Commit Graph

143 Commits

Author SHA1 Message Date
afcea6590d feat(auth): add autocomplete attributes to signup form inputs
name, email, new-password for better browser/password-manager support.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-02 14:58:59 +02:00
75a13d9df1 fix(auth): style login link green/font-medium per spec
Spec shows green text with font-weight 500, no underline by default.
Was dark text with underline.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-02 14:57:47 +02:00
b71c98662b fix(auth): use --green-dark on submit button for WCAG AA contrast
--green (#3D8C4A) gives 4.16:1 against white — fails AA.
--green-dark (#2E6E39) passes comfortably.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-02 14:56:49 +02:00
bfa8f20fe3 test(auth): add no-nav-chrome regression test for signup page
Verifies signup page renders form and brand panel but no
navigation elements (tabs, sidebar, links to app routes).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-02 14:48:23 +02:00
596652d6e4 feat(auth): add signup page with form action
Composes BrandPanel + SignupForm in responsive split layout.
Server action POSTs to /v1/auth/signup and redirects to
/household/setup on success.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-02 14:47:36 +02:00
d3a8518298 feat(auth): add SignupForm component with validation and password toggle
Form with name/email/password fields, client-side validation,
inline error messages, and password show/hide toggle.
Uses native form action for progressive enhancement.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-02 14:45:54 +02:00
d5d85d1156 rename backend service 2026-04-02 14:45:11 +02:00
e8fe69a543 feat(auth): add BrandPanel component for signup screen
Renders brand identity with logo, app name, tagline, and feature icons
on green-dark background. Responsive: banner on mobile, 440px column
on desktop.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-02 14:41:10 +02:00
56fc7e6052 feat(auth): add /signup to public routes
Allow unauthenticated access to the signup page.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-02 14:39:17 +02:00
66cf538454 refactor(auth): make (public) layout bare, move brand panel into login page
The signup page needs its own brand panel, so the shared layout
becomes a simple slot. Login page now owns its brand panel markup.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-02 14:38:30 +02:00
682580e11d feat(nav): add hover state on inactive tablet and desktop nav items
Applies hover:bg-[var(--color-subtle)] to inactive nav links for
visual feedback on pointer devices.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-02 14:04:50 +02:00
5c066d33ef feat(nav): add emoji icons to all nav components
Renders emoji icons in MobileTabBar (stacked above label),
TabletNavBar (inline), and DesktopSidebar (16px, 20px column).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-02 14:03:53 +02:00
4bd020fa16 test(nav): add parameterized active-state tests for all routes
Proves active state logic generalizes beyond /planner by testing
all 4 mobile nav routes with writable page store.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-02 14:01:26 +02:00
bd8e901685 fix(nav): use segment-boundary route matching to prevent false positives
Extracts isActiveRoute() into shared nav module. Matches exact path
or path + '/' prefix, preventing /settings from matching /settings-advanced.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-02 14:00:18 +02:00
aeaca76534 fix(auth): handle users without household — fallback to 'Kein Haushalt'
Removes non-null assertions on householdId/householdName. Users who
haven't joined a household get a fallback name in the sidebar.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-02 13:58:37 +02:00
32550377aa fix(auth): read JSESSIONID cookie to match Spring Security default
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-02 13:57:34 +02:00
92c7d8f92e feat(auth): preserve redirect URL when redirecting to /login
Appends ?redirect= with the original pathname so the login page
can redirect back after successful authentication.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-02 13:56:49 +02:00
cc74c0042a test(auth): add isPublicRoute boundary tests for sub-paths and trailing slash
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-02 13:55:48 +02:00
2bdb1010f8 fix(auth): bypass auth guard for static assets and favicon
Prevents redirect loop when backend is down — login page CSS/JS
would otherwise be redirected to /login.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-02 13:55:03 +02:00
d7f317587e refactor(public): add lang="ts" to public layout for consistency
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-02 13:53:56 +02:00
05bf66de56 refactor(test): replace require() with import() in $app/stores mocks
CJS require() is fragile in an ESM project. Use async import() instead.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-02 13:53:20 +02:00
db4b01ca77 refactor(config): document resolve.conditions safety for SSR builds
Verified: SvelteKit's plugin overrides resolve.conditions for SSR
builds. The global 'browser' condition only affects vitest and dev.
Build output confirmed correct with npm run build.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-02 13:52:23 +02:00
9626bde694 feat(shell): add route groups, layout server load, redirect, and placeholder pages
- (app) group with AppShell layout, loads user/household from locals
- (public) group with full-viewport split layout, /login placeholder
- Root / redirects to /planner for authenticated users
- Placeholder stubs for planner, recipes, shopping, settings, members

