feat: lunch.getEvent + lunch.updateEvent procedures

Lazy-creates LunchEvent on first read or update. Audit-logs every
update with the patched fields.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/unit/lunch-router.test.ts

@@ -0,0 +1,115 @@
+import { afterAll, describe, expect, it } from 'vitest'
+import { prisma, createCaller } from '../setup'
+import {
+  createTestUser,
+  createTestProgram,
+  createTestProject,
+  cleanupTestData,
+  uid,
+} from '../helpers'
+import { lunchRouter } from '@/server/routers/lunch'
+
+const programIds: string[] = []
+const userIds: string[] = []
+
+afterAll(async () => {
+  for (const programId of programIds) {
+    await prisma.memberLunchPick.deleteMany({
+      where: { attendingMember: { confirmation: { project: { programId } } } },
+    })
+    await prisma.attendingMember.deleteMany({
+      where: { confirmation: { project: { programId } } },
+    })
+    await prisma.finalistConfirmation.deleteMany({ where: { project: { programId } } })
+    await prisma.externalAttendee.deleteMany({ where: { lunchEvent: { programId } } })
+    await prisma.dish.deleteMany({ where: { lunchEvent: { programId } } })
+    await prisma.lunchEvent.deleteMany({ where: { programId } })
+    await cleanupTestData(programId, [])
+  }
+  if (userIds.length > 0) {
+    await prisma.auditLog.deleteMany({ where: { userId: { in: userIds } } })
+    await prisma.user.deleteMany({ where: { id: { in: userIds } } })
+  }
+})
+
+async function newAdminCaller() {
+  const admin = await createTestUser('SUPER_ADMIN')
+  userIds.push(admin.id)
+  const caller = createCaller(lunchRouter, {
+    id: admin.id,
+    email: admin.email,
+    role: 'SUPER_ADMIN',
+  })
+  return { admin, caller }
+}
+
+describe('lunch.getEvent', () => {
+  it('lazily creates a LunchEvent on first call', async () => {
+    const program = await createTestProgram({ name: `lunch-get-${uid()}` })
+    programIds.push(program.id)
+    const { caller } = await newAdminCaller()
+    const result = await caller.getEvent({ programId: program.id })
+    expect(result.programId).toBe(program.id)
+    expect(result.enabled).toBe(false)
+    expect(result.changeCutoffHours).toBe(48)
+    const row = await prisma.lunchEvent.findUnique({ where: { programId: program.id } })
+    expect(row).not.toBeNull()
+  })
+
+  it('returns the same row on subsequent calls', async () => {
+    const program = await createTestProgram({ name: `lunch-get-${uid()}` })
+    programIds.push(program.id)
+    const { caller } = await newAdminCaller()
+    const a = await caller.getEvent({ programId: program.id })
+    const b = await caller.getEvent({ programId: program.id })
+    expect(a.id).toBe(b.id)
+  })
+})
+
+describe('lunch.updateEvent', () => {
+  it('patches an arbitrary subset of fields', async () => {
+    const program = await createTestProgram({ name: `lunch-upd-${uid()}` })
+    programIds.push(program.id)
+    const { caller } = await newAdminCaller()
+    await caller.getEvent({ programId: program.id })
+    const updated = await caller.updateEvent({
+      programId: program.id,
+      enabled: true,
+      eventAt: new Date('2026-06-28T12:30:00Z'),
+      venue: 'Hôtel Hermitage',
+      changeCutoffHours: 24,
+      extraRecipients: ['caterer@example.com'],
+    })
+    expect(updated.enabled).toBe(true)
+    expect(updated.venue).toBe('Hôtel Hermitage')
+    expect(updated.changeCutoffHours).toBe(24)
+    expect(updated.extraRecipients).toEqual(['caterer@example.com'])
+  })
+
+  it('lazy-creates the event on first updateEvent', async () => {
+    const program = await createTestProgram({ name: `lunch-lazy-${uid()}` })
+    programIds.push(program.id)
+    const { caller } = await newAdminCaller()
+    const updated = await caller.updateEvent({
+      programId: program.id,
+      enabled: true,
+    })
+    expect(updated.enabled).toBe(true)
+    expect(updated.programId).toBe(program.id)
+  })
+
+  it('rejects non-admin callers', async () => {
+    const program = await createTestProgram({ name: `lunch-rej-${uid()}` })
+    programIds.push(program.id)
+    const member = await createTestUser('APPLICANT')
+    userIds.push(member.id)
+    const memberCaller = createCaller(lunchRouter, {
+      id: member.id,
+      email: member.email,
+      role: 'APPLICANT',
+    })
+    await expect(
+      memberCaller.updateEvent({ programId: program.id, enabled: true }),
+    ).rejects.toThrow()
+  })
+})