Seed provenance and inventory: source links and seed lots (#50)

"German Red Garlic" now links back to the Johnny's page it came from, and pansy knows how much is left. Two modelling calls, both of which look like omissions unless stated. The plant catalog stays FLAT — no species/variety hierarchy. A row in your catalog just is the thing you plant; the built-in "Garlic" is a generic starting point you clone. A hierarchy buys taxonomy nobody asked for and complicates every join. Inventory belongs to a PURCHASE, not to a variety. You might buy the same garlic from two vendors in two years at two prices and two germination rates; quantity columns on plants would collapse all of that into one number and lose it. So lots get their own table, and owner_id sits on the lot rather than being inherited from the plant — you can buy generic built-in Garlic from Johnny's and the record is still yours alone. Lots are never shared along with a garden. `remaining` is derived, never stored: quantity minus the summed effective count of the active plantings attributed to the lot. The alternative — decrementing a column when you plant — drifts the moment anything edits or removes a planting behind its back, and once it has drifted there's no way to tell what the true number was. Removing a plop gives the seed back with nothing having to remember to. The usage query returns raw radius/count/spacing rather than a SUM, because the effective-count formula lives in the service and reproducing it in SQL would guarantee the two drift apart. source_url is validated as http(s) with a host, on both plants and lots. It renders as a clickable link, so that check is load-bearing rather than tidiness: without it a stored javascript: URL becomes script execution the moment someone clicks it. Schemeless and relative URLs are refused too — they'd resolve against pansy's own origin, which is never what a vendor link means. A planting's lot must be the actor's AND a lot of the plant being planted. Attributing a garlic planting to a tomato lot would silently corrupt every remaining count downstream, so it's refused rather than stored, and re-checked on update in case a plant swap invalidated a previously-valid attribution. Deleting a lot leaves its plantings alone with a null link: the plants really were in the ground, whatever happened to the record of the packet. Closes #50 Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01H3zbym8Doka2d7D48maSgZ
2026-07-21 01:20:50 -04:00
parent 3ec77a1099
commit 81481ede2f
15 changed files with 1223 additions and 31 deletions
@@ -0,0 +1,345 @@
+package service
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"gitea.stevedudenhoeffer.com/steve/pansy/internal/domain"
+)
+
+// seedLot records a purchase of plantID with the given quantity in seeds.
+func seedLot(t *testing.T, s *Service, owner, plantID int64, qty float64, over func(*SeedLotInput)) *domain.SeedLot {
+	t.Helper()
+	in := SeedLotInput{PlantID: plantID, Quantity: qty, Unit: domain.UnitSeeds}
+	if over != nil {
+		over(&in)
+	}
+	l, err := s.CreateSeedLot(context.Background(), owner, in)
+	if err != nil {
+		t.Fatalf("CreateSeedLot: %v", err)
+	}
+	return l
+}
+
+// builtinPlantID returns a seeded built-in's id — the case that proves a lot can
+// reference a plant it doesn't own.
+func builtinPlantID(t *testing.T, s *Service, actor int64) int64 {
+	t.Helper()
+	plants, err := s.ListPlants(context.Background(), actor)
+	if err != nil {
+		t.Fatalf("ListPlants: %v", err)
+	}
+	for _, p := range plants {
+		if p.OwnerID == nil {
+			return p.ID
+		}
+	}
+	t.Fatal("no built-in plants seeded")
+	return 0
+}
+
+// TestTwoLotsOfOnePlantTrackIndependently — the reason inventory belongs to a
+// purchase and not to a variety: the same garlic from two vendors in two years
+// is two different things.
