ci: Bump version to 0.7.20 [skip ci]

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "flyer-crawler",
-  "version": "0.7.17",
+  "version": "0.7.20",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "flyer-crawler",
-      "version": "0.7.17",
+      "version": "0.7.20",
       "dependencies": {
         "@bull-board/api": "^6.14.2",
         "@bull-board/express": "^6.14.2",

package.json

@@ -1,7 +1,7 @@
 {
   "name": "flyer-crawler",
   "private": true,
-  "version": "0.7.17",
+  "version": "0.7.20",
   "type": "module",
   "scripts": {
     "dev": "concurrently \"npm:start:dev\" \"vite\"",

src/routes/user.routes.test.ts

@@ -482,6 +482,12 @@ describe('User Routes (/api/users)', () => {
 
         expect(response.status).toBe(201);
         expect(response.body).toEqual(mockAddedItem);
+        expect(db.shoppingRepo.addShoppingListItem).toHaveBeenCalledWith(
+          listId,
+          mockUserProfile.user.user_id,
+          itemData,
+          expectLogger,
+        );
       });
 
       it('should return 400 on foreign key error when adding an item', async () => {
@@ -519,6 +525,12 @@ describe('User Routes (/api/users)', () => {
 
         expect(response.status).toBe(200);
         expect(response.body).toEqual(mockUpdatedItem);
+        expect(db.shoppingRepo.updateShoppingListItem).toHaveBeenCalledWith(
+          itemId,
+          mockUserProfile.user.user_id,
+          updates,
+          expectLogger,
+        );
       });
 
       it('should return 404 if item to update is not found', async () => {
@@ -554,6 +566,11 @@ describe('User Routes (/api/users)', () => {
           vi.mocked(db.shoppingRepo.removeShoppingListItem).mockResolvedValue(undefined);
           const response = await supertest(app).delete('/api/users/shopping-lists/items/101');
           expect(response.status).toBe(204);
+          expect(db.shoppingRepo.removeShoppingListItem).toHaveBeenCalledWith(
+            101,
+            mockUserProfile.user.user_id,
+            expectLogger,
+          );
         });
 
         it('should return 404 if item to delete is not found', async () => {

src/routes/user.routes.ts

@@ -478,10 +478,16 @@ router.post(
   validateRequest(addShoppingListItemSchema),
   async (req, res, next: NextFunction) => {
     logger.debug(`[ROUTE] POST /api/users/shopping-lists/:listId/items - ENTER`);
+    const userProfile = req.user as UserProfile;
     // Apply ADR-003 pattern for type safety
     const { params, body } = req as unknown as AddShoppingListItemRequest;
     try {
-      const newItem = await db.shoppingRepo.addShoppingListItem(params.listId, body, req.log);
+      const newItem = await db.shoppingRepo.addShoppingListItem(
+        params.listId,
+        userProfile.user.user_id,
+        body,
+        req.log,
+      );
       res.status(201).json(newItem);
     } catch (error) {
       if (error instanceof ForeignKeyConstraintError) {
@@ -512,11 +518,13 @@ router.put(
   validateRequest(updateShoppingListItemSchema),
   async (req, res, next: NextFunction) => {
     logger.debug(`[ROUTE] PUT /api/users/shopping-lists/items/:itemId - ENTER`);
+    const userProfile = req.user as UserProfile;
     // Apply ADR-003 pattern for type safety
     const { params, body } = req as unknown as UpdateShoppingListItemRequest;
     try {
       const updatedItem = await db.shoppingRepo.updateShoppingListItem(
         params.itemId,
+        userProfile.user.user_id,
         body,
         req.log,
       );
@@ -541,10 +549,11 @@ router.delete(
   validateRequest(shoppingListItemIdSchema),
   async (req, res, next: NextFunction) => {
     logger.debug(`[ROUTE] DELETE /api/users/shopping-lists/items/:itemId - ENTER`);
+    const userProfile = req.user as UserProfile;
     // Apply ADR-003 pattern for type safety
     const { params } = req as unknown as DeleteShoppingListItemRequest;
     try {
-      await db.shoppingRepo.removeShoppingListItem(params.itemId, req.log);
+      await db.shoppingRepo.removeShoppingListItem(params.itemId, userProfile.user.user_id, req.log);
       res.status(204).send();
     } catch (error: unknown) {
       logger.error(

src/services/db/flyer.db.test.ts

@@ -710,14 +710,4 @@ describe('Flyer DB Service', () => {
       );
     });
   });
-  describe('deleteFlyer - Ownership Check', () => {
-    it('should not delete flyer if the user does not own it', async () => {
-      mockPoolInstance.query.mockResolvedValue({ rowCount: 0 });
-
-      await expect(flyerRepo.deleteFlyer(1, mockLogger)).rejects.toThrow(
-        'Flyer with ID 1 not found.',
-      );
-    });
-  });
-
 });

src/services/db/shopping.db.test.ts

@@ -348,7 +348,7 @@ describe('Shopping DB Service', () => {
     it('should throw an error if no rows are deleted (item not found)', async () => {
       mockPoolInstance.query.mockResolvedValue({ rowCount: 0, rows: [], command: 'DELETE' });
       await expect(shoppingRepo.removeShoppingListItem(999, 'user-1', mockLogger)).rejects.toThrow(
-        'Shopping list item not found.',
+        'Shopping list item not found or user does not have permission.',
       );
     });
 
