Merge pull request 'add Ci gate, add llm-judgetest' (#2) from kien_update into main

Reviewed-on: http://161.33.139.73:3000/admin/casan5/pulls/2

AINative_OKR_CASAN5/.github/workflows/ci.yml

@@ -0,0 +1,69 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test-backend:
+    name: Backend Tests
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: AINative_OKR_CASAN5/backend
+    env:
+      DATABASE_URL: file:./test.db
+      JWT_SECRET: test-secret
+      # ANTHROPIC_API_KEY enables the LLM-judge gate; tests skip gracefully when absent
+      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: AINative_OKR_CASAN5/package-lock.json
+
+      - name: Install dependencies
+        working-directory: AINative_OKR_CASAN5
+        run: npm ci
+
+      - name: Setup test database
+        run: npm run db:setup
+
+      - name: Seed test database
+        run: npx prisma db seed
+
+      # Run test files sequentially (--test-concurrency=1) to prevent shared-DB
+      # conflicts between e2e tests that mutate state and services tests that rely on it.
+      - name: Run unit + e2e + LLM-judge tests
+        run: node --import tsx --test-concurrency=1 --test "test/**/*.test.ts"
+
+  test-frontend:
+    name: Frontend Type Check
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: AINative_OKR_CASAN5/package-lock.json
+
+      - name: Install dependencies
+        working-directory: AINative_OKR_CASAN5
+        run: npm ci
+
+      - name: Type check
+        working-directory: AINative_OKR_CASAN5/frontend
+        run: npm test

AINative_OKR_CASAN5/.github/workflows/deploy.yml

@@ -0,0 +1,45 @@
+name: Deploy
+
+# Triggers only after CI passes on main — this is the gate
+on:
+  workflow_run:
+    workflows: [CI]
+    branches: [main]
+    types: [completed]
+
+jobs:
+  deploy:
+    name: Deploy to Production
+    runs-on: ubuntu-latest
+    environment: production
+    # Only deploy when CI succeeded — not on failure or cancel
+    if: github.event.workflow_run.conclusion == 'success'
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: AINative_OKR_CASAN5/package-lock.json
+
+      - name: Install dependencies
+        working-directory: AINative_OKR_CASAN5
+        run: npm ci
+
+      - name: Build backend
+        working-directory: AINative_OKR_CASAN5/backend
+        run: npm run build
+
+      - name: Build frontend
+        working-directory: AINative_OKR_CASAN5/frontend
+        run: npm run build
+
+      # TODO: replace with your actual deploy command, e.g.:
+      #   - rsync -av dist/ user@server:/var/www/app/
+      #   - fly deploy
+      #   - vercel --prod
+      #   - aws s3 sync frontend/dist/ s3://your-bucket
+      - name: Deploy
+        run: echo "All tests passed — add deploy commands here"

AINative_OKR_CASAN5/backend/test/e2e.test.ts

@@ -5,50 +5,373 @@ import path from 'node:path';
 import request from 'supertest';
 import { createTestApp, loginToken } from './helpers.js';
 
-test('HTTP auth, role filtering, validation, and progress update are real', async () => {
-  const { app, prisma } = await createTestApp();
+// ─── Auth guard ───────────────────────────────────────────────────────────────
+
+test('unauthenticated requests are rejected with 401', async () => {
+  const { app } = await createTestApp();
   try {
     await request(app.getHttpServer()).get('/api/v1/objectives').expect(401);
-
-    const employeeToken = await loginToken(app, 'employee');
-    const managerToken = await loginToken(app, 'manager');
-
-    const employeeObjectives = await request(app.getHttpServer())
-      .get('/api/v1/objectives')
-      .set('Authorization', `Bearer ${employeeToken}`)
-      .expect(200);
-    assert.equal(employeeObjectives.body.success, true);
-    assert.deepEqual(
-      employeeObjectives.body.data.map((objective: { ownerId: number }) => objective.ownerId),
-      [3],
-    );
-
-    const managerObjectives = await request(app.getHttpServer())
-      .get('/api/v1/objectives')
-      .set('Authorization', `Bearer ${managerToken}`)
-      .expect(200);
-    assert.equal(managerObjectives.body.data.length, 3);
-
-    await request(app.getHttpServer())
-      .post('/api/v1/objectives')
-      .set('Authorization', `Bearer ${employeeToken}`)
-      .send({ title: '', ownerId: 3, quarter: '2026-Q2' })
-      .expect(400);
-
-    const progressResponse = await request(app.getHttpServer())
-      .patch('/api/v1/key-results/2/progress')
-      .set('Authorization', `Bearer ${employeeToken}`)
-      .send({ progress: 70, comment: 'Updated in e2e test' })
-      .expect(200);
-    assert.equal(progressResponse.body.data.progress, 70);
-    await prisma.keyResult.update({ where: { id: 2 }, data: { progress: 60 } });
-    await prisma.progressUpdate.deleteMany({ where: { keyResultId: 2, progress: 70 } });
+    await request(app.getHttpServer()).get('/api/v1/objectives/1').expect(401);
+    await request(app.getHttpServer()).get('/api/v1/key-results/1').expect(401);
   } finally {
     await app.close();
   }
 });
 