+func TestTwoLotsOfOnePlantTrackIndependently(t *testing.T) {
+	s := newTestService(t, openConfig())
+	owner := seedUser(t, s, "[email protected]")
+	g := seedGarden(t, s, owner)
+	bed := seedBed(t, s, owner, g.ID)
+	plant := seedOwnPlant(t, s, owner, 15)
+	ctx := context.Background()
+
+	johnnys := seedLot(t, s, owner, plant.ID, 100, func(in *SeedLotInput) {
+		in.Vendor = "Johnny's"
+		in.SourceURL = "https://www.johnnyseeds.com/vegetables/garlic/german-red-garlic"
+		in.PackedForYear = intPtr(2026)
+	})
+	fedco := seedLot(t, s, owner, plant.ID, 50, func(in *SeedLotInput) {
+		in.Vendor = "Fedco"
+		in.PackedForYear = intPtr(2025)
+	})
+
+	// Plant 12 out of the Johnny's lot only.
+	twelve := 12
+	if _, err := s.CreatePlanting(ctx, owner, bed.ID, PlantingInput{
+		PlantID: plant.ID, XCM: 0, YCM: 0, RadiusCM: 20, Count: &twelve, SeedLotID: &johnnys.ID,
+	}); err != nil {
+		t.Fatalf("CreatePlanting: %v", err)
+	}
+
+	lots, err := s.ListSeedLots(ctx, owner, nil)
+	if err != nil {
+		t.Fatalf("ListSeedLots: %v", err)
+	}
+	byID := map[int64]domain.SeedLot{}
+	for _, l := range lots {
+		byID[l.ID] = l
+	}
+	if got := byID[johnnys.ID]; got.Used != 12 || got.Remaining != 88 {
+		t.Errorf("Johnny's lot: used=%v remaining=%v, want 12/88", got.Used, got.Remaining)
+	}
+	if got := byID[fedco.ID]; got.Used != 0 || got.Remaining != 50 {
+		t.Errorf("Fedco lot: used=%v remaining=%v, want 0/50", got.Used, got.Remaining)
+	}
+	if byID[johnnys.ID].Vendor != "Johnny's" || byID[johnnys.ID].SourceURL == "" {
+		t.Errorf("provenance lost: %+v", byID[johnnys.ID])
+	}
+}
+
+// TestRemainingReturnsWhenAPlantingIsRemoved — the acceptance criterion, and the
+// reason `remaining` is derived rather than decremented on planting: removing a
+// plop has to give the seed back, without anything having to remember to.
+func TestRemainingReturnsWhenAPlantingIsRemoved(t *testing.T) {
+	s := newTestService(t, openConfig())
+	owner := seedUser(t, s, "[email protected]")
+	g := seedGarden(t, s, owner)
+	bed := seedBed(t, s, owner, g.ID)
+	plant := seedOwnPlant(t, s, owner, 15)
+	lot := seedLot(t, s, owner, plant.ID, 100, nil)
+	ctx := context.Background()
+
+	ten := 10
+	pl, err := s.CreatePlanting(ctx, owner, bed.ID, PlantingInput{
+		PlantID: plant.ID, XCM: 0, YCM: 0, RadiusCM: 20, Count: &ten, SeedLotID: &lot.ID,
+	})
+	if err != nil {
+		t.Fatalf("CreatePlanting: %v", err)
+	}
+	if got, _ := s.GetSeedLot(ctx, owner, lot.ID); got.Remaining != 90 {
+		t.Fatalf("remaining after planting = %v, want 90", got.Remaining)
+	}
+
+	// Soft-remove ("cleared the bed"): only ACTIVE plantings count against a lot.
+	today := "2026-08-01"
+	if _, err := s.UpdatePlanting(ctx, owner, pl.ID, PlantingPatch{
+		SetRemovedAt: true, RemovedAt: &today,
+	}, pl.Version); err != nil {
+		t.Fatalf("UpdatePlanting: %v", err)
+	}
+	if got, _ := s.GetSeedLot(ctx, owner, lot.ID); got.Remaining != 100 || got.Used != 0 {
+		t.Errorf("after removal: used=%v remaining=%v, want 0/100", got.Used, got.Remaining)
+	}
+}
+
+// TestLotOnBuiltinPlantIsPrivate — you can buy generic Garlic from Johnny's, so
+// a lot may point at a plant it doesn't own; the LOT is still yours alone.
