insights-correlations (#22)

Reviewed-on: #22

crates/server/src/main.rs

@@ -218,6 +218,7 @@ async fn wire_dependencies() -> anyhow::Result<(AppState, axum::Router)> {
         federation_admin: Arc::new(domain::ports::noop::NoopFederationAdminQuery),
         wrapup_stats: db.wrapup_stats,
         wrapup_repo: db.wrapup_repo,
+        insights: db.insights,
         goal_command: db.goal_command,
         goal_query: db.goal_query,
         user_settings: db.user_settings,
@@ -312,9 +313,23 @@ async fn create_event_publisher(
 
 fn init_tracing() {
     tracing_subscriber::registry()
-        .with(tracing_subscriber::EnvFilter::new(
-            std::env::var("RUST_LOG").unwrap_or_else(|_| "server=debug,tower_http=debug".into()),
-        ))
+        .with(log_filter("server=debug,tower_http=debug"))
         .with(tracing_subscriber::fmt::layer())
         .init();
 }
+
+/// `RUST_LOG` names the crates to trace in detail; anything it doesn't name
+/// still reports warnings and errors. Without a baseline, a filter like
+/// `presentation=debug` silently drops adapter errors (e.g. the sqlx detail
+/// behind "Database operation failed").
+fn log_filter(default: &str) -> tracing_subscriber::EnvFilter {
+    let directives = std::env::var("RUST_LOG").unwrap_or_else(|_| default.to_string());
+    let has_baseline = directives
+        .split(',')
+        .any(|d| !d.trim().is_empty() && !d.contains('='));
+    if has_baseline {
+        tracing_subscriber::EnvFilter::new(directives)
+    } else {
+        tracing_subscriber::EnvFilter::new(format!("warn,{directives}"))
+    }
+}

crates/server/tests/api_test.rs

@@ -12,9 +12,8 @@ use domain::{
     errors::DomainError,
     events::DomainEvent,
     models::{
-        EntityType, ExternalPersonId, GeneratedToken, IndexableDocument, MetadataSearchCriteria,
-        Movie, Person, PersonCredits, PersonEnrichmentData, PersonId, SearchQuery, SearchResults,
-        User,
+        EntityType, ExternalPersonId, IndexableDocument, MetadataSearchCriteria, Movie, Person,
+        PersonCredits, PersonEnrichmentData, PersonId, SearchQuery, SearchResults, User,
     },
     ports::{
         AuthService, EventPublisher, MetadataClient, ObjectStorage, PasswordHasher, PersonCommand,
@@ -27,11 +26,12 @@ use presentation::context::AppContext;
 use presentation::{routes, state::AppState};
 use rss::RssAdapter;
 use sqlite::{
-    SqliteDiaryRepository, SqliteMovieRepository, SqliteReviewRepository, SqliteStatsRepository,
-    migrate as sqlite_migrate,
+    SqliteDiaryRepository, SqliteInsightsQuery, SqliteMovieRepository, SqliteReviewRepository,
+    SqliteStatsRepository, migrate as sqlite_migrate,
 };
 use sqlx::SqlitePool;
 use tower::ServiceExt;
+use uuid::Uuid;
 
 struct NoopEventPublisher;
 #[async_trait]
@@ -106,17 +106,6 @@ impl PasswordHasher for PanicHasher {
     }
 }
 
-struct PanicAuth;
-#[async_trait]
-impl AuthService for PanicAuth {
-    async fn generate_token(&self, _: &UserId) -> Result<GeneratedToken, DomainError> {
-        panic!()
-    }
-    async fn validate_token(&self, _: &str) -> Result<UserId, DomainError> {
-        panic!()
-    }
-}
-
 struct NobodyUserRepo;
 #[async_trait]
 impl UserRepository for NobodyUserRepo {
@@ -401,6 +390,10 @@ impl domain::ports::RemoteWatchlistRepository for PanicRemoteWatchlist {
     }
 }
 async fn test_app() -> Router {
+    test_app_with(domain::testing::FakeAuthService).await.0
+}
+
+async fn test_app_with(auth: impl AuthService + 'static) -> (Router, SqlitePool) {
     let pool = SqlitePool::connect("sqlite::memory:")
         .await
         .expect("in-memory SQLite failed");
@@ -432,6 +425,7 @@ async fn test_app() -> Router {
         federation_admin: Arc::new(domain::ports::noop::NoopFederationAdminQuery) as _,
         wrapup_stats: Arc::new(domain::testing::PanicWrapUpStatsQuery) as _,
         wrapup_repo: Arc::new(domain::testing::PanicWrapUpRepository) as _,
+        insights: Arc::new(SqliteInsightsQuery::new(pool.clone())) as _,
         goal_command: Arc::new(domain::testing::NoopGoalCommand),
         goal_query: Arc::new(domain::testing::NoopGoalQuery),
         user_settings: Arc::new(domain::testing::NoopUserSettingsRepository),
@@ -441,7 +435,7 @@ async fn test_app() -> Router {
     };
 
     let services = application::Services {
-        auth: Arc::new(PanicAuth),
+        auth: Arc::new(auth),
         password_hasher: Arc::new(PanicHasher),
         metadata: Arc::new(PanicMeta),
         poster_fetcher: Arc::new(PanicFetcher),
@@ -485,7 +479,8 @@ async fn test_app() -> Router {
         rss_renderer: Arc::new(RssAdapter::new("http://localhost:3000".into())),
     };
 
