release: engagement de posts (N03 + N04) — comentarios, valoraciones, tracking y dashboard

.github/CODEOWNERS

@@ -0,0 +1,17 @@
+# Propietarios de código — Nun Ibiza PinBoard App
+#
+# Gana la ÚLTIMA regla que coincide, no la más específica.
+# Por eso el comodín va primero.
+#
+# Solo surte efecto de bloqueo si el ruleset tiene require_code_owner_review: true.
+
+*                       @Azfe
+
+# Zonas críticas: decisiones de arquitectura, esquema de datos y RLS.
+/docs/adr/              @Azfe
+/supabase/migrations/   @Azfe
+/supabase/functions/    @Azfe
+/supabase/tests/        @Azfe
+
+# La propia configuración de revisión no se cambia sin revisión.
+/.github/               @Azfe

.github/pull_request_template.md

@@ -0,0 +1,27 @@
+## Qué cambia
+
+<!-- Una o dos frases. Qué hace este PR y por qué. -->
+
+Closes #
+
+## Decisiones de arquitectura
+
+- [ ] Este PR **no** cambia ninguna decisión registrada en `docs/adr/`.
+- [ ] Este PR **sí** la cambia. ADR que lo respalda: `docs/adr/____`
+      (el ADR debe existir y estar aprobado **antes** de la implementación,
+      no escribirse después para justificarla)
+
+Si supersede a un ADR anterior, marca el antiguo como `Superseded por ADR-XXXX`
+y actualiza el índice en `docs/adr/README.md`.
+
+## Consumidores afectados
+
+<!-- Si tocas una tabla, una Edge Function o un tipo compartido: qué más deja de
+     compilar o de funcionar. Enumera las issues que quedan abiertas por ello. -->
+
+## Comprobaciones
+
+- [ ] Migración aplicada en local y revisada.
+- [ ] Cada policy RLS nueva tiene al menos un test positivo y uno negativo en `supabase/tests/`.
+- [ ] `pnpm lint`, `pnpm typecheck` y `pnpm test` pasan.
+- [ ] Los tipos de Supabase están regenerados si cambió el esquema.

.github/rulesets/protect-main-and-develop.json

@@ -0,0 +1,48 @@
+{
+  "name": "Protección de main y develop",
+  "target": "branch",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "include": ["refs/heads/main", "refs/heads/develop"],
+      "exclude": []
+    }
+  },
+  "bypass_actors": [
+    {
+      "actor_id": 5,
+      "actor_type": "RepositoryRole",
+      "bypass_mode": "pull_request"
+    }
+  ],
+  "rules": [
+    { "type": "deletion" },
+    { "type": "non_fast_forward" },
+    {
+      "type": "pull_request",
+      "parameters": {
+        "required_approving_review_count": 1,
+        "require_code_owner_review": true,
+        "require_last_push_approval": true,
+        "dismiss_stale_reviews_on_push": true,
+        "required_review_thread_resolution": true,
+        "allowed_merge_methods": ["squash", "merge", "rebase"]
+      }
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "strict_required_status_checks_policy": true,
+        "do_not_enforce_on_create": false,
+        "required_status_checks": [
+          { "context": "Lint", "integration_id": 15368 },
+          { "context": "Markdown Lint (ADRs)", "integration_id": 15368 },
+          { "context": "TypeScript", "integration_id": 15368 },
+          { "context": "Tests (Jest)", "integration_id": 15368 },
+          { "context": "RLS Tests (Supabase)", "integration_id": 15368 },
+          { "context": "Integration Tests (Supabase)", "integration_id": 15368 }
+        ]
+      }
+    }
+  ]
+}