-test('golden objective list response does not drift', async () => {
+// ─── GET /objectives (list) ───────────────────────────────────────────────────
+
+test('GET /objectives employee sees only own objectives', async () => {
+  const { app } = await createTestApp();
+  try {
+    const token = await loginToken(app, 'employee');
+    const res = await request(app.getHttpServer())
+      .get('/api/v1/objectives')
+      .set('Authorization', `Bearer ${token}`)
+      .expect(200);
+    assert.equal(res.body.success, true);
+    assert.ok(Array.isArray(res.body.data));
+    // Every returned objective must belong to employee (id=3)
+    assert.ok(res.body.data.every((o: { ownerId: number }) => o.ownerId === 3));
+    assert.equal(res.body.meta.total, res.body.data.length);
+  } finally {
+    await app.close();
+  }
+});
+
+test('GET /objectives manager sees all objectives', async () => {
+  const { app } = await createTestApp();
+  try {
+    const managerToken = await loginToken(app, 'manager');
+    const employeeToken = await loginToken(app, 'employee');
+    const managerRes = await request(app.getHttpServer())
+      .get('/api/v1/objectives')
+      .set('Authorization', `Bearer ${managerToken}`)
+      .expect(200);
+    const employeeRes = await request(app.getHttpServer())
+      .get('/api/v1/objectives')
+      .set('Authorization', `Bearer ${employeeToken}`)
+      .expect(200);
+    assert.ok(managerRes.body.data.length > employeeRes.body.data.length);
+    assert.equal(managerRes.body.data.length, 3);
+  } finally {
+    await app.close();
+  }
+});
+
+test('GET /objectives?quarter= filters to matching quarter only', async () => {
+  const { app } = await createTestApp();
+  try {
+    const token = await loginToken(app, 'manager');
+    const matching = await request(app.getHttpServer())
+      .get('/api/v1/objectives?quarter=Q2/2026')
+      .set('Authorization', `Bearer ${token}`)
+      .expect(200);
+    const empty = await request(app.getHttpServer())
+      .get('/api/v1/objectives?quarter=Q1/1900')
+      .set('Authorization', `Bearer ${token}`)
+      .expect(200);
+    assert.ok(matching.body.data.every((o: { quarter: string }) => o.quarter === 'Q2/2026'));
+    assert.equal(empty.body.data.length, 0);
+    assert.equal(empty.body.meta.total, 0);
+  } finally {
+    await app.close();
+  }
+});
+
+// ─── GET /objectives/:id ──────────────────────────────────────────────────────
+
+test('GET /objectives/:id returns objective with computedProgress and relations', async () => {
+  const { app } = await createTestApp();
+  try {
+    const token = await loginToken(app, 'manager');
+    const res = await request(app.getHttpServer())
+      .get('/api/v1/objectives/1')
+      .set('Authorization', `Bearer ${token}`)
+      .expect(200);
+    const data = res.body.data;
+    assert.equal(data.id, 1);
+    assert.equal(typeof data.computedProgress, 'number');
+    // KR1=33, KR2=60 → avg = Math.round(46.5) = 47
+    assert.equal(data.computedProgress, 47);
+    assert.ok(data.owner !== undefined);
+    assert.ok(Array.isArray(data.keyResults));
+  } finally {
+    await app.close();
+  }
+});
+
+test('GET /objectives/:id returns 404 for non-existent objective', async () => {
+  const { app } = await createTestApp();
+  try {
+    const token = await loginToken(app, 'manager');
+    await request(app.getHttpServer())
+      .get('/api/v1/objectives/999999')
+      .set('Authorization', `Bearer ${token}`)
+      .expect(404);
+  } finally {
+    await app.close();
+  }
+});
+
+test('GET /objectives/:id returns 403 when employee accesses another owner objective', async () => {
+  const { app } = await createTestApp();
+  try {
+    const token = await loginToken(app, 'employee');
+    // Objective 3 belongs to manager (id=2), not employee (id=3)
+    await request(app.getHttpServer())
+      .get('/api/v1/objectives/3')
+      .set('Authorization', `Bearer ${token}`)
+      .expect(403);
+  } finally {
+    await app.close();
+  }
+});
+
+// ─── POST /objectives ─────────────────────────────────────────────────────────
+
+test('POST /objectives returns 400 for empty title', async () => {
+  const { app } = await createTestApp();
+  try {
+    const token = await loginToken(app, 'employee');
+    await request(app.getHttpServer())
+      .post('/api/v1/objectives')
+      .set('Authorization', `Bearer ${token}`)
+      .send({ title: '', ownerId: 3, quarter: 'Q1/2026' })
+      .expect(400);
+  } finally {
+    await app.close();
+  }
+});
+
+test('POST /objectives returns 400 for invalid quarter format', async () => {
+  const { app } = await createTestApp();
+  try {
+    const token = await loginToken(app, 'employee');
+    // DTO requires Q[1-4]/YYYY format
+    await request(app.getHttpServer())
+      .post('/api/v1/objectives')
+      .set('Authorization', `Bearer ${token}`)
+      .send({ title: 'Valid title', ownerId: 3, quarter: '2026-Q2' })
+      .expect(400);
+  } finally {
+    await app.close();
+  }
+});
+
+test('POST /objectives manager creates objective and receives it with NOT_STARTED status', async () => {
+  const { app, prisma } = await createTestApp();
+  let createdId: number | undefined;
+  try {
+    const token = await loginToken(app, 'manager');
+    const res = await request(app.getHttpServer())
+      .post('/api/v1/objectives')
+      .set('Authorization', `Bearer ${token}`)
+      .send({ title: 'E2E created objective', ownerId: 3, quarter: 'Q1/2099' })
+      .expect(201);
+    createdId = res.body.data.id;
+    assert.equal(res.body.data.status, 'NOT_STARTED');
+    assert.equal(res.body.data.ownerId, 3);
+    assert.ok(typeof createdId === 'number');
+  } finally {
+    if (createdId) await prisma.objective.delete({ where: { id: createdId } });
+    await app.close();
+  }
+});
+
+test('POST /objectives returns 403 when employee creates for another user', async () => {
+  const { app } = await createTestApp();
+  try {
+    const token = await loginToken(app, 'employee');
+    // employee (id=3) trying to create objective for employee2 (id=4)
+    await request(app.getHttpServer())
+      .post('/api/v1/objectives')
+      .set('Authorization', `Bearer ${token}`)
+      .send({ title: 'Sneaky objective', ownerId: 4, quarter: 'Q1/2099' })
+      .expect(403);
+  } finally {
+    await app.close();
+  }
+});
+
+test('POST /objectives returns 404 for non-existent owner', async () => {
+  const { app } = await createTestApp();
+  try {
+    const token = await loginToken(app, 'manager');
+    await request(app.getHttpServer())
+      .post('/api/v1/objectives')
+      .set('Authorization', `Bearer ${token}`)
+      .send({ title: 'Ghost owner objective', ownerId: 999999, quarter: 'Q1/2099' })
+      .expect(404);
+  } finally {
+    await app.close();
+  }
+});
+
+// ─── GET /key-results/:id ─────────────────────────────────────────────────────
+
+test('GET /key-results/:id returns KR with nested objective', async () => {
+  const { app } = await createTestApp();
+  try {
+    const token = await loginToken(app, 'employee');
+    const res = await request(app.getHttpServer())
+      .get('/api/v1/key-results/1')
+      .set('Authorization', `Bearer ${token}`)
+      .expect(200);
+    assert.equal(res.body.success, true);
+    assert.equal(res.body.data.id, 1);
+    assert.ok(res.body.data.objective !== undefined);
+  } finally {
+    await app.close();
+  }
+});
+
+test('GET /key-results/:id returns 404 for non-existent KR', async () => {
+  const { app } = await createTestApp();
+  try {
+    const token = await loginToken(app, 'manager');
+    await request(app.getHttpServer())
+      .get('/api/v1/key-results/999999')
+      .set('Authorization', `Bearer ${token}`)
+      .expect(404);
+  } finally {
+    await app.close();
+  }
+});
+
+test('GET /key-results/:id returns 403 when employee reads another owner KR', async () => {
+  const { app } = await createTestApp();
+  try {
+    const token = await loginToken(app, 'employee');
+    // KR 3 belongs to objective 2 (ownerId=employee2/id=4)
+    await request(app.getHttpServer())
+      .get('/api/v1/key-results/3')
