fix(food): add array support to food API POST

Add array normalization to food API POST endpoint:
- API layer: normalize single object to array (like activity/profile)
- Storage layer: use replaceOne loop with upsert (same as activity pattern)
- Storage layer: accept both single object and array for backward compat

Previously POST /api/food/ with array input would crash:
  insertOne([{...}]) → MongoDB error

Now supports both single object and array input consistently.
Response format is now array (matching treatments pattern).

Fixes #8447

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: bewest

lib/api/food/index.js

@@ -1,5 +1,6 @@
 'use strict';
 
+var _isArray = require('lodash/isArray');
 var consts = require('../../constants');
 
 /**
@@ -13,6 +14,19 @@ function isValidObjectId(id) {
     return /^[a-fA-F0-9]{24}$/.test(id);
 }
 
+/**
+ * Validate _id field for each document in an array.
+ * @returns {Object|null} - null if all valid, or {index, id} of first invalid
+ */
+function findInvalidId(docs) {
+    for (var i = 0; i < docs.length; i++) {
+        if (!isValidObjectId(docs[i]._id)) {
+            return { index: i, id: docs[i]._id };
+        }
+    }
+    return null;
+}
+
 function configure (app, wares, ctx) {
     var express = require('express'),
         api = express.Router( );
@@ -51,14 +65,20 @@ function configure (app, wares, ctx) {
 
     function config_authed (app, api, wares, ctx) {
 
-      // create new record
+      // create new record(s) - supports both single object and array input
       api.post('/food/', ctx.authorization.isPermitted('api:food:create'), function(req, res) {
         var data = req.body;
 
-        // Validate _id if provided
-        if (!isValidObjectId(data._id)) {
+        // Normalize to array for consistent handling
+        if (!_isArray(data)) {
+            data = [data];
+        }
+
+        // Validate _id fields before storage (return 400 on invalid)
+        var invalid = findInvalidId(data);
+        if (invalid) {
             return res.sendJSONStatus(res, consts.HTTP_BAD_REQUEST,
-                'Invalid _id format', 'Must be 24-character hex string or omit for auto-generation. Got: ' + String(data._id));
+                'Invalid _id format', 'Must be 24-character hex string or omit for auto-generation. Got: ' + String(invalid.id));
         }
 
         ctx.food.create(data, function (err, created) {
@@ -68,7 +88,7 @@ function configure (app, wares, ctx) {
             console.log(err);
           } else {
             res.json(created);
-            console.log('food created',created);
+            console.log('food created', created);
           }
         });
       });

lib/server/food.js

@@ -3,15 +3,26 @@
 function storage (env, ctx) {
    var ObjectID = require('mongodb-legacy').ObjectId;
 
-  function create (obj, fn) {
-    obj.created_at = (new Date( )).toISOString( );
-    api().insertOne(obj, function (err, doc) {
-      if (err) {
-        console.log('Data insertion error', err, err.message);
+  function create (docs, fn) {
+    // Normalize to array for consistent handling (allows direct storage calls with single objects)
+    if (!Array.isArray(docs)) {
+      docs = [docs];
+    }
 
-      }
+    var firstErr = null
+      , numDocs = docs.length
+      , totalCreated = 0;
 
-      fn(err, obj);
+    docs.forEach(function(doc) {
+      doc.created_at = (new Date( )).toISOString( );
+      var query = (doc.created_at && doc._id) ? { _id: doc._id, created_at: doc.created_at } : doc;
+      api().replaceOne(query, doc, { upsert: true }, function(err, updateResults) {
+        firstErr = firstErr || err;
+
+        if (++totalCreated === numDocs) {
+          fn(firstErr, docs);
+        }
+      });
     });
   }
 

tests/api.id-validation.test.js

@@ -107,7 +107,10 @@ describe('_id Validation API Tests', function() {
         .send({ "name": "Banana", "type": "food", "carbs": 27 })
         .expect(200)
         .expect(function(response) {
-          response.body.should.have.property('_id');
+          // Food API returns array (consistent with treatments pattern)
+          response.body.should.be.an.Array();
+          response.body.length.should.equal(1);
+          response.body[0].should.have.property('name', 'Banana');
         })
         .end(done);
     });

tests/fixtures/profiles-examples.js

@@ -324,10 +324,12 @@ describe('Storage Layer Shape Handling - Direct Storage Tests', function () {
         fat: 5
       };
 
-      self.ctx.food.create(food, function (err, doc) {
+      self.ctx.food.create(food, function (err, docs) {
         should.not.exist(err);
-        should.exist(doc);
-        doc.name.should.equal('Test Food');
+        should.exist(docs);
+        // Storage normalizes to array internally
+        docs.should.be.an.Array();
+        docs[0].name.should.equal('Test Food');
         done();
       });
     });