feat: external lunch attendees CRUD

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/unit/lunch-router.test.ts

@@ -148,6 +148,76 @@ describe('dish CRUD', () => {
   })
 })
 
+describe('external attendees CRUD', () => {
+  it('listExternals returns standalone + project-attached entries', async () => {
+    const program = await createTestProgram({ name: `ext-list-${uid()}` })
+    programIds.push(program.id)
+    const { caller } = await newAdminCaller()
+    const event = await caller.getEvent({ programId: program.id })
+    const project = await createTestProject(program.id, {
+      title: `ext-${uid()}`,
+      competitionCategory: 'STARTUP',
+    })
+    await caller.createExternal({
+      lunchEventId: event.id, name: 'Princess Albert',
+      roleNote: 'Foundation rep',
+    })
+    await caller.createExternal({
+      lunchEventId: event.id, name: 'Speaker Smith',
+      projectId: project.id, email: 's@example.com',
+    })
+    const list = await caller.listExternals({ lunchEventId: event.id })
+    expect(list).toHaveLength(2)
+    expect(list.find((e) => e.name === 'Princess Albert')?.projectId).toBeNull()
+    expect(list.find((e) => e.name === 'Speaker Smith')?.projectId).toBe(project.id)
+  })
+
+  it('updateExternal patches fields including dishId + allergens', async () => {
+    const program = await createTestProgram({ name: `ext-upd-${uid()}` })
+    programIds.push(program.id)
+    const { caller } = await newAdminCaller()
+    const event = await caller.getEvent({ programId: program.id })
+    const dish = await caller.createDish({
+      lunchEventId: event.id, name: 'Steak', dietaryTags: [],
+    })
+    const ext = await caller.createExternal({ lunchEventId: event.id, name: 'X' })
+    const updated = await caller.updateExternal({
+      externalId: ext.id, dishId: dish.id, allergens: ['GLUTEN', 'TREE_NUTS'],
+      allergenOther: 'sulphites in red wine',
+    })
+    expect(updated.dishId).toBe(dish.id)
+    expect(updated.allergens).toEqual(['GLUTEN', 'TREE_NUTS'])
+  })
+
+  it('deleteExternal removes the row', async () => {
+    const program = await createTestProgram({ name: `ext-del-${uid()}` })
+    programIds.push(program.id)
+    const { caller } = await newAdminCaller()
+    const event = await caller.getEvent({ programId: program.id })
+    const ext = await caller.createExternal({ lunchEventId: event.id, name: 'tmp' })
+    await caller.deleteExternal({ externalId: ext.id })
+    const list = await caller.listExternals({ lunchEventId: event.id })
+    expect(list.find((e) => e.id === ext.id)).toBeUndefined()
+  })
+
+  it('rejects non-admin createExternal', async () => {
+    const program = await createTestProgram({ name: `ext-rej-${uid()}` })
+    programIds.push(program.id)
+    const { caller } = await newAdminCaller()
+    const event = await caller.getEvent({ programId: program.id })
+    const member = await createTestUser('APPLICANT')
+    userIds.push(member.id)
+    const memberCaller = createCaller(lunchRouter, {
+      id: member.id,
+      email: member.email,
+      role: 'APPLICANT',
+    })
+    await expect(
+      memberCaller.createExternal({ lunchEventId: event.id, name: 'nope' }),
+    ).rejects.toThrow()
+  })
+})
+
 describe('lunch.updateEvent', () => {
   it('patches an arbitrary subset of fields', async () => {
     const program = await createTestProgram({ name: `lunch-upd-${uid()}` })