+      .set('Authorization', `Bearer ${token}`)
+      .expect(403);
+  } finally {
+    await app.close();
+  }
+});
+
+// ─── POST /key-results ────────────────────────────────────────────────────────
+
+test('POST /key-results employee creates KR on own objective', async () => {
+  const { app, prisma } = await createTestApp();
+  let createdId: number | undefined;
+  try {
+    const token = await loginToken(app, 'employee');
+    const res = await request(app.getHttpServer())
+      .post('/api/v1/key-results')
+      .set('Authorization', `Bearer ${token}`)
+      .send({
+        objectiveId: 1,
+        title: 'E2E created key result',
+        progress: 0,
+        startValue: 0,
+        targetValue: 5,
+        deadline: '2099-12-31',
+      })
+      .expect(201);
+    createdId = res.body.data.id;
+    assert.equal(res.body.data.progress, 0);
+    assert.equal(res.body.data.objectiveId, 1);
+  } finally {
+    if (createdId) await prisma.keyResult.delete({ where: { id: createdId } });
+    await app.close();
+  }
+});
+
+test('POST /key-results returns 403 when employee creates KR on another owner objective', async () => {
+  const { app } = await createTestApp();
+  try {
+    const token = await loginToken(app, 'employee');
+    // Objective 3 belongs to manager (id=2)
+    await request(app.getHttpServer())
+      .post('/api/v1/key-results')
+      .set('Authorization', `Bearer ${token}`)
+      .send({
+        objectiveId: 3,
+        title: 'Sneaky KR',
+        progress: 0,
+        startValue: 0,
+        targetValue: 1,
+        deadline: '2099-12-31',
+      })
+      .expect(403);
+  } finally {
+    await app.close();
+  }
+});
+
+// ─── PATCH /key-results/:id/progress ─────────────────────────────────────────
+
+test('PATCH /key-results/:id/progress updates progress and returns updated KR', async () => {
+  const { app, prisma } = await createTestApp();
+  try {
+    const token = await loginToken(app, 'employee');
+    const res = await request(app.getHttpServer())
+      .patch('/api/v1/key-results/2/progress')
+      .set('Authorization', `Bearer ${token}`)
+      .send({ progress: 70, comment: 'E2E progress update' })
+      .expect(200);
+    assert.equal(res.body.data.progress, 70);
+  } finally {
+    await prisma.keyResult.update({ where: { id: 2 }, data: { progress: 60 } });
+    await prisma.progressUpdate.deleteMany({ where: { keyResultId: 2, progress: 70 } });
+    await app.close();
+  }
+});
+
+test('PATCH /key-results/:id/progress returns 400 for out-of-range values', async () => {
+  const { app } = await createTestApp();
+  try {
+    const token = await loginToken(app, 'employee');
+    await request(app.getHttpServer())
+      .patch('/api/v1/key-results/1/progress')
+      .set('Authorization', `Bearer ${token}`)
+      .send({ progress: -1 })
+      .expect(400);
+    await request(app.getHttpServer())
+      .patch('/api/v1/key-results/1/progress')
+      .set('Authorization', `Bearer ${token}`)
+      .send({ progress: 101 })
+      .expect(400);
+  } finally {
+    await app.close();
+  }
+});
+
+test('PATCH /key-results/:id/progress returns 403 when employee updates another owner KR', async () => {
+  const { app } = await createTestApp();
+  try {
+    const token = await loginToken(app, 'employee');
+    // KR 3 belongs to employee2's objective
+    await request(app.getHttpServer())
+      .patch('/api/v1/key-results/3/progress')
+      .set('Authorization', `Bearer ${token}`)
+      .send({ progress: 50 })
+      .expect(403);
+  } finally {
+    await app.close();
+  }
+});
+
+test('PATCH /key-results/:id/progress returns 404 for non-existent KR', async () => {
+  const { app } = await createTestApp();
+  try {
+    const token = await loginToken(app, 'manager');
+    await request(app.getHttpServer())
+      .patch('/api/v1/key-results/999999/progress')
+      .set('Authorization', `Bearer ${token}`)
+      .send({ progress: 50 })
+      .expect(404);
+  } finally {
+    await app.close();
+  }
+});
+
+// ─── Golden regression ────────────────────────────────────────────────────────
+
+test('golden: manager objective list does not drift', async () => {
   const { app } = await createTestApp();
   try {
     const token = await loginToken(app, 'manager');
@@ -59,16 +382,12 @@ test('golden objective list response does not drift', async () => {
     const canonical = JSON.stringify(
       {
         success: response.body.success,
-        data: response.body.data.map((objective: { id: number; title: string; quarter: string; status: string; keyResults: { id: number; title: string; progress: number }[] }) => ({
-          id: objective.id,
-          title: objective.title,
-          quarter: objective.quarter,
-          status: objective.status,
-          keyResults: objective.keyResults.map((keyResult) => ({
-            id: keyResult.id,
-            title: keyResult.title,
-            progress: keyResult.progress,
-          })),
+        data: response.body.data.map((o: { id: number; title: string; quarter: string; status: string; keyResults: { id: number; title: string; progress: number }[] }) => ({
+          id: o.id,
+          title: o.title,
+          quarter: o.quarter,
+          status: o.status,
+          keyResults: o.keyResults.map((kr) => ({ id: kr.id, title: kr.title, progress: kr.progress })),
         })),
         meta: response.body.meta,
       },
@@ -76,7 +395,72 @@ test('golden objective list response does not drift', async () => {
       2,
     );
     const fixture = await fs.readFile(path.resolve('test/golden/objectives.manager.json'), 'utf8');
-    assert.equal(`${canonical}\n`, fixture);
+    assert.equal(`${canonical}\n`, fixture, 'Manager objective list response drifted from golden fixture');
+  } finally {
+    await app.close();
+  }
+});
+
+test('golden: employee objective list does not drift', async () => {
+  const { app } = await createTestApp();
+  try {
+    const token = await loginToken(app, 'employee');
+    const response = await request(app.getHttpServer())
+      .get('/api/v1/objectives')
+      .set('Authorization', `Bearer ${token}`)
+      .expect(200);
+    const canonical = JSON.stringify(
+      {
+        success: response.body.success,
+        data: response.body.data.map((o: { id: number; title: string; quarter: string; status: string; keyResults: { id: number; title: string; progress: number }[] }) => ({
+          id: o.id,
+          title: o.title,
+          quarter: o.quarter,
+          status: o.status,
+          keyResults: o.keyResults.map((kr) => ({ id: kr.id, title: kr.title, progress: kr.progress })),
+        })),
+        meta: response.body.meta,
+      },
+      null,
+      2,
+    );
+    const fixture = await fs.readFile(path.resolve('test/golden/objectives.employee.json'), 'utf8');
+    assert.equal(`${canonical}\n`, fixture, 'Employee objective list response drifted from golden fixture');
+  } finally {
+    await app.close();
+  }
+});
+
+test('golden: objective detail (GET /objectives/1) does not drift', async () => {
+  const { app } = await createTestApp();
+  try {
+    const token = await loginToken(app, 'manager');
+    const response = await request(app.getHttpServer())
+      .get('/api/v1/objectives/1')
+      .set('Authorization', `Bearer ${token}`)
+      .expect(200);
+    const data = response.body.data;
+    const canonical = JSON.stringify(
+      {
+        success: response.body.success,
+        data: {
+          id: data.id,
+          title: data.title,
+          quarter: data.quarter,
+          status: data.status,
+          computedProgress: data.computedProgress,
+          keyResults: data.keyResults.map((kr: { id: number; title: string; progress: number }) => ({
+            id: kr.id,
+            title: kr.title,
+            progress: kr.progress,
+          })),
+        },
+      },
+      null,
+      2,
+    );
+    const fixture = await fs.readFile(path.resolve('test/golden/objective-detail.json'), 'utf8');
+    assert.equal(`${canonical}\n`, fixture, 'Objective detail response drifted from golden fixture');
   } finally {
     await app.close();
   }

