"We Met" scan experience — capture connections on scan

Experience #1 from the scan-experiences brief: when someone scans a card and shares back, capture the meeting (with coarse geo + time) so the owner gets a "People I met" list. Backend (cardclaws-backend): - migration 0006_connections.sql: connections table (card_id, owner_id, name, email, note, country, city, met_at). Raw IP never stored — only resolved geo. - POST /v1/profile/:handle/connect (public, rate-limited 5/min): captures the connection with geo, emails the owner best-effort. - GET /v1/cards/:id/connections (owner-only): the People-I-met list. - ConnectionRow model + connections queries (insert, list_by_card); profile_service::submit_connection; card_service::list_connections. - 2 tests (capture→owner-list + validation, owner-only); gate green (118 tests). - Verified live end-to-end. Web (cardclaws-profile): - [handle].astro: a "We met?" share-back form posting to /connect; astro check clean. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
2026-06-05 18:36:09 -05:00
parent 5aba3ef1a1
commit 256f2285b9
12 changed files with 312 additions and 0 deletions
@@ -281,3 +281,69 @@ async fn welcome_requires_ownership() {
        .await;
    assert_eq!(status, StatusCode::NOT_FOUND);
 }
+
+#[tokio::test]
+async fn we_met_capture_and_owner_list() {
+    let app = require_app!();
+    let token = app.register_and_token().await;
+    let (id, handle) = create_card(&app, &token).await;
+    app.request(
+        "POST",
+        &format!("/v1/cards/{id}/publish"),
+        Some(&token),
+        None,
+    )
+    .await;
+
+    // A scanner shares back (public, unauthenticated).
+    let (s, _) = app
+        .request(
+            "POST",
+            &format!("/v1/profile/{handle}/connect"),
+            None,
+            Some(json!({ "name": "Dana Scanner", "email": "[email protected]", "note": "met at SXSW" })),
+        )
+        .await;
+    assert_eq!(s, StatusCode::OK);
+
+    // The owner sees it in their connections.
+    let (s, body) = app
+        .request(
+            "GET",
+            &format!("/v1/cards/{id}/connections"),
+            Some(&token),
+            None,
+        )
+        .await;
+    assert_eq!(s, StatusCode::OK);
+    assert_eq!(body[0]["name"], "Dana Scanner");
+    assert_eq!(body[0]["note"], "met at SXSW");
+
+    // Name is required.
+    let (s, _) = app
+        .request(
+            "POST",
+            &format!("/v1/profile/{handle}/connect"),
+            None,
+            Some(json!({ "name": "  " })),
+        )
+        .await;
+    assert_eq!(s, StatusCode::BAD_REQUEST);
+}
+
+#[tokio::test]
+async fn connections_list_is_owner_only() {
+    let app = require_app!();
+    let token = app.register_and_token().await;
+    let (id, _handle) = create_card(&app, &token).await;
+    let other = app.register_and_token().await;
+    let (status, _) = app
+        .request(
+            "GET",
+            &format!("/v1/cards/{id}/connections"),
+            Some(&other),
+            None,
+        )
+        .await;
+    assert_eq!(status, StatusCode::NOT_FOUND);
+}