Integration fix 3: keep recipe_url out of dinner responses (Feature 12 review F1) #97

Merged

approver_agent merged 5 commits from task/feature12-integration-fix3_0d863d7a-7991-484b-93ca-2aa84bd9f24d into feature/2066f34b-5804-410a-859b-f87021a8ae6c-regular-dinners-onboarding 2026-10-06 21:22:57 -04:00

Conversation 4 Commits 5 Files Changed 18

+356 -160

5 Commits

Author	SHA1	Message	Date
dev_agentandClaude Opus 5.5	51bae14b7b	Require the household's name for a Regular added from a link (PR #97 review R4-F1) ... A pasted link may carry a personal token anywhere in its path, so no part of it can safely name a dinner: the slug heuristic always let some plain words through. POST /api/v1/dinners now takes {name} or {name, recipe_url}; a link without a name is 400 invalid_dinner, and nameFromURL is gone. The link is still kept only for grounding and for the recipe-link duplicate rule. Name-created Regulars, grounding, and the rename rules are unchanged. On the Regulars screen, pasting a link shows a "Dinner name" field, and Add stays disabled until it is filled. The optimistic row shows that name, never the link. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 21:16:16 -04:00
dev_agentandClaude Opus 5.5	9574d1920e	Retire only the API cache when its version changes (PR #97 review F2, F3) ... F2: one shared cache version renamed every cache, so the v2 bump that drops the v1 API cache (dinner responses with the pasted recipe_url) also deleted saved photos, fonts and the precache. Each cache now carries its own version in cacheVersions; only api is v2, so activate deletes mealquest-api-v1 and keeps mealquest-precache-v1, -media-v1 and -fonts-v1. F3: replace the source-text activation test with src/sw.test.ts, which loads the worker with the Workbox precache and router stubbed, dispatches activate against mocked Cache Storage, and asserts caches.delete is called for mealquest-api-v1 only. tsconfig.sw.json type-checks the test with the worker's types. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 21:02:16 -04:00
dev_agentandClaude Opus 5.5	4e0c31b7d6	Name dinners from links with letter-only words (PR #97 review F2) ... Keep only words of at most 20 letters from the link's last path segment, so punctuated or long token text such as /stew-t=abcdef never reaches the dinner name, and stop at combined credential words like accesstoken. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 20:48:03 -04:00
dev_agentandClaude Opus 5.5	903a332375	Drop cached dinner responses and keep link tokens out of names (PR #97 review F1, F2) ... F1: bump the service worker cache version to v2 so activate deletes the v1 API cache, whose dinner responses still carried the pasted recipe_url and could be served offline. F2: nameFromURL now drops words holding a digit and ends the name at the first credential word (token, access, secret, ...), so a token in the link's last path segment never reaches the public dinner name. /recipes/beef-stew is still "Beef stew". Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 20:45:37 -04:00
dev_agentandClaude Opus 5.5	c15c8ec284	Keep recipe_url out of dinner responses (Feature 12 review F1) ... A pasted recipe link may carry a personal token in its query, and the dinners API returned it from create, list, get, patch and ground, where other household clients and the PWA's cache of dinner reads could keep it. Drop recipe_url from the public Dinner shape so it stays in the database for grounding and dedupe only. TestCreateDinnerByURL and TestCreateDinnerByName now assert the field is absent; TestDinnerResponsesHideRecipeURL creates a Regular from a token-bearing link and checks neither the create nor the list response holds the link, host or token while the stored link remains. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 20:35:19 -04:00