AINative_OKR_CASAN5/backend/test/golden/objective-detail.json

@@ -0,0 +1,22 @@
+{
+  "success": true,
+  "data": {
+    "id": 1,
+    "title": "POC AI for SQL Injection prevention",
+    "quarter": "Q2/2026",
+    "status": "IN_PROGRESS",
+    "computedProgress": 47,
+    "keyResults": [
+      {
+        "id": 1,
+        "title": "Complete 3 POC sessions with security team",
+        "progress": 33
+      },
+      {
+        "id": 2,
+        "title": "Reduce manual SQL injection review effort by 30%",
+        "progress": 60
+      }
+    ]
+  }
+}

AINative_OKR_CASAN5/backend/test/golden/objectives.employee.json

@@ -0,0 +1,26 @@
+{
+  "success": true,
+  "data": [
+    {
+      "id": 1,
+      "title": "POC AI for SQL Injection prevention",
+      "quarter": "Q2/2026",
+      "status": "IN_PROGRESS",
+      "keyResults": [
+        {
+          "id": 1,
+          "title": "Complete 3 POC sessions with security team",
+          "progress": 33
+        },
+        {
+          "id": 2,
+          "title": "Reduce manual SQL injection review effort by 30%",
+          "progress": 60
+        }
+      ]
+    }
+  ],
+  "meta": {
+    "total": 1
+  }
+}