+func TestLotOnBuiltinPlantIsPrivate(t *testing.T) {
+	s := newTestService(t, openConfig())
+	owner := seedUser(t, s, "[email protected]")
+	other := seedUser(t, s, "[email protected]")
+	ctx := context.Background()
+
+	builtin := builtinPlantID(t, s, owner)
+	lot := seedLot(t, s, owner, builtin, 25, func(in *SeedLotInput) { in.Vendor = "Johnny's" })
+
+	if _, err := s.GetSeedLot(ctx, owner, lot.ID); err != nil {
+		t.Fatalf("owner can't read their own lot: %v", err)
+	}
+	// Another user gets ErrNotFound, not Forbidden: existence stays masked.
+	if _, err := s.GetSeedLot(ctx, other, lot.ID); !errors.Is(err, domain.ErrNotFound) {
+		t.Errorf("other user read err = %v, want ErrNotFound", err)
+	}
+	if _, err := s.UpdateSeedLot(ctx, other, lot.ID, SeedLotPatch{Notes: strPtr("mine now")}, lot.Version); !errors.Is(err, domain.ErrNotFound) {
+		t.Errorf("other user update err = %v, want ErrNotFound", err)
+	}
+	if err := s.DeleteSeedLot(ctx, other, lot.ID); !errors.Is(err, domain.ErrNotFound) {
+		t.Errorf("other user delete err = %v, want ErrNotFound", err)
+	}
+	if lots, _ := s.ListSeedLots(ctx, other, nil); len(lots) != 0 {
+		t.Errorf("other user sees %d lots", len(lots))
+	}
+}
+
+// TestSourceURLValidation — the field renders as a clickable link, so the scheme
+// check is what stops a stored javascript: URL from becoming script execution.
+func TestSourceURLValidation(t *testing.T) {
+	s := newTestService(t, openConfig())
+	owner := seedUser(t, s, "[email protected]")
+	plant := seedOwnPlant(t, s, owner, 15)
+	ctx := context.Background()
+
+	ok := []string{
+		"",
+		"https://www.johnnyseeds.com/x",
+		"http://example.com/seeds?sku=123",
+	}
+	for _, u := range ok {
+		if _, err := s.CreateSeedLot(ctx, owner, SeedLotInput{
+			PlantID: plant.ID, Unit: domain.UnitSeeds, SourceURL: u,
+		}); err != nil {
+			t.Errorf("SourceURL %q rejected: %v", u, err)
+		}
+	}
+	bad := []string{
+		"javascript:alert(1)",
+		"JavaScript:alert(1)",
+		"data:text/html,<script>alert(1)</script>",
+		"//evil.example.com", // schemeless: would resolve against pansy's origin
+		"/seeds/garlic",      // relative, same reason
+		"file:///etc/passwd",
+		"https://", // no host
+	}
+	for _, u := range bad {
+		if _, err := s.CreateSeedLot(ctx, owner, SeedLotInput{
+			PlantID: plant.ID, Unit: domain.UnitSeeds, SourceURL: u,
+		}); !errors.Is(err, domain.ErrInvalidInput) {
+			t.Errorf("SourceURL %q accepted (err=%v)", u, err)
+		}
+	}
+	// The same rule applies to the plant's own source link.
+	if _, err := s.CreatePlant(ctx, owner, PlantInput{
+		Name: "X", Category: domain.CategoryHerb, SpacingCM: 10, Color: "#4a7c3f", Icon: "🌿",
+		SourceURL: "javascript:alert(1)",
+	}); !errors.Is(err, domain.ErrInvalidInput) {
+		t.Errorf("plant SourceURL accepted a javascript: URL (err=%v)", err)
+	}
+}
+
+// TestPlantCarriesProvenance — the headline: "German Red Garlic" links back to
+// the page it came from, and the built-ins keep working untouched.
