test: fix stale requireSession mocks after auth-widening pass (v0.30.1)

Four route test files still mocked requireSession after their routes
were converted to requireSessionOrApiKey in an earlier commit this
session — every test in them was failing at the auth call before
reaching the logic under test. Also adds the missing inArray export
to one file's @epicure/db mock, uncovered once its auth mock was
fixed and the test could actually run further.

No production code changed; two unrelated pre-existing failures
(lib/__tests__/tiers.test.ts, lib/__tests__/webhooks.test.ts) remain
and are confirmed present on main before this session's changes.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -2,6 +2,10 @@
 
 All notable changes to Epicure are documented here. This file is mirrored in-app at `/changelog` (and in the admin dashboard) via `apps/web/lib/changelog.ts` — update both together.
 
+## 0.30.1 — 2026-07-14 16:20
+
+Internal: fixed test mocks left stale by the earlier API-key auth-widening pass (recipes/meal-plans/shopping-lists route tests) — no user-facing change.
+
 ## 0.30.0 — 2026-07-14 16:05
 
 ### Added

apps/web/app/api/v1/meal-plans/[weekStart]/members/__tests__/route.test.ts

@@ -4,7 +4,7 @@ import { NextRequest } from "next/server";
 const mockSession = { user: { id: "user-1" } };
 
 vi.mock("@/lib/api-auth", () => ({
-  requireSession: vi.fn(),
+  requireSessionOrApiKey: vi.fn(),
 }));
 
 const { mockPlanFindFirst, mockMemberFindFirst, mockMemberFindMany, mockUserFindFirst, mockInsertValues, mockInsertPlanValues, mockDeleteWhere } = vi.hoisted(() => ({
@@ -34,7 +34,7 @@ vi.mock("@epicure/db", () => ({
   and: vi.fn((...args) => ({ args, op: "and" })),
 }));
 
-const { requireSession } = await import("@/lib/api-auth");
+const { requireSessionOrApiKey } = await import("@/lib/api-auth");
 import { GET, POST, DELETE } from "../route";
 
 const ctx = { params: Promise.resolve({ weekStart: "2026-06-01" }) };
@@ -49,7 +49,7 @@ function makeRequest(method: string, body?: unknown, search = "") {
 
 beforeEach(() => {
   vi.clearAllMocks();
-  vi.mocked(requireSession).mockResolvedValue({ session: mockSession as never, response: null });
+  vi.mocked(requireSessionOrApiKey).mockResolvedValue({ session: mockSession as never, response: null });
 });
 
 describe("GET /api/v1/meal-plans/[weekStart]/members", () => {
@@ -123,7 +123,7 @@ describe("DELETE /api/v1/meal-plans/[weekStart]/members", () => {
   it("returns 403 when caller is neither owner nor the member themselves", async () => {
     mockPlanFindFirst.mockResolvedValue({ id: "plan-1", userId: "user-1" });
     mockMemberFindFirst.mockResolvedValue({ id: "m1", userId: "user-2" });
-    vi.mocked(requireSession).mockResolvedValue({ session: { user: { id: "user-3" } } as never, response: null });
+    vi.mocked(requireSessionOrApiKey).mockResolvedValue({ session: { user: { id: "user-3" } } as never, response: null });
     const res = await DELETE(makeRequest("DELETE", undefined, "?memberId=m1"), ctx);
     expect(res.status).toBe(403);
   });

apps/web/app/api/v1/meal-plans/shared/[mealPlanId]/entries/__tests__/route.test.ts

@@ -4,7 +4,7 @@ import { NextRequest } from "next/server";
 const mockSession = { user: { id: "user-2" } };
 
 vi.mock("@/lib/api-auth", () => ({
-  requireSession: vi.fn(),
+  requireSessionOrApiKey: vi.fn(),
 }));
 
 vi.mock("@/lib/webhooks", () => ({
@@ -37,9 +37,10 @@ vi.mock("@epicure/db", () => ({
   and: vi.fn((...args) => ({ args, op: "and" })),
   or: vi.fn((...args) => ({ args, op: "or" })),
   ne: vi.fn((a, b) => ({ a, b, op: "ne" })),
+  inArray: vi.fn((a, b) => ({ a, b, op: "inArray" })),
 }));
 