AINative_OKR_CASAN5/backend/test/llm-judge.test.ts

@@ -0,0 +1,165 @@
+/**
+ * LLM-judge gate: sends live API responses to Claude and fails if the model
+ * returns REJECTED. This catches semantic breakage that structural assertions miss
+ * (e.g. scrambled titles, impossible status/progress combinations, data leakage).
+ *
+ * Requires ANTHROPIC_API_KEY to be set. The test is skipped — not failed — when
+ * the key is absent, so local dev without a key still passes CI.
+ *
+ * REJECTED→fix cycle:
+ *   1. CI logs the judge verdict and reason.
+ *   2. Developer reads the reason, fixes the business logic or seed data.
+ *   3. CI re-runs; the judge issues ACCEPTED once invariants are restored.
+ */
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import request from 'supertest';
+import { createTestApp, loginToken } from './helpers.js';
+
+const ANTHROPIC_API_KEY = process.env.ANTHROPIC_API_KEY;
+const JUDGE_MODEL = 'claude-haiku-4-5-20251001';
+
+interface JudgeVerdict {
+  verdict: 'ACCEPTED' | 'REJECTED';
+  reason: string;
+}
+
+async function callLlmJudge(prompt: string): Promise<JudgeVerdict> {
+  const response = await fetch('https://api.anthropic.com/v1/messages', {
+    method: 'POST',
+    headers: {
+      'x-api-key': ANTHROPIC_API_KEY!,
+      'anthropic-version': '2023-06-01',
+      'content-type': 'application/json',
+    },
+    body: JSON.stringify({
+      model: JUDGE_MODEL,
+      max_tokens: 512,
+      temperature: 0,
+      messages: [{ role: 'user', content: prompt }],
+    }),
+  });
+
+  if (!response.ok) {
+    const body = await response.text();
+    throw new Error(`Anthropic API error ${response.status}: ${body}`);
+  }
+
+  const result = await response.json() as { content: Array<{ type: string; text: string }> };
+  const text = result.content.find((c) => c.type === 'text')?.text ?? '';
+
+  // Extract JSON object from the model response (model may wrap it in prose)
+  const match = text.match(/\{[\s\S]*"verdict"[\s\S]*\}/);
+  if (!match) {
+    throw new Error(`LLM judge returned unparseable response:\n${text}`);
+  }
+  return JSON.parse(match[0]) as JudgeVerdict;
+}
+
+function buildJudgePrompt(label: string, responseJson: unknown): string {
+  const serialized = JSON.stringify(responseJson, null, 2);
+  return `You are a strict quality gate for an OKR (Objectives and Key Results) management API.
+
+Evaluate the API response below for the endpoint: ${label}
+
+Check ALL of the following invariants:
+1. \`success\` field is exactly boolean \`true\`.
+2. \`data\` exists and is a non-empty array (for list endpoints) or a non-null object (for detail endpoints).
+3. For list responses: \`meta.total\` equals \`data.length\`.
+4. Each objective has: id (positive integer), title (non-empty string), quarter (format Q[1-4]/YYYY), status (one of NOT_STARTED, IN_PROGRESS, COMPLETED), keyResults (array).
+5. Each keyResult has: id (positive integer), title (non-empty string), progress (integer 0-100 inclusive).
+6. Status-progress invariant — for each objective:
+   - If ALL keyResults have progress === 0 → status MUST be NOT_STARTED.
+   - If ALL keyResults have progress === 100 → status MUST be COMPLETED.
+   - Otherwise → status MUST be IN_PROGRESS.
+7. Titles must NOT contain placeholder or test noise (e.g. "undefined", "null", "TODO", "string", "untitled", "test objective").
+
+API response:
+\`\`\`json
+${serialized}
+\`\`\`
+
+Respond with a JSON object ONLY — no prose before or after:
+{"verdict": "ACCEPTED" or "REJECTED", "reason": "<one sentence explaining pass or the first failing invariant>"}`;
+}
+
+// Skip gracefully when the API key is absent
+const skip = !ANTHROPIC_API_KEY && 'Set ANTHROPIC_API_KEY to enable the LLM-judge gate';
+
+test(
+  'LLM judge: manager objective list passes all semantic invariants',
+  { skip },
+  async () => {
+    const { app } = await createTestApp();
+    let verdict: JudgeVerdict;
+    try {
+      const token = await loginToken(app, 'manager');
+      const res = await request(app.getHttpServer())
+        .get('/api/v1/objectives')
+        .set('Authorization', `Bearer ${token}`)
+        .expect(200);
+
+      verdict = await callLlmJudge('GET /api/v1/objectives (manager)', res.body);
+    } finally {
+      await app.close();
+    }
+
+    if (verdict!.verdict === 'REJECTED') {
+      assert.fail(`LLM judge REJECTED manager objective list: ${verdict!.reason}`);
+    }
+  },
+);
+
+test(
+  'LLM judge: employee objective list passes all semantic invariants',
+  { skip },
+  async () => {
+    const { app } = await createTestApp();
+    let verdict: JudgeVerdict;
+    try {
+      const token = await loginToken(app, 'employee');
+      const res = await request(app.getHttpServer())
+        .get('/api/v1/objectives')
+        .set('Authorization', `Bearer ${token}`)
+        .expect(200);
+
+      verdict = await callLlmJudge('GET /api/v1/objectives (employee)', res.body);
+    } finally {
+      await app.close();
+    }
+
+    if (verdict!.verdict === 'REJECTED') {
+      assert.fail(`LLM judge REJECTED employee objective list: ${verdict!.reason}`);
+    }
+  },
+);
+
+test(
+  'LLM judge: objective detail passes all semantic invariants',
+  { skip },
+  async () => {
+    const { app } = await createTestApp();
+    let verdict: JudgeVerdict;
+    try {
+      const token = await loginToken(app, 'manager');
+      const res = await request(app.getHttpServer())
+        .get('/api/v1/objectives/1')
+        .set('Authorization', `Bearer ${token}`)
+        .expect(200);
+
+      // Normalize: present as a single-item list so the judge uses the same invariant set
+      const normalized = {
+        success: res.body.success,
+        data: [res.body.data],
+        meta: { total: 1 },
+      };
+      verdict = await callLlmJudge('GET /api/v1/objectives/1 (detail, normalized to list form)', normalized);
+    } finally {
+      await app.close();
+    }
+
+    if (verdict!.verdict === 'REJECTED') {
+      assert.fail(`LLM judge REJECTED objective detail: ${verdict!.reason}`);
+    }
+  },
+);

AINative_OKR_CASAN5/backend/test/services.test.ts

@@ -1,62 +1,403 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
 import { JwtService } from '@nestjs/jwt';
-import { ForbiddenException, UnauthorizedException } from '@nestjs/common';
+import { ForbiddenException, NotFoundException, UnauthorizedException } from '@nestjs/common';
 import { AuthService } from '../src/auth/auth.service.js';
 import type { JwtUser } from '../src/common/auth.types.js';
 import { KeyResultsService } from '../src/key-results/key-results.service.js';
 import { ObjectivesService } from '../src/objectives/objectives.service.js';
 import { PrismaService } from '../src/prisma/prisma.service.js';
 
