feat: ingredient CRUD endpoints with admin gating

backend/tests/test_ingredient_api.py

@@ -0,0 +1,76 @@
+import pytest
+
+pytestmark = pytest.mark.requires_postgres
+
+
+def _admin_headers() -> dict:
+    return {"Authorization": "Bearer test-admin-token"}
+
+
+def test_create_ingredient_returns_201_with_id(client):
+    body = {
+        "name": "Test Chicken Thighs",
+        "aliases": ["chicken thigh", "BSL chicken thighs"],
+        "aisle": "meat_seafood",
+        "unit": "lb",
+    }
+    r = client.post("/api/admin/ingredients", json=body, headers=_admin_headers())
+    assert r.status_code == 201, r.text
+    data = r.json()
+    assert data["id"]
+    assert data["aliases"] == ["chicken thigh", "BSL chicken thighs"]
+
+
+def test_create_ingredient_rejects_duplicate_name(client):
+    body = {"name": "Test Garlic Bulb", "aliases": [], "aisle": "produce", "unit": "clove"}
+    r1 = client.post("/api/admin/ingredients", json=body, headers=_admin_headers())
+    assert r1.status_code == 201
+    r2 = client.post("/api/admin/ingredients", json=body, headers=_admin_headers())
+    assert r2.status_code == 409
+
+
+def test_list_ingredients_supports_search(client):
+    client.post(
+        "/api/admin/ingredients",
+        json={"name": "Test Avocado Oil", "aliases": ["EVOO-test"], "aisle": "pantry", "unit": "tbsp"},
+        headers=_admin_headers(),
+    )
+    r = client.get("/api/ingredients?q=avocado")
+    assert r.status_code == 200
+    names = {row["name"] for row in r.json()}
+    assert "Test Avocado Oil" in names
+
+
+def test_create_ingredient_requires_admin_token(client):
+    body = {"name": "Test Meyer Lemon", "aisle": "produce", "unit": "ea", "aliases": []}
+    r = client.post("/api/admin/ingredients", json=body)
+    assert r.status_code == 401
+
+
+def test_update_ingredient_replaces_aliases(client):
+    create = client.post(
+        "/api/admin/ingredients",
+        json={"name": "Onion, Yellow", "aliases": ["yellow onion"], "aisle": "produce", "unit": "ea"},
+        headers=_admin_headers(),
+    )
+    iid = create.json()["id"]
+    r = client.patch(
+        f"/api/admin/ingredients/{iid}",
+        json={"aliases": ["yellow onion", "spanish onion"]},
+        headers=_admin_headers(),
+    )
+    assert r.status_code == 200
+    assert r.json()["aliases"] == ["yellow onion", "spanish onion"]
+
+
+def test_delete_ingredient_removes_row(client):
+    create = client.post(
+        "/api/admin/ingredients",
+        json={"name": "Sage", "aliases": [], "aisle": "produce", "unit": "tsp"},
+        headers=_admin_headers(),
+    )
+    iid = create.json()["id"]
+    r = client.delete(f"/api/admin/ingredients/{iid}", headers=_admin_headers())
+    assert r.status_code == 204
+    r2 = client.get(f"/api/ingredients/{iid}")
+    assert r2.status_code == 404