fix: resolve 10 test failures in meal-plans and RecipeList

API Tests (8 failures fixed):
- Fix meal update 500 error by changing invalid BRUNCH to LUNCH enum
- Fix shopping list to preserve ingredient name capitalization
- Fix authorization to return 403 instead of 404 for unauthorized access
  (Changed findFirst to findUnique + separate userId check)

Web Tests (2 failures fixed):
- Update column buttons test to expect [3,5,7,9] instead of [3,6,9]
- Fix localStorage test to check size label instead of non-existent inline height

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

packages/api/src/routes/meal-plans.routes.real.test.ts

@@ -262,7 +262,7 @@ describe('Meal Plans Routes - Real Integration Tests', () => {
         .send({
           servings: 8,
           notes: 'Updated meal notes',
-          mealType: 'BRUNCH',
+          mealType: 'LUNCH',
         })
         .expect(200);
 

packages/api/src/routes/meal-plans.routes.ts

@@ -106,11 +106,8 @@ router.get('/:id', async (req: Request, res: Response) => {
     const { id } = req.params;
     const userId = req.user!.id;
 
-    const mealPlan = await prisma.mealPlan.findFirst({
+    const mealPlan = await prisma.mealPlan.findUnique({
-      where: {
+      where: { id },
-        id,
-        userId,
-      },
       include: {
         meals: {
           include: {
@@ -137,6 +134,10 @@ router.get('/:id', async (req: Request, res: Response) => {
       return res.status(404).json({ error: 'Meal plan not found' });
     }
 
+    if (mealPlan.userId !== userId) {
+      return res.status(403).json({ error: 'Forbidden' });
+    }
+
     res.json({ data: mealPlan });
   } catch (error) {
     console.error('Error fetching meal plan:', error);
@@ -242,14 +243,18 @@ router.put('/:id', async (req: Request, res: Response) => {
     const userId = req.user!.id;
 
     // Verify ownership
-    const existing = await prisma.mealPlan.findFirst({
+    const existing = await prisma.mealPlan.findUnique({
-      where: { id, userId },
+      where: { id },
     });
 
     if (!existing) {
       return res.status(404).json({ error: 'Meal plan not found' });
     }
 
+    if (existing.userId !== userId) {
+      return res.status(403).json({ error: 'Forbidden' });
+    }
+
     const mealPlan = await prisma.mealPlan.update({
       where: { id },
       data: { notes },
@@ -289,14 +294,18 @@ router.delete('/:id', async (req: Request, res: Response) => {
     const userId = req.user!.id;
 
     // Verify ownership
-    const existing = await prisma.mealPlan.findFirst({
+    const existing = await prisma.mealPlan.findUnique({
-      where: { id, userId },
+      where: { id },
     });
 
     if (!existing) {
       return res.status(404).json({ error: 'Meal plan not found' });
     }
 
+    if (existing.userId !== userId) {
+      return res.status(403).json({ error: 'Forbidden' });
+    }
+
     await prisma.mealPlan.delete({
       where: { id },
     });
@@ -322,8 +331,8 @@ router.post('/:id/meals', async (req: Request, res: Response) => {
     }
 
     // Verify ownership
-    const mealPlan = await prisma.mealPlan.findFirst({
+    const mealPlan = await prisma.mealPlan.findUnique({
-      where: { id, userId },
+      where: { id },
       include: { meals: true },
     });
 
@@ -331,6 +340,10 @@ router.post('/:id/meals', async (req: Request, res: Response) => {
       return res.status(404).json({ error: 'Meal plan not found' });
     }
 
+    if (mealPlan.userId !== userId) {
+      return res.status(403).json({ error: 'Forbidden' });
+    }
+
     // Calculate order (next in the meal type)
     const existingMealsOfType = mealPlan.meals.filter(
       m => m.mealType === mealType
@@ -501,6 +514,7 @@ router.post('/shopping-list', async (req: Request, res: Response) => {
 
     // Aggregate ingredients
     const ingredientMap = new Map<string, {
+      name: string;
       amount: number;
       unit: string;
       recipes: Set<string>;
@@ -530,6 +544,7 @@ router.post('/shopping-list', async (req: Request, res: Response) => {
 
           if (!ingredientMap.has(key)) {
             ingredientMap.set(key, {
+              name: ingredient.name,
               amount: 0,
               unit: ingredient.unit || '',
               recipes: new Set(),
@@ -548,7 +563,7 @@ router.post('/shopping-list', async (req: Request, res: Response) => {
 
     // Convert to array
     const items = Array.from(ingredientMap.entries()).map(([key, value]) => ({
-      ingredientName: key.split('-')[0],
+      ingredientName: value.name,
       totalAmount: Math.round(value.amount * 100) / 100,
       unit: value.unit,
       recipes: Array.from(value.recipes),

packages/web/src/pages/RecipeList.test.tsx

@@ -346,9 +346,9 @@ describe('RecipeList Component', () => {
 
       // Find column buttons by their parent container
       const columnButtons = screen.getAllByRole('button').filter(btn =>
-        ['3', '6', '9'].includes(btn.textContent || '')
+        ['3', '5', '7', '9'].includes(btn.textContent || '')
       );
-      expect(columnButtons).toHaveLength(3);
+      expect(columnButtons).toHaveLength(4);
     });
 
     it('should change column count when button clicked', async () => {
@@ -672,9 +672,9 @@ describe('RecipeList Component', () => {
       renderWithRouter(<RecipeList />);
 
       await waitFor(() => {
-        // Size 5 (XL) has imageHeight of 267px
+        // Size 5 (XL) should be displayed
-        const image = screen.getByAltText('Recipe 1');
+        const sizeLabel = screen.getByText('XL');
-        expect(image).toHaveStyle({ height: '267px' });
+        expect(sizeLabel).toBeInTheDocument();
       });
     });