-const employeeUser: JwtUser = {
-  sub: 3,
-  email: 'employee@okr.local',
-  role: 'EMPLOYEE',
-  name: 'Nguyen Van A',
-};
+// Seeded user identities (from prisma/seed.ts insertion order)
+const managerUser: JwtUser = { sub: 2, email: 'manager@okr.local', role: 'MANAGER', name: 'Nguyen Van Manager' };
+const employeeUser: JwtUser = { sub: 3, email: 'employee@okr.local', role: 'EMPLOYEE', name: 'Nguyen Van A' };
+const employee2User: JwtUser = { sub: 4, email: 'employee2@okr.local', role: 'EMPLOYEE', name: 'Tran Thi B' };
 
-const managerUser: JwtUser = {
-  sub: 2,
-  email: 'manager@okr.local',
-  role: 'MANAGER',
-  name: 'Nguyen Van Manager',
-};
+// ─── Auth ───────────────────────────────────────────────────────────────────
 
-test('AuthService rejects invalid passwords and signs valid users', async () => {
+test('AuthService rejects invalid password with UnauthorizedException', async () => {
   const prisma = new PrismaService();
   await prisma.$connect();
   const service = new AuthService(prisma, new JwtService({ secret: 'test-secret' }));
-  await assert.rejects(() => service.login('employee', 'wrong-password'), UnauthorizedException);
-  const result = await service.login('employee', 'Password@123');
-  assert.equal(result.user.email, 'employee@okr.local');
-  assert.ok(result.token.length > 20);
-  await prisma.$disconnect();
+  try {
+    await assert.rejects(() => service.login('employee', 'wrong-password'), UnauthorizedException);
+  } finally {
+    await prisma.$disconnect();
+  }
 });
 
-test('ObjectivesService applies employee role filtering', async () => {
+test('AuthService rejects non-existent user with UnauthorizedException', async () => {
+  const prisma = new PrismaService();
+  await prisma.$connect();
+  const service = new AuthService(prisma, new JwtService({ secret: 'test-secret' }));
+  try {
+    await assert.rejects(() => service.login('nobody@ghost.local', 'Password@123'), UnauthorizedException);
+  } finally {
+    await prisma.$disconnect();
+  }
+});
+
+test('AuthService accepts correct credentials and returns signed JWT', async () => {
+  const prisma = new PrismaService();
+  await prisma.$connect();
+  const service = new AuthService(prisma, new JwtService({ secret: 'test-secret' }));
+  try {
+    const result = await service.login('employee', 'Password@123');
+    assert.equal(result.user.email, 'employee@okr.local');
+    assert.equal(result.user.role, 'EMPLOYEE');
+    assert.ok(result.token.length > 20, 'JWT must be non-trivially long');
+    // Token has 3 dot-separated segments
+    assert.equal(result.token.split('.').length, 3);
+  } finally {
+    await prisma.$disconnect();
+  }
+});
+
+test('AuthService accepts login by email as well as username', async () => {
+  const prisma = new PrismaService();
+  await prisma.$connect();
+  const service = new AuthService(prisma, new JwtService({ secret: 'test-secret' }));
+  try {
+    const byUsername = await service.login('manager', 'Password@123');
+    const byEmail = await service.login('manager@okr.local', 'Password@123');
+    assert.equal(byUsername.user.id, byEmail.user.id);
+  } finally {
+    await prisma.$disconnect();
+  }
+});
+
+// ─── ObjectivesService.list ──────────────────────────────────────────────────
+
+test('ObjectivesService.list employee sees only own objectives', async () => {
   const prisma = new PrismaService();
   await prisma.$connect();
   const service = new ObjectivesService(prisma);
-  const employeeObjectives = await service.list(employeeUser);
-  const managerObjectives = await service.list(managerUser);
-  assert.deepEqual(employeeObjectives.map((objective) => objective.ownerId), [employeeUser.sub]);
-  assert.ok(managerObjectives.length > employeeObjectives.length);
-  await prisma.$disconnect();
+  try {
+    const results = await service.list(employeeUser);
+    assert.ok(results.length > 0, 'Employee must have at least one objective');
+    assert.ok(
+      results.every((o) => o.ownerId === employeeUser.sub),
+      'Every returned objective must belong to the employee',
+    );
+  } finally {
+    await prisma.$disconnect();
+  }
 });
 
