feat(report): improve daily intelligence UX and price tracking

cmd/server/main_test.go

@@ -7,7 +7,9 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"os"
+	"strings"
 	"testing"
+	"time"
 )
 
 func TestModelsHandlerReturnsFlatPricingFields(t *testing.T) {
@@ -59,6 +61,131 @@ func TestModelsHandlerReturnsFlatPricingFields(t *testing.T) {
 	}
 }
 
+func TestModelsHandlerReturnsJSONErrorEnvelope(t *testing.T) {
+	mux := newMux(
+		nil,
+		func(context.Context, *sql.DB) ([]modelResponse, error) {
+			return nil, nil
+		},
+		func(context.Context, *sql.DB) ([]subscriptionPlanResponse, error) {
+			return nil, nil
+		},
+		func(context.Context, *sql.DB) (*latestReportResponse, error) {
+			return nil, sql.ErrNoRows
+		},
+	)
+
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/models", nil)
+	rec := httptest.NewRecorder()
+	mux.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusServiceUnavailable {
+		t.Fatalf("expected status 503, got %d", rec.Code)
+	}
+
+	var payload struct {
+		Error struct {
+			Code    string `json:"code"`
+			Message string `json:"message"`
+		} `json:"error"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &payload); err != nil {
+		t.Fatalf("unmarshal error response: %v", err)
+	}
+	if payload.Error.Code != "database_not_configured" {
+		t.Fatalf("unexpected error code: %q", payload.Error.Code)
+	}
+}
+
+func TestHealthHandlerReturnsJSONErrorEnvelope(t *testing.T) {
+	mux := newMux(
+		nil,
+		func(context.Context, *sql.DB) ([]modelResponse, error) {
+			return nil, nil
+		},
+		func(context.Context, *sql.DB) ([]subscriptionPlanResponse, error) {
+			return nil, nil
+		},
+		func(context.Context, *sql.DB) (*latestReportResponse, error) {
+			return nil, sql.ErrNoRows
+		},
+	)
+
+	req := httptest.NewRequest(http.MethodGet, "/health", nil)
+	rec := httptest.NewRecorder()
+	mux.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusServiceUnavailable {
+		t.Fatalf("expected status 503, got %d", rec.Code)
+	}
+
+	var payload struct {
+		Error struct {
+			Code    string `json:"code"`
+			Message string `json:"message"`
+		} `json:"error"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &payload); err != nil {
+		t.Fatalf("unmarshal health error response: %v", err)
+	}
+	if payload.Error.Code != "database_not_configured" {
+		t.Fatalf("unexpected error code: %q", payload.Error.Code)
+	}
+}
+
+func TestLatestReportHTMLHandlerReturnsJSONErrorEnvelope(t *testing.T) {
+	mux := newMux(
+		&sql.DB{},
+		func(context.Context, *sql.DB) ([]modelResponse, error) {
+			return nil, nil
+		},
+		func(context.Context, *sql.DB) ([]subscriptionPlanResponse, error) {
+			return nil, nil
+		},
+		func(context.Context, *sql.DB) (*latestReportResponse, error) {
+			return nil, sql.ErrNoRows
+		},
+	)
+
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/reports/latest/html", nil)
+	rec := httptest.NewRecorder()
+	mux.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusNotFound {
+		t.Fatalf("expected status 404, got %d", rec.Code)
+	}
+
+	var payload struct {
+		Error struct {
+			Code    string `json:"code"`
+			Message string `json:"message"`
+		} `json:"error"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &payload); err != nil {
+		t.Fatalf("unmarshal latest html error response: %v", err)
+	}
+	if payload.Error.Code != "latest_report_not_found" {
+		t.Fatalf("unexpected error code: %q", payload.Error.Code)
+	}
+}
+
+func TestFetchModelsQueryEncodesPrimaryPricePriority(t *testing.T) {
+	fragments := []string{
+		"CASE WHEN lower(rp.region) = 'global' THEN 0 ELSE 1 END",
+		"WHEN 'official' THEN 0",
+		"WHEN 'reseller' THEN 1",
+		"WHEN 'free_tier' THEN 2",
+		"rp.effective_date DESC NULLS LAST",
+		"rp.id DESC",
+	}
+
+	for _, fragment := range fragments {
+		if !strings.Contains(fetchModelsQuery, fragment) {
+			t.Fatalf("fetchModelsQuery missing fragment %q", fragment)
+		}
+	}
+}
+
 func TestSubscriptionPlansHandlerReturnsEnvelope(t *testing.T) {
 	mux := newMux(
 		&sql.DB{},
@@ -211,3 +338,137 @@ func TestLatestReportHTMLHandlerServesArtifact(t *testing.T) {
 		t.Fatalf("unexpected body: %q", body)
 	}
 }
+
+func TestModelsHandlerRejectsUnauthenticatedExternalRequests(t *testing.T) {
+	mux := newMuxWithConfig(
+		&sql.DB{},