+func TestPlantCarriesProvenance(t *testing.T) {
+	s := newTestService(t, openConfig())
+	owner := seedUser(t, s, "[email protected]")
+	ctx := context.Background()
+
+	p, err := s.CreatePlant(ctx, owner, PlantInput{
+		Name: "German Red Garlic", Category: domain.CategoryVegetable, SpacingCM: 15,
+		Color: "#8a5a8a", Icon: "🧄",
+		SourceURL: "https://www.johnnyseeds.com/vegetables/garlic/german-red-garlic",
+		Vendor:    "Johnny's Selected Seeds",
+	})
+	if err != nil {
+		t.Fatalf("CreatePlant: %v", err)
+	}
+	if p.Vendor != "Johnny's Selected Seeds" || p.SourceURL == "" {
+		t.Errorf("provenance not stored: %+v", p)
+	}
+
+	// The built-ins predate these columns and must still read cleanly.
+	plants, _ := s.ListPlants(ctx, owner)
+	for _, b := range plants {
+		if b.OwnerID == nil && (b.SourceURL != "" || b.Vendor != "") {
+			t.Errorf("built-in %q gained provenance from nowhere: %+v", b.Name, b)
+		}
+	}
+}
+
+// TestPlantingRejectsMismatchedLot — attributing a garlic planting to a tomato
+// lot would silently corrupt every remaining count downstream.
+func TestPlantingRejectsMismatchedLot(t *testing.T) {
+	s := newTestService(t, openConfig())
+	owner := seedUser(t, s, "[email protected]")
+	other := seedUser(t, s, "[email protected]")
+	g := seedGarden(t, s, owner)
+	bed := seedBed(t, s, owner, g.ID)
+	garlic := seedOwnPlant(t, s, owner, 15)
+	ctx := context.Background()
+
+	tomato, err := s.CreatePlant(ctx, owner, PlantInput{
+		Name: "Tomato", Category: domain.CategoryVegetable, SpacingCM: 45, Color: "#c0392b", Icon: "🍅",
+	})
+	if err != nil {
+		t.Fatalf("CreatePlant: %v", err)
+	}
+	tomatoLot := seedLot(t, s, owner, tomato.ID, 20, nil)
+
+	if _, err := s.CreatePlanting(ctx, owner, bed.ID, PlantingInput{
+		PlantID: garlic.ID, XCM: 0, YCM: 0, RadiusCM: 20, SeedLotID: &tomatoLot.ID,
+	}); !errors.Is(err, domain.ErrInvalidInput) {
+		t.Errorf("a garlic planting was attributed to a tomato lot (err=%v)", err)
+	}
+
+	// Someone else's lot is an invalid reference, not a leak of its existence.
+	othersPlant := seedOwnPlant(t, s, other, 15)
+	othersLot := seedLot(t, s, other, othersPlant.ID, 10, nil)
+	if _, err := s.CreatePlanting(ctx, owner, bed.ID, PlantingInput{
+		PlantID: garlic.ID, XCM: 0, YCM: 0, RadiusCM: 20, SeedLotID: &othersLot.ID,
+	}); !errors.Is(err, domain.ErrInvalidInput) {
+		t.Errorf("another user's lot was accepted (err=%v)", err)
+	}
+}
+
+// TestDeletingALotKeepsPlantingHistory — the plants really were in the ground,
+// whatever happened to the record of the packet.