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-02 13:22:34 +02:00
7a17873046 feat(auth): add auth guard in hooks.server.ts with session validation
Validates session cookie via GET /v1/auth/me, populates event.locals
with benutzer and haushalt, redirects to /login if unauthenticated.
Public routes (/login, /register, /invite) bypass auth.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-02 13:19:40 +02:00
cfe38c39aa feat(nav): add AppShell layout with breakpoint-switched navigation
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-02 13:18:09 +02:00
56cfd137aa feat(nav): add DesktopSidebar with logo, nav sections, and variety widget slot
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-02 13:16:12 +02:00
8f33f469de feat(nav): add TabletNavBar with horizontal pills and active state
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-02 13:14:12 +02:00
d3fa8991fe feat(nav): add MobileTabBar with active state and safe-area padding
Fixed vitest resolve conditions to use browser entry for Svelte 5.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-02 13:12:04 +02:00
7ae1f3dc18 feat(nav): add shared navigation config with mobile and desktop items
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-02 13:09:26 +02:00
0a2ef750c4 feat(design-system): add Tailwind 4 @theme tokens, fonts, and completeness tests
- Load Fraunces, DM Sans, DM Mono via Google Fonts preconnect in app.html
- Define all design tokens in @theme block: neutrals, green/yellow/blue/
  purple/orange scales, spacing (--space-1..20), radii, shadows, button base
- Note --green-dark as button background (--green fails WCAG AA with white)
- Add @types/node for Node fs/path usage in design-system tests

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-02 12:45:11 +02:00
7c8d725fce test(design-system): assert WCAG 2.2 AA contrast for key color pairs
White on --green-dark (not --green) is the correct button background;
--green (#3D8C4A) gives only 4.16:1 which fails AA for normal-size text.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-02 12:43:21 +02:00
82815205d0 Wire frontend into Docker Compose with type-safe API client
- Add frontend service to docker-compose.yml (port 3000, BACKEND_URL env var)
- Add frontend/Dockerfile using adapter-node for plain Node/Docker runtime
- Switch svelte.config.js from adapter-auto to adapter-node
- Generate OpenAPI types from backend spec (openapi-typescript + openapi-fetch)
- Add src/lib/server/api.ts as server-only typed API client factory
- Add generate:api script to regenerate types when backend spec changes

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-02 12:36:09 +02:00
b36d4c731d Add frontend journey specs with visual previews and LLM instructions
Six self-contained HTML documents, one per user journey, each combining
mobile/desktop previews with machine-readable implementation guides:

- j1-add-recipe.html (B1, B3)
- j2-plan-the-week.html (C1, C2, C3)
- j3-cook-tonight.html (B2, B4)
- j4-adapt-on-the-fly.html (swap trigger, C2 swap)
- j5-shopping-list.html (D1)
- j6-household-setup.html (A1, A2, A3/D3, A4)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-02 12:17:47 +02:00
9713412d42 Remove service interfaces — use concrete classes directly
Each domain had a single-implementation interface (e.g. AdminService
interface + AdminServiceImpl). Merged implementation into the service
class and deleted the redundant interfaces per KISS principle.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-02 11:04:41 +02:00
03b96e8584 Remove shopping list draft/publish workflow — lists are always live
Shopping lists no longer go through a draft → published lifecycle.
They are immediately usable upon generation from a week plan.