+		func(context.Context, *sql.DB) ([]modelResponse, error) {
+			return nil, nil
+		},
+		func(context.Context, *sql.DB) ([]subscriptionPlanResponse, error) {
+			return nil, nil
+		},
+		func(context.Context, *sql.DB) (*latestReportResponse, error) {
+			return nil, sql.ErrNoRows
+		},
+		serverConfig{BasicAuthUser: "review", BasicAuthPass: "secret", RateLimitPerWindow: 10, RateLimitWindow: time.Minute},
+	)
+
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/models", nil)
+	req.RemoteAddr = "198.51.100.8:1234"
+	rec := httptest.NewRecorder()
+	mux.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusUnauthorized {
+		t.Fatalf("expected status 401, got %d", rec.Code)
+	}
+}
+
+func TestModelsHandlerAllowsBasicAuthForExternalRequests(t *testing.T) {
+	mux := newMuxWithConfig(
+		&sql.DB{},
+		func(context.Context, *sql.DB) ([]modelResponse, error) {
+			return []modelResponse{{ID: "openai/gpt-4o", Name: "GPT-4o"}}, nil
+		},
+		func(context.Context, *sql.DB) ([]subscriptionPlanResponse, error) {
+			return nil, nil
+		},
+		func(context.Context, *sql.DB) (*latestReportResponse, error) {
+			return nil, sql.ErrNoRows
+		},
+		serverConfig{BasicAuthUser: "review", BasicAuthPass: "secret", RateLimitPerWindow: 10, RateLimitWindow: time.Minute},
+	)
+
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/models", nil)
+	req.RemoteAddr = "198.51.100.8:1234"
+	req.SetBasicAuth("review", "secret")
+	rec := httptest.NewRecorder()
+	mux.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected status 200, got %d", rec.Code)
+	}
+}
+
+func TestModelsHandlerAllowsBearerTokenForExternalRequests(t *testing.T) {
+	mux := newMuxWithConfig(
+		&sql.DB{},
+		func(context.Context, *sql.DB) ([]modelResponse, error) {
+			return []modelResponse{{ID: "openai/gpt-4o", Name: "GPT-4o"}}, nil
+		},
+		func(context.Context, *sql.DB) ([]subscriptionPlanResponse, error) {
+			return nil, nil
+		},
+		func(context.Context, *sql.DB) (*latestReportResponse, error) {
+			return nil, sql.ErrNoRows
+		},
+		serverConfig{ServiceToken: "token-123", RateLimitPerWindow: 10, RateLimitWindow: time.Minute},
+	)
+
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/models", nil)
+	req.RemoteAddr = "198.51.100.8:1234"
+	req.Header.Set("Authorization", "Bearer token-123")
+	rec := httptest.NewRecorder()
+	mux.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected status 200, got %d", rec.Code)
+	}
+}
+
+func TestHealthHandlerRejectsExternalRequests(t *testing.T) {
+	mux := newMuxWithConfig(
+		&sql.DB{},
+		func(context.Context, *sql.DB) ([]modelResponse, error) {
+			return nil, nil
+		},
+		func(context.Context, *sql.DB) ([]subscriptionPlanResponse, error) {
+			return nil, nil
+		},
+		func(context.Context, *sql.DB) (*latestReportResponse, error) {
+			return nil, sql.ErrNoRows
+		},
+		serverConfig{RateLimitPerWindow: 10, RateLimitWindow: time.Minute},
+	)
+
+	req := httptest.NewRequest(http.MethodGet, "/health", nil)
+	req.RemoteAddr = "198.51.100.8:1234"
+	rec := httptest.NewRecorder()
+	mux.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("expected status 403, got %d", rec.Code)
+	}
+}
+
+func TestModelsHandlerAppliesRateLimit(t *testing.T) {
+	mux := newMuxWithConfig(
+		&sql.DB{},
+		func(context.Context, *sql.DB) ([]modelResponse, error) {
+			return []modelResponse{{ID: "openai/gpt-4o", Name: "GPT-4o"}}, nil
+		},
+		func(context.Context, *sql.DB) ([]subscriptionPlanResponse, error) {
+			return nil, nil
+		},
+		func(context.Context, *sql.DB) (*latestReportResponse, error) {
+			return nil, sql.ErrNoRows
+		},
+		serverConfig{RateLimitPerWindow: 1, RateLimitWindow: time.Minute},
+	)
+
+	first := httptest.NewRequest(http.MethodGet, "/api/v1/models", nil)
+	first.RemoteAddr = "127.0.0.1:1234"
+	firstRec := httptest.NewRecorder()
+	mux.ServeHTTP(firstRec, first)
+	if firstRec.Code != http.StatusOK {
+		t.Fatalf("expected first request status 200, got %d", firstRec.Code)
+	}
+
+	second := httptest.NewRequest(http.MethodGet, "/api/v1/models", nil)
+	second.RemoteAddr = "127.0.0.1:1234"
+	secondRec := httptest.NewRecorder()
+	mux.ServeHTTP(secondRec, second)
+	if secondRec.Code != http.StatusTooManyRequests {
+		t.Fatalf("expected second request status 429, got %d", secondRec.Code)
+	}
+}