fix(gamification): dedup badge unlock via user_badges so events don't re-fire every request (#3472)

[diegosouzapw]

Closes #3472

Problem: checkAndUnlockBadge guarded with getBadges(), which INNER-JOINs badge_definitions. That table is empty in production (seedBuiltinBadges is never wired at startup), so the guard always reported "not earned" and re-emitted events.badge_unlocked for first-token/token-consumer/weekly-warrior on every request (log spam + redundant writes).

Fix: added hasBadge(apiKeyId, badgeId) to db/gamification.ts that reads user_badges directly (no JOIN), and switched the guard to it — dedup is now correct regardless of whether badge_definitions is seeded. Re-exported from localDb.ts (check-db-rules: 50 re-exported, OK).

Test (Rule #18): tests/unit/gamification/badge-unlock-once-3472.test.ts — RED before hasBadge existed; proves hasBadge sees an award even when getBadges is blind (empty definitions) and that a repeated unlock stays a single row. events/badges/db-gamification suites still green.

Note: seeding badge_definitions so badges display is tracked separately under #3484.

[gemini-code-assist]

Code Review

This pull request fixes a bug where badge-unlock events re-fired on every request by introducing a hasBadge helper that queries the user_badges table directly, bypassing the empty badge_definitions table. The review feedback correctly points out that the newly added test file uses Node's built-in node:test and node:assert/strict instead of Vitest, which is the project's standard testing framework, and provides a code suggestion to migrate the test to Vitest.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

The project uses Vitest as its primary testing framework (as indicated by vitest.config.ts and the repository style guide). To maintain consistency across the codebase and ensure proper integration with Vitest's test runner, reporters, and coverage tools, please use vitest instead of the built-in Node.js node:test and node:assert/strict modules.

import { describe, it, expect } from "vitest";
import { unlockBadge, getBadges, hasBadge } from "../../../src/lib/db/gamification";
import { getDbInstance } from "../../../src/lib/db/core";

// Regression for #3472: badge_definitions is empty in production (seedBuiltinBadges is never
// wired at startup). The old "already unlocked?" guard in checkAndUnlockBadge used getBadges(),
// which INNER-JOINs badge_definitions — so it returned [] even after a badge was awarded, and
// the unlock event (events.badge_unlocked) was re-emitted on EVERY request. The guard must read
// user_badges directly so dedup works regardless of whether badge_definitions is populated.

describe("#3472 badge unlock dedup is independent of badge_definitions", () => {
  it("hasBadge() sees an awarded badge even when badge_definitions has no matching row", () => {
    const key = `t3472-${Date.now()}`;
    const badgeId = `first-token-3472-${Date.now()}`;
    const db = getDbInstance();
    try {
      unlockBadge(key, badgeId);
      // getBadges INNER-JOINs badge_definitions → blind to this award (the bug surface).
      expect(getBadges(key).length).toBe(0);
      // The fixed guard reads user_badges directly.
      expect(hasBadge(key, badgeId)).toBe(true);
    } finally {
      db.prepare("DELETE FROM user_badges WHERE api_key_id = ?").run(key);
    }
  });

  it("hasBadge() is false before award and a repeated unlock stays a single row", () => {
    const key = `t3472b-${Date.now()}`;
    const badgeId = `token-consumer-3472-${Date.now()}`;
    const db = getDbInstance();
    try {
      expect(hasBadge(key, badgeId)).toBe(false);
      unlockBadge(key, badgeId);
      unlockBadge(key, badgeId); // INSERT OR IGNORE → still one row
      expect(hasBadge(key, badgeId)).toBe(true);
      const count = db
        .prepare("SELECT COUNT(*) AS n FROM user_badges WHERE api_key_id = ? AND badge_id = ?")
        .get(key, badgeId) as { n: number };
      expect(count.n).toBe(1);
    } finally {
      db.prepare("DELETE FROM user_badges WHERE api_key_id = ?").run(key);
    }
  });
});