Extend create/update recipe endpoints to accept ingredients and steps

[dgee2]

Summary

• POST/PUT now accept ingredients and steps together, persisted in a single transaction (steps were plumbed by Epic [Epic] Core recipe model changes (DB schema) #1098 but never wired into create/update).
• PUT now checks ownership: 403 for non-owners, 404 for a missing recipe.
• Duplicate (OwnerUserId, Title) now returns 409 (was 422) via a new ConflictException/handler; a new ForbiddenAccessException/handler backs the 403.
• UpsertRecipeValidator now accepts an empty ingredient list (zero ingredients/steps is a valid minimal recipe).

Also fixes a real stale-read bug found while wiring the ownership check: RecipeRepository.GetRecipeAsync/GetRecipesAsync called a private mapping method inside a LINQ Select, which isn't EF-translatable — EF had to materialize (and, with nothing suppressing tracking, track) a full RecipeEntity to run it. Once the new pre-update ownership check added a read before the write, that tracked entity went stale the moment ExecuteUpdateAsync wrote past the change tracker, and the post-update read-for-response reused the stale tracked instance via EF's identity resolution instead of the freshly committed row — title/scalar updates were silently reverting in the response (ingredients/steps updated fine). Fixed by inlining the projection with .AsNoTracking().

Closes #1116
Part of #1099

Test plan

• dotnet test MenuApi.Tests (unit)
• dotnet test MenuApi.Integration.Tests — create/update with ingredients+steps, non-owner 403, duplicate-title 409 (both create and update paths)

[sonarqubecloud]

Quality Gate passed

Issues
4 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Extends the MenuApi recipe authoring endpoints so create/update can accept and persist full recipe payloads (ingredients + steps) atomically, adds ownership enforcement for updates, and improves API error semantics (409 conflict, 403 forbidden). It also adjusts EF Core querying to avoid tracked-entity stale reads and updates validation + test coverage accordingly.

Changes:

• Wire step collection persistence into recipe create/update and add update-time ownership checks (403/404 behavior).
• Introduce shared ProblemDetails-based exception handling plus new Conflict/Forbidden exception types and switch duplicate-title to 409.
• Update validator + unit/integration tests to allow empty ingredient lists and cover the new behaviors.

Reviewed changes

Copilot reviewed 17 out of 17 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
backend/MenuApi/Validation/UpsertRecipeValidator.cs	Allows empty ingredient list while still rejecting null ingredients.
backend/MenuApi/Services/RecipeService.cs	Upserts steps during create/update; update now performs owner check and returns bool for not-found.
backend/MenuApi/Services/IRecipeService.cs	Updates service contract for update to include callerId and return not-found status.
backend/MenuApi/Repositories/RecipeRepository.cs	Uses an expression-based projection for EF friendliness; maps duplicate-title to ConflictException and adds no-tracking intent.
backend/MenuApi/Recipes/RecipeApi.cs	Updates endpoint metadata; PUT now returns 401/403/404/409 appropriately and returns IResult.
backend/MenuApi/Program.cs	Registers new exception handlers.
backend/MenuApi/Exceptions/ProblemDetailsExceptionHandler.cs	Adds shared base handler to emit consistent RFC-linked ProblemDetails payloads.
backend/MenuApi/Exceptions/ForbiddenAccessExceptionHandler.cs	Maps ForbiddenAccessException to 403 ProblemDetails.
backend/MenuApi/Exceptions/ForbiddenAccessException.cs	New exception type for forbidden updates.
backend/MenuApi/Exceptions/ConflictExceptionHandler.cs	Maps ConflictException to 409 ProblemDetails.
backend/MenuApi/Exceptions/ConflictException.cs	New exception type for conflict (duplicate title).
backend/MenuApi/Exceptions/BusinessValidationExceptionHandler.cs	Refactors 422 handler to reuse the new base ProblemDetails exception handler.
backend/MenuApi.Tests/Validation/UpsertRecipeValidatorTests.cs	Updates validator expectations (empty ingredients allowed; null ingredients rejected).
backend/MenuApi.Tests/Services/RecipeServiceTests.cs	Adds coverage for ownership/not-found paths and verifies steps upsert is invoked.
backend/MenuApi.Tests/Controllers/RecipeApiTests.cs	Updates PUT endpoint tests for IResult + 401/404 behavior.
backend/MenuApi.Integration.Tests/RecipeIntegrationTests.cs	Updates duplicate-title integration assertions from 422 to 409.
backend/MenuApi.Integration.Tests/RecipeCreateUpdateIntegrationTests.cs	Adds integration coverage for create/update with steps, minimal payload, 403 for non-owner, and 404 for missing recipe.

Suppressed comments (1)

backend/MenuApi/Repositories/RecipeRepository.cs:58

• AsNoTracking() is applied after the projection. To ensure RecipeEntity instances are never tracked (and to make the stale-read fix robust), move AsNoTracking() onto the entity query before Select().

        return await db.Recipes
            .Where(r => r.Id == recipeId.Value)
            .Select(ToDbModel)
            .AsNoTracking()
            .FirstOrDefaultAsync()

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.