@@ -369,7 +369,7 @@ describe('Shopping DB Service', () => {
       mockPoolInstance.query.mockResolvedValue({ rowCount: 0 });
 
       await expect(shoppingRepo.removeShoppingListItem(1, 'wrong-user', mockLogger)).rejects.toThrow(
-        'Shopping list item not found.',
+        'Shopping list item not found or user does not have permission.',
       );
     });
   });

src/tests/integration/admin.integration.test.ts

@@ -164,7 +164,7 @@ describe('Admin API Routes Integration Tests', () => {
     beforeEach(async () => {
       const flyerRes = await getPool().query(
         `INSERT INTO public.flyers (store_id, file_name, image_url, item_count, checksum) 
-         VALUES ($1, 'admin-test.jpg', 'http://test.com/img.jpg', 1, $2) RETURNING flyer_id`,
+         VALUES ($1, 'admin-test.jpg', 'https://example.com/flyer-images/asdmin-test.jpg', 1, $2) RETURNING flyer_id`,
         // The checksum must be a unique 64-character string to satisfy the DB constraint.
         // We generate a dynamic string and pad it to 64 characters.
         [testStoreId, `checksum-${Date.now()}-${Math.random()}`.padEnd(64, '0')],

src/tests/integration/flyer.integration.test.ts

@@ -25,8 +25,8 @@ describe('Public Flyer API Routes Integration Tests', () => {
 
     const flyerRes = await getPool().query(
       `INSERT INTO public.flyers (store_id, file_name, image_url, item_count, checksum) 
-       VALUES ($1, 'integration-test.jpg', 'http://test.com/img.jpg', 1, $2) RETURNING flyer_id`,
-      [storeId, `checksum-${Date.now()}`.padEnd(64, '0')],
+       VALUES ($1, 'integration-test.jpg', 'https://example.com/flyer-images/integration-test.jpg', 1, $2) RETURNING flyer_id`,
+      [storeId, `${Date.now().toString(16)}`.padEnd(64, '0')],
     );
     createdFlyerId = flyerRes.rows[0].flyer_id;
 

src/tests/integration/price.integration.test.ts

@@ -35,22 +35,22 @@ describe('Price History API Integration Test (/api/price-history)', () => {
     // 3. Create two flyers with different dates
     const flyerRes1 = await pool.query(
       `INSERT INTO public.flyers (store_id, file_name, image_url, item_count, checksum, valid_from) 
-       VALUES ($1, 'price-test-1.jpg', 'http://test.com/price-1.jpg', 1, $2, '2025-01-01') RETURNING flyer_id`,
-      [storeId, `checksum-price-1-${Date.now()}`],
+       VALUES ($1, 'price-test-1.jpg', 'https://example.com/flyer-images/price-test-1.jpg', 1, $2, '2025-01-01') RETURNING flyer_id`,
+      [storeId, `${Date.now().toString(16)}1`.padEnd(64, '0')],
     );
     flyerId1 = flyerRes1.rows[0].flyer_id;
 
     const flyerRes2 = await pool.query(
       `INSERT INTO public.flyers (store_id, file_name, image_url, item_count, checksum, valid_from) 
-       VALUES ($1, 'price-test-2.jpg', 'http://test.com/price-2.jpg', 1, $2, '2025-01-08') RETURNING flyer_id`,
-      [storeId, `checksum-price-2-${Date.now()}`],
+       VALUES ($1, 'price-test-2.jpg', 'https://example.com/flyer-images/price-test-2.jpg', 1, $2, '2025-01-08') RETURNING flyer_id`,
+      [storeId, `${Date.now().toString(16)}2`.padEnd(64, '0')],
     );
     flyerId2 = flyerRes2.rows[0].flyer_id; // This was a duplicate, fixed.
 
     const flyerRes3 = await pool.query(
       `INSERT INTO public.flyers (store_id, file_name, image_url, item_count, checksum, valid_from) 
-       VALUES ($1, 'price-test-3.jpg', 'http://test.com/price-3.jpg', 1, $2, '2025-01-15') RETURNING flyer_id`,
-      [storeId, `checksum-price-3-${Date.now()}`],
+       VALUES ($1, 'price-test-3.jpg', '/flyer-images/price-test-3.jpg', 1, $2, '2025-01-15') RETURNING flyer_id`,
+      [storeId, `${Date.now().toString(16)}3`.padEnd(64, '0')],
     );
     flyerId3 = flyerRes3.rows[0].flyer_id;
 

src/tests/integration/public.routes.integration.test.ts

@@ -78,8 +78,8 @@ describe('Public API Routes Integration Tests', () => {
     testStoreId = storeRes.rows[0].store_id;
     const flyerRes = await pool.query(
       `INSERT INTO public.flyers (store_id, file_name, image_url, item_count, checksum) 
-       VALUES ($1, 'public-routes-test.jpg', 'http://test.com/public-routes.jpg', 1, $2) RETURNING *`,
-      [testStoreId, `checksum-public-routes-${Date.now()}`],
+       VALUES ($1, 'public-routes-test.jpg', 'https://example.com/flyer-images/public-routes-test.jpg', 1, $2) RETURNING *`,
+      [testStoreId, `${Date.now().toString(16)}`.padEnd(64, '0')],
     );
     testFlyer = flyerRes.rows[0];