Removed: status/published_at columns (V021 migration), publish endpoint,
PublishResponse DTO, delete-item guard, and 4 related tests.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-02 11:03:54 +02:00
8221a1fd41 Rewrite variety score and suggestions with configurable scoring
- Add VarietyScoreConfig entity, repository, and V020 migration for
  per-household scoring weights and configurable tag types
- Rewrite getVarietyScore: tag-type repeats on consecutive days,
  non-staple ingredient overlaps, cooking log history, plan duplicates
- Rewrite getSuggestions: simulate variety score for each candidate,
  add tag filter (AND, case-insensitive) and configurable topN param
- Update SuggestionResponse to return simulatedScore instead of
  fitReasons/warnings, update VarietyScoreResponse to new shape
- Seed default VarietyScoreConfig on household creation
- Extend test suite across all domains (+270 tests, all passing)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-02 10:33:11 +02:00
9ec703abcd Implement Recipe, Planning, Shopping, Pantry, and Admin domains
Outside-in TDD for all 5 remaining domains (128 tests total):
- Recipe: CRUD, ingredients autocomplete/patch, tags, categories (27 tests)
- Planning: week plans, slots, confirm, suggestions, variety score, cooking logs (24 tests)
- Shopping: generate from plan, publish, check/add/remove items (15 tests)
- Pantry: CRUD with expiry sorting (11 tests)
- Admin: user management, password reset, audit logging (13 tests)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-01 21:56:51 +02:00
4f457303d8 Implement household domain with outside-in TDD (15 tests)
Controller (5 tests): create household, get mine, get members,
create invite, accept invite.

Service (10 tests): household creation with planner role + seed
data (categories, tags, staple ingredients), conflict when already
in household, invite code generation with 48h expiry, accept invite
with expired/used/conflict validation.

Also includes:
- Household, HouseholdMember, HouseholdInvite JPA entities
- HouseholdInvite repository with findByInviteCode
- Ingredient, IngredientCategory, Tag entities + repositories
  (created early for seed data, will be extended in recipe domain)
- Fixed BackendApplicationTests to use AbstractIntegrationTest

Total: 38 tests passing.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-01 21:31:00 +02:00
3253dcfec2 Implement auth domain with outside-in TDD (22 tests)
Controller (7 tests): signup, login, logout, GET/PATCH me.
Standalone MockMvc setup (Boot 4 removed @WebMvcTest).

Service (11 tests): signup with conflict check, login with
password/active validation, getCurrentUser with household info,
updateProfile with password change flow.

Repository (4 tests): save/find, case-insensitive email via
IgnoreCase queries (citext + Hibernate needs explicit IgnoreCase),
existsByEmail.

Also includes:
- SecurityConfig: session auth, CSRF, role-based authorization
- CustomUserDetailsService: loads UserAccount for Spring Security
- UserAccount, Household, HouseholdMember JPA entities
- spring-boot-flyway dependency (Boot 4 requires explicit module)
- ddl-auto=none (Flyway owns schema, validate fails on citext)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-01 21:24:26 +02:00
866603711d Add test infrastructure and common module
- Testcontainers 2.0.4 (PostgreSQL) for repository integration tests
- AbstractIntegrationTest base class with shared Postgres container
- application-test.yml for test profile
- Common module: ApiResponse/ApiError envelopes, GlobalExceptionHandler,
  ResourceNotFoundException, ConflictException, ValidationException,
  HouseholdContext record

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-01 21:05:17 +02:00
10b4d567d3 Add Flyway migrations V001-V019 for all 18 tables
V001: pgcrypto + citext extensions, trigger_set_updated_at function.
V002-V019: tables in FK dependency order per data model v1.1.

Spec fixes incorporated:
- recipe: added created_at/updated_at (spec says all mutable tables
  carry audit timestamps, but ERD omitted them)
- shopping_list: added household_id FK for HouseholdContext scoping
- shopping_list_item: added checked_by FK (API returns checkedBy)
- cooking_log: omitted phantom week_plan_slot_id (in FK map but
  absent from ERD, API, and all journeys)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-01 20:56:25 +02:00
247a130b69 Scaffold Spring Boot 4.0.5 project with domain packages
Maven project with Java 21. Dependencies: web, data-jpa, security,
validation, flyway, postgresql, springdoc-openapi 3.0.2.
Package-by-domain structure: auth, household, recipe, planning,
shopping, pantry, admin, common. JPA open-in-view disabled,
Hibernate ddl-auto=validate (Flyway owns the schema).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-01 20:54:18 +02:00
c11d5ff192 Add Docker Compose setup with PostgreSQL 16 and Spring Boot app
Multi-stage Dockerfile for the backend (build + runtime).
Compose defines db (postgres:16-alpine with healthcheck) and app services.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-01 20:51:54 +02:00