-const { requireSession } = await import("@/lib/api-auth");
+const { requireSessionOrApiKey } = await import("@/lib/api-auth");
 import { POST, DELETE } from "../route";
 
 const ctx = { params: Promise.resolve({ mealPlanId: "plan-1" }) };
@@ -54,7 +55,7 @@ function makeRequest(method: string, body?: unknown, search = "") {
 
 beforeEach(() => {
   vi.clearAllMocks();
-  vi.mocked(requireSession).mockResolvedValue({ session: mockSession as never, response: null });
+  vi.mocked(requireSessionOrApiKey).mockResolvedValue({ session: mockSession as never, response: null });
   mockPlanFindFirst.mockResolvedValue({ id: "plan-1", userId: "user-1" });
 });
 

apps/web/app/api/v1/recipes/bulk/__tests__/route.test.ts

@@ -10,7 +10,7 @@ const { mockRequireSession } = vi.hoisted(() => ({
 }));
 
 vi.mock("@/lib/api-auth", () => ({
-  requireSession: mockRequireSession,
+  requireSessionOrApiKey: mockRequireSession,
 }));
 
 vi.mock("@epicure/db", () => ({

apps/web/app/api/v1/shopping-lists/[id]/members/__tests__/route.test.ts

@@ -4,7 +4,7 @@ import { NextRequest } from "next/server";
 const mockSession = { user: { id: "user-1" } };
 
 vi.mock("@/lib/api-auth", () => ({
-  requireSession: vi.fn(),
+  requireSessionOrApiKey: vi.fn(),
 }));
 
 const { mockListFindFirst, mockMemberFindFirst, mockMemberFindMany, mockUserFindFirst, mockInsertValues, mockDeleteWhere } = vi.hoisted(() => ({
@@ -33,7 +33,7 @@ vi.mock("@epicure/db", () => ({
   and: vi.fn((...args) => ({ args, op: "and" })),
 }));
 
-const { requireSession } = await import("@/lib/api-auth");
+const { requireSessionOrApiKey } = await import("@/lib/api-auth");
 import { GET, POST, DELETE } from "../route";
 
 const ctx = { params: Promise.resolve({ id: "list-1" }) };
@@ -48,7 +48,7 @@ function makeRequest(method: string, body?: unknown, search = "") {
 
 beforeEach(() => {
   vi.clearAllMocks();
-  vi.mocked(requireSession).mockResolvedValue({ session: mockSession as never, response: null });
+  vi.mocked(requireSessionOrApiKey).mockResolvedValue({ session: mockSession as never, response: null });
 });
 
 describe("GET /api/v1/shopping-lists/[id]/members", () => {

apps/web/lib/changelog.ts

@@ -1,5 +1,5 @@
 // Mirrors CHANGELOG.md at the repo root — update both together.
-export const APP_VERSION = "0.30.0";
+export const APP_VERSION = "0.30.1";
 
 export type ChangelogEntry = {
   version: string;
@@ -11,6 +11,11 @@ export type ChangelogEntry = {
 };
 
 export const CHANGELOG: ChangelogEntry[] = [
+  {
+    version: "0.30.1",
+    date: "2026-07-14 16:20",
+    notes: "Internal: fixed test mocks left stale by the earlier API-key auth-widening pass (recipes/meal-plans/shopping-lists route tests) — no user-facing change.",
+  },
   {
     version: "0.30.0",
     date: "2026-07-14 16:05",

apps/web/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@epicure/web",
-  "version": "0.30.0",
+  "version": "0.30.1",
   "private": true,
   "scripts": {
     "dev": "next dev",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "epicure",
-  "version": "0.30.0",
+  "version": "0.30.1",
   "private": true,
   "scripts": {
     "dev": "pnpm --filter web dev",