+func TestDeletingALotKeepsPlantingHistory(t *testing.T) {
+	s := newTestService(t, openConfig())
+	owner := seedUser(t, s, "[email protected]")
+	g := seedGarden(t, s, owner)
+	bed := seedBed(t, s, owner, g.ID)
+	plant := seedOwnPlant(t, s, owner, 15)
+	lot := seedLot(t, s, owner, plant.ID, 100, nil)
+	ctx := context.Background()
+
+	pl, err := s.CreatePlanting(ctx, owner, bed.ID, PlantingInput{
+		PlantID: plant.ID, XCM: 0, YCM: 0, RadiusCM: 20, SeedLotID: &lot.ID,
+	})
+	if err != nil {
+		t.Fatalf("CreatePlanting: %v", err)
+	}
+	if err := s.DeleteSeedLot(ctx, owner, lot.ID); err != nil {
+		t.Fatalf("DeleteSeedLot: %v", err)
+	}
+	survived, err := s.store.GetPlanting(ctx, pl.ID)
+	if err != nil {
+		t.Fatalf("planting was destroyed with its lot: %v", err)
+	}
+	if survived.SeedLotID != nil {
+		t.Errorf("seedLotId = %v, want null after the lot was deleted", *survived.SeedLotID)
+	}
+}
+
+// TestSeedLotVersionGuard — lots are version-guarded like every other mutable row.
+func TestSeedLotVersionGuard(t *testing.T) {
+	s := newTestService(t, openConfig())
+	owner := seedUser(t, s, "[email protected]")
+	plant := seedOwnPlant(t, s, owner, 15)
+	lot := seedLot(t, s, owner, plant.ID, 100, nil)
+	ctx := context.Background()
+
+	updated, err := s.UpdateSeedLot(ctx, owner, lot.ID, SeedLotPatch{Notes: strPtr("half used")}, lot.Version)
+	if err != nil {
+		t.Fatalf("UpdateSeedLot: %v", err)
+	}
+	if updated.Notes != "half used" || updated.Version != lot.Version+1 {
+		t.Errorf("unexpected update: %+v", updated)
+	}
+	// Stale version → conflict, carrying the current row.
+	current, err := s.UpdateSeedLot(ctx, owner, lot.ID, SeedLotPatch{Notes: strPtr("stale")}, lot.Version)
+	if !errors.Is(err, domain.ErrVersionConflict) {
+		t.Fatalf("err = %v, want ErrVersionConflict", err)
+	}
+	if current == nil || current.Notes != "half used" {
+		t.Errorf("conflict should carry the current row, got %+v", current)
+	}
+}
+
+// TestSeedLotUnitAndQuantityValidation
+func TestSeedLotUnitAndQuantityValidation(t *testing.T) {
+	s := newTestService(t, openConfig())
+	owner := seedUser(t, s, "[email protected]")
+	plant := seedOwnPlant(t, s, owner, 15)
+	ctx := context.Background()
+
+	if _, err := s.CreateSeedLot(ctx, owner, SeedLotInput{PlantID: plant.ID, Unit: "handfuls"}); !errors.Is(err, domain.ErrInvalidInput) {
+		t.Errorf("unknown unit accepted: %v", err)
+	}
+	if _, err := s.CreateSeedLot(ctx, owner, SeedLotInput{
+		PlantID: plant.ID, Unit: domain.UnitSeeds, Quantity: -1,
+	}); !errors.Is(err, domain.ErrInvalidInput) {
+		t.Errorf("negative quantity accepted: %v", err)
+	}
+	pct := 140.0
+	if _, err := s.CreateSeedLot(ctx, owner, SeedLotInput{
+		PlantID: plant.ID, Unit: domain.UnitSeeds, GerminationPct: &pct,
+	}); !errors.Is(err, domain.ErrInvalidInput) {
+		t.Errorf("140%% germination accepted: %v", err)
+	}
+	if _, err := s.CreateSeedLot(ctx, owner, SeedLotInput{
+		PlantID: plant.ID, Unit: domain.UnitSeeds, PurchasedAt: strPtr("not-a-date"),
+	}); !errors.Is(err, domain.ErrInvalidInput) {
+		t.Errorf("malformed purchase date accepted: %v", err)
+	}
+}
+
+func intPtr(v int) *int { return &v }