.github/workflows/ci.yml

@@ -104,6 +104,41 @@ jobs:
         with:
           version: 2.108.0
       - run: supabase start
-      - run: pnpm test -- --ci --testPathPattern="__tests__/integration/"
+      # `supabase start` no sirve las Edge Functions: hay que arrancarlas aparte
+      # para que el test de integración de track-engagement pueda alcanzarlas.
+      # Se sirve en background dentro del mismo step (así el proceso sigue vivo
+      # durante los tests) y se CALIENTA antes de lanzar Jest.
+      #
+      # El calentamiento manda un JWT (la anon key) en `Authorization`, y eso importa:
+      # sin esa cabecera la función corta en su primer check ("Missing Authorization
+      # header") sin llegar a crear el cliente Supabase, así que el probe daría "listo"
+      # sin haber pagado el arranque en frío. Con el Bearer, la función recorre
+      # createClient + getUser y responde 401 "Unauthorized": eso prueba que el camino
+      # caro ya está caliente, y el cold start se paga aquí y no en un timeout de Jest.
+      - name: Serve edge functions and run integration tests
+        run: |
+          supabase functions serve track-engagement --no-verify-jwt > /tmp/functions.log 2>&1 &
+
+          # `status -o json` es estable entre versiones de la CLI; el parseo de
+          # `-o env` no lo era y dejaba ANON_KEY vacío en silencio.
+          ANON_KEY=$(supabase status -o json \
+            | node -e "let s='';process.stdin.on('data',d=>s+=d).on('end',()=>process.stdout.write(JSON.parse(s).ANON_KEY))")
+          if [ -z "$ANON_KEY" ]; then
+            echo "::error::no se pudo leer ANON_KEY de 'supabase status -o json'"; exit 1
+          fi
+
+          for i in $(seq 1 30); do
+            body=$(curl -s -m 30 -X POST http://127.0.0.1:54321/functions/v1/track-engagement \
+              -H "apikey: $ANON_KEY" -H "Authorization: Bearer $ANON_KEY" \
+              -H "Content-Type: application/json" -d '[]' || true)
+            if echo "$body" | grep -q 'Unauthorized'; then
+              echo "edge function warm (createClient + getUser exercised)"; break
+            fi
+            echo "warming edge function... ($body)"; sleep 2
+          done
+
+          pnpm test -- --ci --testPathPattern="__tests__/integration/"
+      - if: always()
+        run: cat /tmp/functions.log || true
       - if: always()
         run: supabase stop

__tests__/components/CommentComposer.test.tsx

@@ -0,0 +1,46 @@
+import React from 'react';
+import { fireEvent, render } from '@testing-library/react-native';
+
+import { CommentComposer } from '@/components/comments';
+
+// CommentComposer importa MAX_COMMENT_LENGTH de @/lib/comments, que a su vez carga
+// @/lib/supabase (createClient con env de Expo, no disponible en jest).
+jest.mock('@/lib/supabase', () => ({ supabase: {} }));
+
+describe('CommentComposer', () => {
+  it('el botón está deshabilitado cuando el campo está vacío', () => {
+    const onSubmit = jest.fn();
+    const { getByLabelText } = render(<CommentComposer onSubmit={onSubmit} />);
+
+    fireEvent.press(getByLabelText('Comentar'));
+    expect(onSubmit).not.toHaveBeenCalled();
+  });
+
+  it('envía el comentario recortado y limpia el campo', () => {
+    const onSubmit = jest.fn();
+    const { getByLabelText } = render(<CommentComposer onSubmit={onSubmit} />);
+
+    const input = getByLabelText('Nuevo comentario');
+    fireEvent.changeText(input, '  hola mundo  ');
+    fireEvent.press(getByLabelText('Comentar'));
+
+    expect(onSubmit).toHaveBeenCalledWith('hola mundo');
+  });
+
+  it('no envía cuando solo hay espacios', () => {
+    const onSubmit = jest.fn();
+    const { getByLabelText } = render(<CommentComposer onSubmit={onSubmit} />);
+
+    fireEvent.changeText(getByLabelText('Nuevo comentario'), '    ');
+    fireEvent.press(getByLabelText('Comentar'));
+
+    expect(onSubmit).not.toHaveBeenCalled();
+  });
+
+  it('muestra el contador de caracteres', () => {
+    const { getByText, getByLabelText } = render(<CommentComposer onSubmit={jest.fn()} />);
+
+    fireEvent.changeText(getByLabelText('Nuevo comentario'), 'abc');
+    expect(getByText('3/2000')).toBeTruthy();
+  });
+});