-    routes::build_router(state, axum::Router::new())
+    let router = routes::build_router(state, axum::Router::new());
+    (router, pool)
 }
 
 /// Inject a fake peer IP so the GovernorLayer can extract ConnectInfo.
@@ -625,3 +620,227 @@ async fn get_movie_detail_html_returns_404_for_unknown_id() {
 
     assert_eq!(response.status(), StatusCode::NOT_FOUND);
 }
+
+// ── Insights ─────────────────────────────────────────────────────────────────
+
+async fn seed_insights_diary(pool: &SqlitePool, user_id: Uuid) {
+    // 12 thrillers rated 5 late at night, 12 comedies rated 2 — enough for a
+    // rating lift once genres come from movie_genres.
+    for i in 0..12u32 {
+        let movie_id = uuid::Uuid::new_v4().to_string();
+        sqlx::query("INSERT INTO movies (id, title, release_year) VALUES (?, ?, ?)")
+            .bind(&movie_id)
+            .bind(format!("Thriller {i}"))
+            .bind(2020)
+            .execute(pool)
+            .await
+            .unwrap();
+        sqlx::query("INSERT INTO movie_genres (movie_id, tmdb_id, name) VALUES (?, ?, ?)")
+            .bind(&movie_id)
+            .bind(44400 + i as i64)
+            .bind("Thriller")
+            .execute(pool)
+            .await
+            .unwrap();
+        sqlx::query(
+            "INSERT INTO reviews (id, movie_id, user_id, rating, watched_at, created_at) \
+             VALUES (?, ?, ?, ?, ?, ?)",
+        )
+        .bind(uuid::Uuid::new_v4().to_string())
+        .bind(&movie_id)
+        .bind(user_id.to_string())
+        .bind(5)
+        .bind("2024-01-05 22:30:00")
+        .bind("2024-01-05 22:30:00")
+        .execute(pool)
+        .await
+        .unwrap();
+
+        let movie_id = uuid::Uuid::new_v4().to_string();
+        sqlx::query("INSERT INTO movies (id, title, release_year) VALUES (?, ?, ?)")
+            .bind(&movie_id)
+            .bind(format!("Comedy {i}"))
+            .bind(2015)
+            .execute(pool)
+            .await
+            .unwrap();
+        sqlx::query("INSERT INTO movie_genres (movie_id, tmdb_id, name) VALUES (?, ?, ?)")
+            .bind(&movie_id)
+            .bind(55300 + i as i64)
+            .bind("Comedy")
+            .execute(pool)
+            .await
+            .unwrap();
+        sqlx::query(
+            "INSERT INTO reviews (id, movie_id, user_id, rating, watched_at, created_at) \
+             VALUES (?, ?, ?, ?, ?, ?)",
+        )
+        .bind(uuid::Uuid::new_v4().to_string())
+        .bind(&movie_id)
+        .bind(user_id.to_string())
+        .bind(2)
+        .bind("2024-03-10 13:00:00")
+        .bind("2024-03-10 13:00:00")
+        .execute(pool)
+        .await
+        .unwrap();
+    }
+}
+
+#[tokio::test]
+async fn get_api_insights_returns_rating_lift_for_own_user() {
+    let (app, pool) = test_app_with(domain::testing::FakeAuthService).await;
+    let user_id = Uuid::new_v4();
+    seed_insights_diary(&pool, user_id).await;
+
+    let response = app
+        .oneshot(with_ip(
+            Request::builder()
+                .uri("/api/v1/insights")
+                .header("authorization", format!("Bearer {user_id}"))
+                .body(Body::empty())
+                .unwrap(),
+        ))
+        .await
+        .unwrap();
+
+    let (status, bytes) = (
+        response.status(),
+        response.into_body().collect().await.unwrap().to_bytes(),
+    );
+    assert_eq!(
+        status,
+        StatusCode::OK,
+        "body: {}",
+        String::from_utf8(bytes.to_vec()).unwrap()
+    );
+    let json: serde_json::Value = serde_json::from_slice(&bytes).unwrap();
+
+    let rating_lifts: Vec<&serde_json::Value> = json["insights"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .filter(|i| i["kind"] == "rating_lift")
+        .collect();
+    assert_eq!(rating_lifts.len(), 2, "thriller up, comedy down: {json}");
+
+    let thriller = rating_lifts
+        .iter()
+        .find(|i| i["genre"] == "Thriller")
+        .unwrap();
+    assert_eq!(thriller["delta"], 1.5);
+    assert_eq!(thriller["sample_count"], 12);
+    // Timestamps are real → rhythm fires. Hours split evenly between 22
