Add household support: multi-household isolation, each with own admin and users, 38 tests

tests/test_routes.py

@@ -15,12 +15,34 @@ class TestDashboardRoute:
 
     def test_dashboard_renders_users(self, auth_client):
         resp = auth_client.get("/dashboard")
-        # bob and alice were registered
+        # bob and alice were registered in the same household
         assert b"alice" in resp.data
         assert b"bob" in resp.data
         assert b"Lunch" in resp.data
         assert b"Dinner" in resp.data
 
+    def test_dashboard_hides_other_households(self, auth_client):
+        """Bob should NOT see users from other households."""
+        # Register another user in a different household
+        auth_client.get("/logout")
+        auth_client.post("/register", data={
+            "username": "stranger",
+            "password": "stranger1",
+            "confirm": "stranger1",
+            "household_action": "create",
+            "new_household_name": "Stranger House",
+        })
+        # Log back in as bob (Test Household)
+        auth_client.get("/logout")
+        auth_client.post("/login", data={
+            "username": "bob",
+            "password": "bobpass",
+        })
+        resp = auth_client.get("/dashboard")
+        assert resp.status_code == 200
+        assert b"stranger" not in resp.data
+        assert b"Stranger House" not in resp.data
+
 
 class TestRespondRoute:
     def test_respond_sets_status(self, auth_client):
@@ -29,16 +51,13 @@ class TestRespondRoute:
             "status": "yes",
         }, follow_redirects=True)
         assert resp.status_code == 200
-        # After responding, the "Home" chip should be active
         assert b"Home" in resp.data
 
     def test_respond_changes_mind(self, auth_client):
-        # First respond yes
         auth_client.post("/respond", data={
             "meal_type": "dinner",
             "status": "yes",
         })
-        # Then change to no
         resp = auth_client.post("/respond", data={
             "meal_type": "dinner",
             "status": "no",