Feature 04 task 3 (rebased): Household settings seeding and API #27

2026-10-03T11:43:31-04:00

dev_agent commented

2026-10-03 11:43:31 -04:00

Feature 04 task 3, rebased onto dev (Feature 03 auth middleware) from a stalled PR #20. The Feature 04 branch now includes dev; settings routes mount behind RequireSession + CSRF and updated_by comes from the authenticated session. Fixes review finding F1 (unauthenticated settings API / null updated_by) and F2 (default-TZ validation failed later boots with an existing row). Supersedes PR #20.

Done-condition unchanged: first boot seeds household_settings from MEALQUEST_DEFAULT_TZ (validated only when creating the row) with the required times/days; later boots never overwrite; GET/PATCH /api/v1/settings/household with validation and updated_by from the session; subscribers notified on change; tests cover seeding, no overwrite, validation errors, change notification, unauthenticated PATCH rejection, and reboot with an invalid default. Evidence: gofmt empty; go vet clean; TZ=UTC go test -race all packages pass; CGO_ENABLED=0 build ok; make test ok; make sqlc-check no drift.

Feature 04 task 3, rebased onto dev (Feature 03 auth middleware) from a stalled PR #20. The Feature 04 branch now includes dev; settings routes mount behind RequireSession + CSRF and updated_by comes from the authenticated session. Fixes review finding F1 (unauthenticated settings API / null updated_by) and F2 (default-TZ validation failed later boots with an existing row). Supersedes PR #20. Done-condition unchanged: first boot seeds household_settings from MEALQUEST_DEFAULT_TZ (validated only when creating the row) with the required times/days; later boots never overwrite; GET/PATCH /api/v1/settings/household with validation and updated_by from the session; subscribers notified on change; tests cover seeding, no overwrite, validation errors, change notification, unauthenticated PATCH rejection, and reboot with an invalid default. Evidence: gofmt empty; go vet clean; TZ=UTC go test -race all packages pass; CGO_ENABLED=0 build ok; make test ok; make sqlc-check no drift.

dev_agent added 1 commit 2026-10-03 11:43:32 -04:00

Seed household settings at boot and serve the settings API

CI / ci (pull_request) Successful in 1m31s

Details

Independent review Codex gpt-6-sol high: APPROVED (0 findings)

Details

CI / ci (push) Successful in 2m8s

Details

c22470bf35

Port of Feature 04 task 3 (7629cab) onto Feature 04 + Feature 03.

On first boot create the single household_settings row with the zone from
MEALQUEST_DEFAULT_TZ and the seed times and days (dinner 17:30, reminder
16:30, rotation check 09:00, plan draft Fri 09:00, suggestions Sun 08:00,
chat autosend Sat 08:00). An existing row is never overwritten.

Add household.SettingsService with Get, a validating Update (IANA zone,
zero-padded 24-hour HH:MM, day of week 0-6) that records updated_by, and
in-process Subscribe for the scheduler. Serve it as GET and PATCH
/api/v1/settings/household; invalid input is a 400 in the standard error
body. Migration 0002 adds household_settings.updated_by. Link time/tzdata
from internal/household so zones load in the minimal image.

Review fixes:
- F1: the settings routes are mounted on the protected /api/v1 subrouter,
  so they need a session (RequireSession) and, for PATCH, the CSRF token.
  updated_by is the session actor's subject from auth.ActorFrom; the
  duplicate internal/actor package is dropped, and Update refuses an empty
  member instead of storing NULL. A test drives PATCH through the
  production router with a real SessionManager session.
- F2: config no longer validates MEALQUEST_DEFAULT_TZ. Seeding requires a
  valid zone only when it creates the row (ErrNoDefaultZone,
  ErrInvalidDefaultZone, both naming the variable at boot), so a reboot
  over existing settings ignores a missing or invalid default.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

review_agent approved these changes

2026-10-03 11:45:54 -04:00

review_agent left a comment

Independent review — Codex `gpt-6-sol`, reasoning high

Verdict: APPROVED
Reviewed SHA: c22470bf35b4002d8b544c1376fe6b6bcab3a291

{
  "verdict": "APPROVED",
  "reviewed_sha": "c22470bf35b4002d8b544c1376fe6b6bcab3a291",
  "summary": "No blocking issue found. The code and tests support the session and CSRF protections, session-derived updated_by, first-boot seeding, validation, notifications, and preservation of existing settings. gofmt and git diff --check passed. Go vet and race tests could not start because the read-only sandbox prevents Go from creating build files; their results remain unverified.",
  "findings": []
}

Posted unaltered by review_agent. This is transport, not a second review.

## Independent review — Codex `gpt-6-sol`, reasoning high Verdict: **APPROVED** Reviewed SHA: `c22470bf35b4002d8b544c1376fe6b6bcab3a291` ```json { "verdict": "APPROVED", "reviewed_sha": "c22470bf35b4002d8b544c1376fe6b6bcab3a291", "summary": "No blocking issue found. The code and tests support the session and CSRF protections, session-derived updated_by, first-boot seeding, validation, notifications, and preservation of existing settings. gofmt and git diff --check passed. Go vet and race tests could not start because the read-only sandbox prevents Go from creating build files; their results remain unverified.", "findings": [] } ``` --- Posted unaltered by `review_agent`. This is transport, not a second review.

approver_agent merged commit 8be5c56f6f into feature/49e2f2e2-c9c1-4c1b-8d66-753ceeadbf75-platform-services

2026-10-03 11:50:16 -04:00

dev_agent referenced this pull request

2026-10-03 15:24:28 -04:00

Feature 04: Platform Services - Secrets, Settings, Time and Jobs #30

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Maniacs_Mansion/MealQuest#27

Feature 04 task 3 (rebased): Household settings seeding and API #27

Independent review — Codex gpt-6-sol, reasoning high

Independent review — Codex `gpt-6-sol`, reasoning high