+    // (thrillers) and 13 (comedies); every window covering either bucket ties,
+    // so the earliest one, 11:00–14:00, wins. Days tie too (Fri/Sun), sorted
+    // ascending.
+    let rhythm = json["insights"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .find(|i| i["kind"] == "rhythm")
+        .expect("rhythm expected for real timestamps");
+    assert_eq!(rhythm["peak_hour_start"], 11);
+    assert_eq!(rhythm["peak_hour_end"], 14);
+    assert_eq!(rhythm["top_days"], serde_json::json!([5, 7]));
+}
+
+async fn get_insights_json(
+    app: Router,
+    user_id: Uuid,
+    query: &str,
+) -> (StatusCode, serde_json::Value) {
+    let response = app
+        .oneshot(with_ip(
+            Request::builder()
+                .uri(format!("/api/v1/insights{query}"))
+                .header("authorization", format!("Bearer {user_id}"))
+                .body(Body::empty())
+                .unwrap(),
+        ))
+        .await
+        .unwrap();
+    let status = response.status();
+    let bytes = response.into_body().collect().await.unwrap().to_bytes();
+    let json = serde_json::from_slice(&bytes).unwrap_or(serde_json::Value::Null);
+    (status, json)
+}
+
+#[tokio::test]
+async fn get_api_insights_ignores_remote_reviews() {
+    let (app, pool) = test_app_with(domain::testing::FakeAuthService).await;
+    let user_id = Uuid::new_v4();
+    seed_insights_diary(&pool, user_id).await;
+    // Federated rows stored under the same user_id are someone else's watches.
+    for i in 0..12u32 {
+        let movie_id = uuid::Uuid::new_v4().to_string();
+        sqlx::query("INSERT INTO movies (id, title, release_year) VALUES (?, ?, ?)")
+            .bind(&movie_id)
+            .bind(format!("Horror {i}"))
+            .bind(2019)
+            .execute(&pool)
+            .await
+            .unwrap();
+        sqlx::query("INSERT INTO movie_genres (movie_id, tmdb_id, name) VALUES (?, ?, ?)")
+            .bind(&movie_id)
+            .bind(66600 + i as i64)
+            .bind("Horror")
+            .execute(&pool)
+            .await
+            .unwrap();
+        sqlx::query(
+            "INSERT INTO reviews (id, movie_id, user_id, rating, watched_at, created_at, remote_actor_url) \
+             VALUES (?, ?, ?, ?, ?, ?, ?)",
+        )
+        .bind(uuid::Uuid::new_v4().to_string())
+        .bind(&movie_id)
+        .bind(user_id.to_string())
+        .bind(5)
+        .bind("2024-05-05 09:00:00")
+        .bind("2024-05-05 09:00:00")
+        .bind("https://remote.example/users/someone")
+        .execute(&pool)
+        .await
+        .unwrap();
+    }
+
+    let (status, json) = get_insights_json(app, user_id, "").await;
+    assert_eq!(status, StatusCode::OK);
+    let insights = json["insights"].as_array().unwrap();
+    assert!(
+        !insights.iter().any(|i| i["genre"] == "Horror"),
+        "remote reviews must not feed insights: {json}"
+    );
+    let thriller = insights
+        .iter()
+        .find(|i| i["kind"] == "rating_lift" && i["genre"] == "Thriller")
+        .unwrap();
+    assert_eq!(thriller["delta"], 1.5);
+}
+
+#[tokio::test]
+async fn get_api_insights_buckets_rhythm_in_requested_time_zone() {
+    let (app, pool) = test_app_with(domain::testing::FakeAuthService).await;
+    let user_id = Uuid::new_v4();
+    seed_insights_diary(&pool, user_id).await;
+
+    // January in Warsaw is UTC+1: 22:30 → 23:30 and 13:00 → 14:00, so the
+    // earliest tied window moves from 11–14 to 12–15.
+    let (status, json) = get_insights_json(app, user_id, "?tz=Europe/Warsaw").await;
+    assert_eq!(status, StatusCode::OK);
+    let rhythm = json["insights"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .find(|i| i["kind"] == "rhythm")
+        .expect("rhythm expected");
+    assert_eq!(rhythm["peak_hour_start"], 12);
+    assert_eq!(rhythm["peak_hour_end"], 15);
+}
+
+#[tokio::test]
+async fn get_api_insights_rejects_unknown_time_zone() {
+    let (app, _pool) = test_app_with(domain::testing::FakeAuthService).await;
+    let (status, _) = get_insights_json(app, Uuid::new_v4(), "?tz=Mars/Olympus").await;
+    assert_eq!(status, StatusCode::BAD_REQUEST);
+}