feat(16-04): update all service tests to pass userId and add isolation tests

- Destructure { db, userId } from createTestDb() in all 8 service test files
- Pass userId to every service function call
- Add cross-user isolation tests for items, categories, threads, setups
- Add composite unique constraint test for categories
- Update verifyApiKey assertions to check { userId } return
- Update verifyAccessToken assertions to check { userId } return
- Pass userId to exchangeCode and refreshAccessToken calls

tests/services/category.service.test.ts

@@ -8,18 +8,22 @@ import {
 	updateCategory,
 } from "../../src/server/services/category.service.ts";
 import { createItem } from "../../src/server/services/item.service.ts";
-import { createTestDb } from "../helpers/db.ts";
+import { createSecondTestUser, createTestDb } from "../helpers/db.ts";
 
 describe("Category Service", () => {
 	let db: any;
+	let userId: number;
 
 	beforeEach(async () => {
-		db = await createTestDb();
+		({ db, userId } = await createTestDb());
 	});
 
 	describe("createCategory", () => {
 		it("creates with name and icon", async () => {
-			const cat = await createCategory(db, { name: "Shelter", icon: "tent" });
+			const cat = await createCategory(db, userId, {
+				name: "Shelter",
+				icon: "tent",
+			});
 
 			expect(cat).toBeDefined();
 			expect(cat?.id).toBeGreaterThan(0);
@@ -28,7 +32,7 @@ describe("Category Service", () => {
 		});
 
 		it("uses default icon if not provided", async () => {
-			const cat = await createCategory(db, { name: "Cooking" });
+			const cat = await createCategory(db, userId, { name: "Cooking" });
 
 			expect(cat).toBeDefined();
 			expect(cat?.icon).toBe("package");
@@ -37,10 +41,13 @@ describe("Category Service", () => {
 
 	describe("getAllCategories", () => {
 		it("returns all categories", async () => {
-			await createCategory(db, { name: "Shelter", icon: "tent" });
-			await createCategory(db, { name: "Cooking", icon: "cooking-pot" });
+			await createCategory(db, userId, { name: "Shelter", icon: "tent" });
+			await createCategory(db, userId, {
+				name: "Cooking",
+				icon: "cooking-pot",
+			});
 
-			const all = await getAllCategories(db);
+			const all = await getAllCategories(db, userId);
 			// Includes seeded Uncategorized + 2 new
 			expect(all.length).toBeGreaterThanOrEqual(3);
 		});
@@ -48,8 +55,13 @@ describe("Category Service", () => {
 
 	describe("updateCategory", () => {
 		it("renames category", async () => {
-			const cat = await createCategory(db, { name: "Shelter", icon: "tent" });
-			const updated = await updateCategory(db, cat?.id, { name: "Sleep System" });
+			const cat = await createCategory(db, userId, {
+				name: "Shelter",
+				icon: "tent",
+			});
+			const updated = await updateCategory(db, userId, cat?.id, {
+				name: "Sleep System",
+			});
 
 			expect(updated).toBeDefined();
 			expect(updated?.name).toBe("Sleep System");
@@ -57,41 +69,81 @@ describe("Category Service", () => {
 		});
 
 		it("changes icon", async () => {
-			const cat = await createCategory(db, { name: "Shelter", icon: "tent" });
-			const updated = await updateCategory(db, cat?.id, { icon: "home" });
+			const cat = await createCategory(db, userId, {
+				name: "Shelter",
+				icon: "tent",
+			});
+			const updated = await updateCategory(db, userId, cat?.id, {
+				icon: "home",
+			});
 
 			expect(updated).toBeDefined();
 			expect(updated?.icon).toBe("home");
 		});
 
 		it("returns null for non-existent id", async () => {
-			const result = await updateCategory(db, 9999, { name: "Ghost" });
+			const result = await updateCategory(db, userId, 9999, {
+				name: "Ghost",
+			});
 			expect(result).toBeNull();
 		});
 	});
 
 	describe("deleteCategory", () => {
-		it("reassigns items to Uncategorized (id=1) then deletes", async () => {
-			const shelter = await createCategory(db, { name: "Shelter", icon: "tent" });
-			await createItem(db, { name: "Tent", categoryId: shelter?.id });
-			await createItem(db, { name: "Tarp", categoryId: shelter?.id });
+		it("reassigns items to Uncategorized then deletes", async () => {
+			const shelter = await createCategory(db, userId, {
+				name: "Shelter",
+				icon: "tent",
+			});
+			await createItem(db, userId, {
+				name: "Tent",
+				categoryId: shelter?.id,
+			});
+			await createItem(db, userId, {
+				name: "Tarp",
+				categoryId: shelter?.id,
+			});
 
-			const result = await deleteCategory(db, shelter?.id);
+			const result = await deleteCategory(db, userId, shelter?.id);
 			expect(result.success).toBe(true);
 
-			// Items should now be in Uncategorized (id=1)
+			// Items should now be in the Uncategorized category (id=1 for first user)
 			const reassigned = await db
 				.select()
 				.from(items)
 				.where(eq(items.categoryId, 1));
 			expect(reassigned).toHaveLength(2);
-			expect(reassigned.map((i: any) => i.name).sort()).toEqual(["Tarp", "Tent"]);
+			expect(reassigned.map((i: any) => i.name).sort()).toEqual([
+				"Tarp",
+				"Tent",
+			]);
 		});
 
-		it("cannot delete Uncategorized (id=1)", async () => {
-			const result = await deleteCategory(db, 1);
+		it("cannot delete Uncategorized", async () => {
+			const result = await deleteCategory(db, userId, 1);
 			expect(result.success).toBe(false);
 			expect(result.error).toBeDefined();
 		});
 	});
+
+	describe("composite unique constraint", () => {
+		it("two users can have categories with the same name", async () => {
+			const userId2 = await createSecondTestUser(db);
+
+			const cat1 = await createCategory(db, userId, {
+				name: "Cycling",
+				icon: "bike",
+			});
+			const cat2 = await createCategory(db, userId2, {
+				name: "Cycling",
+				icon: "bike",
+			});
+
+			expect(cat1).toBeDefined();
+			expect(cat2).toBeDefined();
+			expect(cat1?.name).toBe("Cycling");
+			expect(cat2?.name).toBe("Cycling");
+			expect(cat1?.id).not.toBe(cat2?.id);
+		});
+	});
 });