-test('KeyResultsService blocks employee updates to another owner and recalculates owned progress', async () => {
+test('ObjectivesService.list manager sees all objectives', async () => {
+  const prisma = new PrismaService();
+  await prisma.$connect();
+  const service = new ObjectivesService(prisma);
+  try {
+    const managerResults = await service.list(managerUser);
+    const employeeResults = await service.list(employeeUser);
+    assert.ok(managerResults.length > employeeResults.length, 'Manager must see more objectives than employee');
+  } finally {
+    await prisma.$disconnect();
+  }
+});
+
+test('ObjectivesService.list quarter filter narrows results to matching quarter only', async () => {
+  const prisma = new PrismaService();
+  await prisma.$connect();
+  const service = new ObjectivesService(prisma);
+  try {
+    const all = await service.list(managerUser);
+    const filtered = await service.list(managerUser, 'Q2/2026');
+    const empty = await service.list(managerUser, 'Q1/1900');
+
+    assert.ok(filtered.length <= all.length);
+    assert.ok(filtered.every((o) => o.quarter === 'Q2/2026'), 'All filtered results must match the requested quarter');
+    assert.equal(empty.length, 0, 'No objectives should match a future non-existent quarter');
+  } finally {
+    await prisma.$disconnect();
+  }
+});
+
+// ─── ObjectivesService.getById ───────────────────────────────────────────────
+
+test('ObjectivesService.getById returns objective with computedProgress', async () => {
+  const prisma = new PrismaService();
+  await prisma.$connect();
+  const service = new ObjectivesService(prisma);
+  try {
+    // Objective 1: KR1=33, KR2=60 → avg = Math.round((33+60)/2) = 47
+    const result = await service.getById(1, managerUser);
+    assert.equal(result.id, 1);
+    assert.equal(result.computedProgress, 47);
+    assert.ok(result.keyResults.length === 2);
+    assert.ok(result.owner !== undefined, 'Owner relation must be loaded');
+  } finally {
+    await prisma.$disconnect();
+  }
+});
+
+test('ObjectivesService.getById employee accessing own objective succeeds', async () => {
+  const prisma = new PrismaService();
+  await prisma.$connect();
+  const service = new ObjectivesService(prisma);
+  try {
+    // Objective 1 is owned by employee (id=3)
+    const result = await service.getById(1, employeeUser);
+    assert.equal(result.ownerId, employeeUser.sub);
+  } finally {
+    await prisma.$disconnect();
+  }
+});
+
+test('ObjectivesService.getById employee accessing another user objective throws ForbiddenException', async () => {
+  const prisma = new PrismaService();
+  await prisma.$connect();
+  const service = new ObjectivesService(prisma);
+  try {
+    // Objective 3 belongs to manager (id=2), not employee (id=3)
+    await assert.rejects(() => service.getById(3, employeeUser), ForbiddenException);
+  } finally {
+    await prisma.$disconnect();
+  }
+});
+
+test('ObjectivesService.getById non-existent id throws NotFoundException', async () => {
+  const prisma = new PrismaService();
+  await prisma.$connect();
+  const service = new ObjectivesService(prisma);
+  try {
+    await assert.rejects(() => service.getById(999999, managerUser), NotFoundException);
+  } finally {
+    await prisma.$disconnect();
+  }
+});
+
+// ─── ObjectivesService.create ────────────────────────────────────────────────
+
+test('ObjectivesService.create sets status to NOT_STARTED and loads relations', async () => {
+  const prisma = new PrismaService();
+  await prisma.$connect();
+  const service = new ObjectivesService(prisma);
+  let createdId: number | undefined;
+  try {
+    const result = await service.create(
+      { title: 'Test objective for create', ownerId: employeeUser.sub, quarter: 'Q1/2099' },
+      managerUser,
+    );
+    createdId = result.id;
+    assert.equal(result.status, 'NOT_STARTED');
+    assert.equal(result.ownerId, employeeUser.sub);
+    assert.equal(result.quarter, 'Q1/2099');
+    assert.ok(result.owner !== undefined, 'Owner relation must be eagerly loaded');
+    assert.deepEqual(result.keyResults, [], 'New objective must have no key results');
+  } finally {
+    if (createdId) await prisma.objective.delete({ where: { id: createdId } });
+    await prisma.$disconnect();
+  }
+});
+
+test('ObjectivesService.create employee creating for another user throws ForbiddenException', async () => {
+  const prisma = new PrismaService();
+  await prisma.$connect();
+  const service = new ObjectivesService(prisma);
+  try {
+    await assert.rejects(
+      () =>
+        service.create(
+          { title: 'Sneaky objective', ownerId: employee2User.sub, quarter: 'Q1/2099' },
+          employeeUser,
+        ),
+      ForbiddenException,
+    );
+  } finally {
+    await prisma.$disconnect();
+  }
+});
+
+test('ObjectivesService.create with non-existent owner throws NotFoundException', async () => {
+  const prisma = new PrismaService();
+  await prisma.$connect();
+  const service = new ObjectivesService(prisma);
+  try {
+    await assert.rejects(
+      () => service.create({ title: 'Ghost objective', ownerId: 999999, quarter: 'Q1/2099' }, managerUser),
+      NotFoundException,
+    );
+  } finally {
+    await prisma.$disconnect();
+  }
+});
+
+// ─── KeyResultsService.getById ───────────────────────────────────────────────
+
+test('KeyResultsService.getById returns KR with nested objective and owner', async () => {
   const prisma = new PrismaService();
   await prisma.$connect();
   const service = new KeyResultsService(prisma);
-  await assert.rejects(
-    () => service.updateProgress(3, { progress: 50, comment: 'Not mine' }, employeeUser),
-    ForbiddenException,
-  );
-  const updated = await service.updateProgress(1, { progress: 100, comment: 'Completed' }, employeeUser);
-  assert.equal(updated.progress, 100);
-  const objective = await prisma.objective.findUniqueOrThrow({ where: { id: updated.objectiveId } });
-  assert.equal(objective.status, 'IN_PROGRESS');
-  await prisma.keyResult.update({ where: { id: 1 }, data: { progress: 33 } });
-  await prisma.progressUpdate.deleteMany({ where: { keyResultId: 1 } });
-  await prisma.$disconnect();
+  try {
+    // KR 1 belongs to objective 1 which is owned by employee
+    const result = await service.getById(1, employeeUser);
+    assert.equal(result.id, 1);
+    assert.ok(typeof result.progress === 'number');
+    assert.ok(result.objective !== undefined, 'Objective relation must be loaded');
+    assert.ok(result.objective.owner !== undefined, 'Owner relation must be loaded inside objective');
+  } finally {
+    await prisma.$disconnect();
+  }
+});
+
+test('KeyResultsService.getById employee reading another owner KR throws ForbiddenException', async () => {
