST /api/v1/meal-plans/shared/[mealPlanId]/entries", () => {
+  it("returns 404 when the caller has no access to the plan", async () => {
+    mockMemberFindFirst.mockResolvedValue(undefined);
+    const res = await POST(makeRequest("POST", validBody), ctx);
+    expect(res.status).toBe(404);
+  });
+
+  it("returns 403 for a viewer trying to add an entry", async () => {
+    mockMemberFindFirst.mockResolvedValue({ role: "viewer" });
+    const res = await POST(makeRequest("POST", validBody), ctx);
+    expect(res.status).toBe(403);
+  });
+
+  it("allows an editor to add an entry", async () => {
+    mockMemberFindFirst.mockResolvedValue({ role: "editor" });
+    mockRecipeFindFirst.mockResolvedValue({ id: "r-1" });
+    const res = await POST(makeRequest("POST", validBody), ctx);
+    expect(res.status).toBe(201);
+    expect(mockInsertValues).toHaveBeenCalledWith(expect.objectContaining({ mealPlanId: "plan-1", day: "mon" }));
+  });
+
+  it("returns 404 when the recipe isn't accessible to the editor", async () => {
+    mockMemberFindFirst.mockResolvedValue({ role: "editor" });
+    mockRecipeFindFirst.mockResolvedValue(undefined);
+    const res = await POST(makeRequest("POST", validBody), ctx);
+    expect(res.status).toBe(404);
+  });
+});
+
+describe("DELETE /api/v1/meal-plans/shared/[mealPlanId]/entries", () => {
+  it("returns 403 for a viewer trying to remove an entry", async () => {
+    mockMemberFindFirst.mockResolvedValue({ role: "viewer" });
+    const res = await DELETE(makeRequest("DELETE", undefined, "?entryId=e1"), ctx);
+    expect(res.status).toBe(403);
+  });
+
+  it("allows an editor to remove an entry", async () => {
+    mockMemberFindFirst.mockResolvedValue({ role: "editor" });
+    const res = await DELETE(makeRequest("DELETE", undefined, "?entryId=e1"), ctx);
+    expect(res.status).toBe(204);
+  });
+});
@@ -0,0 +1,81 @@
+import { NextRequest, NextResponse } from "next/server";
+import { z } from "zod";
+import { db, mealPlanEntries, recipes, eq, and, or, ne } from "@epicure/db";
+import { requireSession } from "@/lib/api-auth";
+import { getMealPlanAccessById, canWriteMealPlan } from "@/lib/meal-plan-access";
+import { dispatchWebhook } from "@/lib/webhooks";
+
+type Params = { params: Promise<{ mealPlanId: string }> };
+
+const Schema = z.object({
+  day: z.enum(["mon", "tue", "wed", "thu", "fri", "sat", "sun"]),
+  mealType: z.enum(["breakfast", "lunch", "dinner", "snack"]),
+  recipeId: z.string().optional(),
+  servings: z.number().int().min(1).max(100).default(2),
+  note: z.string().max(500).optional(),
+});
+
+export async function POST(req: NextRequest, { params }: Params) {
+  const { session, response } = await requireSession();
+  if (response) return response;
+  const { mealPlanId } = await params;
+
+  const access = await getMealPlanAccessById(mealPlanId, session!.user.id);
+  if (!access) return NextResponse.json({ error: "Not found" }, { status: 404 });
+  if (!canWriteMealPlan(access.role)) return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+
+  const body = await req.json() as unknown;
+  const parsed = Schema.safeParse(body);
+  if (!parsed.success) return NextResponse.json({ error: "Validation error" }, { status: 400 });
+
+  if (parsed.data.recipeId) {
+    const recipe = await db.query.recipes.findFirst({
+      where: and(
+        eq(recipes.id, parsed.data.recipeId),
+        or(eq(recipes.authorId, session!.user.id), ne(recipes.visibility, "private"))
+      ),
+    });
+    if (!recipe) return NextResponse.json({ error: "Recipe not found" }, { status: 404 });
+  }
+
+  await db.delete(mealPlanEntries).where(
+    and(
+      eq(mealPlanEntries.mealPlanId, mealPlanId),
+      eq(mealPlanEntries.day, parsed.data.day),
+      eq(mealPlanEntries.mealType, parsed.data.mealType)
+    )
+  );
+
+  const entryId = crypto.randomUUID();
+  await db.insert(mealPlanEntries).values({
+    id: entryId,
+    mealPlanId,
+    day: parsed.data.day,
+    mealType: parsed.data.mealType,
+    recipeId: parsed.data.recipeId,
+    servings: parsed.data.servings,
+    note: parsed.data.note,
+  });
+
+  void dispatchWebhook(access.plan.userId, "meal_plan.updated", { mealPlanId, day: parsed.data.day, mealType: parsed.data.mealType });
+  return NextResponse.json({ id: entryId }, { status: 201 });
+}
+
+export async function DELETE(req: NextRequest, { params }: Params) {
+  const { session, response } = await requireSession();
+  if (response) return response;
+  const { mealPlanId } = await params;
+
+  const access = await getMealPlanAccessById(mealPlanId, session!.user.id);
+  if (!access) return NextResponse.json({ error: "Not found" }, { status: 404 });
+  if (!canWriteMealPlan(access.role)) return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+
+  const entryId = req.nextUrl.searchParams.get("entryId");
+  if (!entryId) return NextResponse.json({ error: "entryId required" }, { status: 400 });
+
+  await db.delete(mealPlanEntries).where(
+    and(eq(mealPlanEntries.id, entryId), eq(mealPlanEntries.mealPlanId, mealPlanId))
+  );
+
+  return new NextResponse(null, { status: 204 });
+}
@@ -0,0 +1,27 @@
+import { NextRequest, NextResponse } from "next/server";
+import { db, mealPlans, users, eq } from "@epicure/db";
+import { requireSession } from "@/lib/api-auth";
+import { getMealPlanAccessById } from "@/lib/meal-plan-access";
+
+type Params = { params: Promise<{ mealPlanId: string }> };
+
+export async function GET(_req: NextRequest, { params }: Params) {
+  const { session, response } = await requireSession();
+  if (response) return response;
+  const { mealPlanId } = await params;
+
+  const access = await getMealPlanAccessById(mealPlanId, session!.user.id);
+  if (!access) return NextResponse.json({ error: "Not found" }, { status: 404 });
+
+  const plan = await db.query.mealPlans.findFirst({
+    where: eq(mealPlans.id, mealPlanId),
+    with: {
+      entries: { with: { recipe: { with: { photos: true } } } },
+    },
+  });
+  if (!plan) return NextResponse.json({ error: "Not found" }, { status: 404 });
+
+  const owner = await db.query.users.findFirst({ where: eq(users.id, plan.userId) });
+
+  return NextResponse.json({ ...plan, role: access.role, owner: owner ? { name: owner.name } : null });
+}