__tests__/components/EngagementScreen.test.tsx

@@ -0,0 +1,124 @@
+import React from 'react';
+import { render, screen } from '@testing-library/react-native';
+
+import EngagementScreen from '@/app/(app)/(tabs)/admin/engagement/index';
+import type { PostEngagement } from '@/lib/supabase/queries/engagement';
+
+// ─── Mocks ──────────────────────────────────────────────────────────────────
+
+const mockUseSession = jest.fn();
+const mockUseMetrics = jest.fn();
+
+// El módulo de queries arrastra el singleton de Supabase, que lee
+// Constants.expoConfig.extra (no poblado bajo Jest).
+jest.mock('@/lib/supabase', () => ({ supabase: {} }));
+
+jest.mock('@/hooks/useSession', () => ({
+  useSession: () => mockUseSession(),
+}));
+
+jest.mock('@/hooks/usePostEngagementMetrics', () => ({
+  usePostEngagementMetrics: () => mockUseMetrics(),
+}));
+
+jest.mock('expo-router', () => ({
+  Redirect: () => null,
+  Stack: { Screen: () => null },
+}));
+
+jest.mock('react-native-safe-area-context', () => {
+  // eslint-disable-next-line @typescript-eslint/no-require-imports
+  const { View } = require('react-native');
+  return { SafeAreaView: View };
+});
+
+const ROWS: PostEngagement[] = [
+  {
+    post_id: 'p1',
+    title: 'Nueva carta de temporada',
+    unique_readers: 4,
+    unique_clicks: 3,
+    click_rate: 0.75,
+    avg_rating: 4.5,
+    total_reactions: 6,
+    engaged_users: 2,
+    avg_seconds: 12,
+    avg_scroll: 0.8,
+  },
+];
+
+function metrics(overrides: Partial<ReturnType<typeof mockUseMetrics>> = {}) {
+  return {
+    rows: ROWS,
+    loading: false,
+    error: null,
+    refresh: jest.fn(),
+    ...overrides,
+  };
+}
+
+beforeEach(() => {
+  jest.clearAllMocks();
+  mockUseSession.mockReturnValue({ session: { userId: 'u1', role: 'admin' } });
+  mockUseMetrics.mockReturnValue(metrics());
+});
+
+// ─── Tests ───────────────────────────────────────────────────────────────────
+
+describe('EngagementScreen', () => {
+  it('shows the metrics of each post to an admin', () => {
+    render(<EngagementScreen />);
+
+    expect(screen.getByText('Nueva carta de temporada')).toBeTruthy();
+    expect(screen.getByText('3')).toBeTruthy(); // unique_clicks
+    expect(screen.getByText('75%')).toBeTruthy(); // click_rate
+    expect(screen.getByText('4.5')).toBeTruthy(); // avg_rating
+    expect(screen.getByText('6')).toBeTruthy(); // total_reactions
+    // engaged (ADR-001): interactuaron pero no llegaron al enlace externo.
+    expect(screen.getByText(/2 interactuaron sin clicar/)).toBeTruthy();
+  });
+
+  it('shows the metrics to a manager too', () => {
+    mockUseSession.mockReturnValue({ session: { userId: 'u2', role: 'manager' } });
+
+    render(<EngagementScreen />);
+
+    expect(screen.getByText('Nueva carta de temporada')).toBeTruthy();
+  });
+
+  it('does not render the metrics for staff (redirects away)', () => {
+    mockUseSession.mockReturnValue({ session: { userId: 'u3', role: 'staff' } });
+
+    render(<EngagementScreen />);
+
+    expect(screen.queryByText('Nueva carta de temporada')).toBeNull();
+  });
+
+  it('renders an em dash when a post has no readers or ratings', () => {
+    mockUseMetrics.mockReturnValue(
+      metrics({
+        rows: [{ ...ROWS[0]!, unique_readers: 0, unique_clicks: 0, click_rate: null, avg_rating: null }],
+      }),
+    );
+
+    render(<EngagementScreen />);
+
+    expect(screen.getAllByText('—')).toHaveLength(2); // click_rate y avg_rating
+  });
+
+  it('shows the empty state when there is no activity', () => {
+    mockUseMetrics.mockReturnValue(metrics({ rows: [] }));
+
+    render(<EngagementScreen />);
+
+    expect(screen.getByText(/Todavía no hay actividad registrada/)).toBeTruthy();
+  });
+
+  it('shows the error state', () => {
+    mockUseMetrics.mockReturnValue(metrics({ rows: [], error: 'Fallo de red' }));
+
+    render(<EngagementScreen />);
+
+    expect(screen.getByText('Fallo de red')).toBeTruthy();
+  });
+});

__tests__/components/PostCard.test.tsx

@@ -18,6 +18,8 @@ jest.mock('expo-image', () => {
 
 jest.mock('lucide-react-native', () => ({
   ExternalLink: () => null,
+  MessageCircle: () => null,
+  Star: () => null,
 }));
 
 jest.mock('@/hooks/usePostReactions', () => ({
@@ -49,6 +51,9 @@ const POST: PostWithAuthor = {
   updated_at: '2026-06-30T09:00:00Z',
   deleted_at: null,
   author: { name: 'Juan', surname: 'García' },
+  comments_count: 4,
+  rating_average: 4.25,
+  rating_count: 8,
 };
 
 // ─── Tests ───────────────────────────────────────────────────────────────────
@@ -91,6 +96,18 @@ describe('PostCard', () => {
     expect(getByText('—')).toBeTruthy();
   });
 
+  it('renders the rounded rating average when the post has ratings', () => {
+    const { getByText } = render(<PostCard post={POST} onPress={jest.fn()} />);
+    expect(getByText('4.3')).toBeTruthy(); // 4.25 -> toFixed(1)
+  });
+
+  it('does not render a rating when the post has no ratings', () => {
+    const { queryByText } = render(
+      <PostCard post={{ ...POST, rating_average: 0, rating_count: 0 }} onPress={jest.fn()} />,
+    );
+    expect(queryByText('0.0')).toBeNull();
+  });
+
   it('calls onPress when tapped', () => {
     const onPress = jest.fn();
     const { getByRole } = render(<PostCard post={POST} onPress={onPress} />);