+  const prisma = new PrismaService();
+  await prisma.$connect();
+  const service = new KeyResultsService(prisma);
+  try {
+    // KR 3 belongs to objective 2 (ownerId=employee2/id=4), not employee (id=3)
+    await assert.rejects(() => service.getById(3, employeeUser), ForbiddenException);
+  } finally {
+    await prisma.$disconnect();
+  }
+});
+
+test('KeyResultsService.getById non-existent id throws NotFoundException', async () => {
+  const prisma = new PrismaService();
+  await prisma.$connect();
+  const service = new KeyResultsService(prisma);
+  try {
+    await assert.rejects(() => service.getById(999999, managerUser), NotFoundException);
+  } finally {
+    await prisma.$disconnect();
+  }
+});
+
+// ─── KeyResultsService.updateProgress ────────────────────────────────────────
+
+test('KeyResultsService.updateProgress blocks employee updating KR from another owner', async () => {
+  const prisma = new PrismaService();
+  await prisma.$connect();
+  const service = new KeyResultsService(prisma);
+  try {
+    // KR 3 belongs to employee2's objective — employee cannot update it
+    await assert.rejects(
+      () => service.updateProgress(3, { progress: 50, comment: 'Not mine' }, employeeUser),
+      ForbiddenException,
+    );
+  } finally {
+    await prisma.$disconnect();
+  }
+});
+
+test('KeyResultsService.updateProgress records new progress value and creates ProgressUpdate', async () => {
+  const prisma = new PrismaService();
+  await prisma.$connect();
+  const service = new KeyResultsService(prisma);
+  try {
+    const updated = await service.updateProgress(1, { progress: 100, comment: 'Completed KR' }, employeeUser);
+    assert.equal(updated.progress, 100);
+    const progressUpdates = await prisma.progressUpdate.findMany({ where: { keyResultId: 1, progress: 100 } });
+    assert.ok(progressUpdates.length > 0, 'A ProgressUpdate record must be created');
+  } finally {
+    await prisma.keyResult.update({ where: { id: 1 }, data: { progress: 33 } });
+    await prisma.progressUpdate.deleteMany({ where: { keyResultId: 1 } });
+    await prisma.$disconnect();
+  }
+});
+
+test('KeyResultsService.updateProgress non-existent KR throws NotFoundException', async () => {
+  const prisma = new PrismaService();
+  await prisma.$connect();
+  const service = new KeyResultsService(prisma);
+  try {
+    await assert.rejects(
+      () => service.updateProgress(999999, { progress: 50, comment: 'ghost' }, managerUser),
+      NotFoundException,
+    );
+  } finally {
+    await prisma.$disconnect();
+  }
+});
+
+// ─── Status recalculation (full NOT_STARTED → IN_PROGRESS → COMPLETED cycle) ─
+
+test('KeyResultsService status recalculation: NOT_STARTED → IN_PROGRESS → COMPLETED → IN_PROGRESS', async () => {
+  const prisma = new PrismaService();
+  await prisma.$connect();
+  const service = new KeyResultsService(prisma);
+  let testObjectiveId: number | undefined;
+  let testKrId: number | undefined;
+  try {
+    // Create isolated objective + KR owned by employee
+    const obj = await prisma.objective.create({
+      data: { title: 'status-cycle-test', ownerId: employeeUser.sub, quarter: 'Q4/2099', status: 'NOT_STARTED' },
+    });
+    testObjectiveId = obj.id;
+    const kr = await prisma.keyResult.create({
+      data: {
+        objectiveId: obj.id,
+        title: 'single KR for status test',
+        progress: 0,
+        startValue: 0,
+        targetValue: 10,
+        deadline: new Date('2099-12-31'),
+      },
+    });
+    testKrId = kr.id;
+
+    // 0% → IN_PROGRESS
+    await service.updateProgress(kr.id, { progress: 50, comment: 'halfway' }, employeeUser);
+    const afterHalf = await prisma.objective.findUniqueOrThrow({ where: { id: obj.id } });
+    assert.equal(afterHalf.status, 'IN_PROGRESS');
+
+    // 100% → COMPLETED
+    await service.updateProgress(kr.id, { progress: 100, comment: 'done' }, employeeUser);
+    const afterFull = await prisma.objective.findUniqueOrThrow({ where: { id: obj.id } });
+    assert.equal(afterFull.status, 'COMPLETED');
+
+    // Regression back → IN_PROGRESS
+    await service.updateProgress(kr.id, { progress: 80, comment: 'regressed' }, employeeUser);
+    const afterRegress = await prisma.objective.findUniqueOrThrow({ where: { id: obj.id } });
+    assert.equal(afterRegress.status, 'IN_PROGRESS');
+
+    // Back to 0 → NOT_STARTED
+    await service.updateProgress(kr.id, { progress: 0, comment: 'reset' }, employeeUser);
+    const afterZero = await prisma.objective.findUniqueOrThrow({ where: { id: obj.id } });
+    assert.equal(afterZero.status, 'NOT_STARTED');
+  } finally {
+    if (testKrId) await prisma.keyResult.delete({ where: { id: testKrId } });
+    if (testObjectiveId) await prisma.objective.delete({ where: { id: testObjectiveId } });
+    await prisma.$disconnect();
+  }
+});
+
+test('KeyResultsService averageProgress: multi-KR completion drives COMPLETED status', async () => {
+  const prisma = new PrismaService();
+  await prisma.$connect();
+  const service = new KeyResultsService(prisma);
+  let testObjectiveId: number | undefined;
+  let kr1Id: number | undefined;
+  let kr2Id: number | undefined;
+  try {
+    const obj = await prisma.objective.create({
+      data: { title: 'multi-kr-test', ownerId: employeeUser.sub, quarter: 'Q4/2099', status: 'NOT_STARTED' },
+    });
+    testObjectiveId = obj.id;
+    const kr1 = await prisma.keyResult.create({
+      data: { objectiveId: obj.id, title: 'kr1', progress: 0, startValue: 0, targetValue: 1, deadline: new Date('2099-12-31') },
+    });
+    kr1Id = kr1.id;
+    const kr2 = await prisma.keyResult.create({
+      data: { objectiveId: obj.id, title: 'kr2', progress: 0, startValue: 0, targetValue: 1, deadline: new Date('2099-12-31') },
+    });
+    kr2Id = kr2.id;
+
+    // Set KR1 to 100%, KR2 stays 0 → avg=50 → IN_PROGRESS
+    await service.updateProgress(kr1.id, { progress: 100, comment: '' }, employeeUser);
+    const afterFirst = await prisma.objective.findUniqueOrThrow({ where: { id: obj.id } });
+    assert.equal(afterFirst.status, 'IN_PROGRESS');
+
+    // Set KR2 to 100% → avg=100 → COMPLETED
+    await service.updateProgress(kr2.id, { progress: 100, comment: '' }, employeeUser);
+    const afterBoth = await prisma.objective.findUniqueOrThrow({ where: { id: obj.id } });
+    assert.equal(afterBoth.status, 'COMPLETED');
+  } finally {
+    if (kr1Id) await prisma.keyResult.delete({ where: { id: kr1Id } });
+    if (kr2Id) await prisma.keyResult.delete({ where: { id: kr2Id } });
+    if (testObjectiveId) await prisma.objective.delete({ where: { id: testObjectiveId } });
+    await prisma.$disconnect();
+  }
 });