[svenger87]

Summary

Two bugs that came up while comparing Kinboard with Yuvomi.

1. Changing the family code didn't sign anyone out (security).

• The confirmation said "all connected devices will need to rejoin", but rotation was only a browser-side UPDATE of families.join_code.
• Sessions last a year, and revokeFamilySessions in lib/session.ts was written "for a join-code rotation" but had no callers. After a lost phone, a new code only stopped new devices from joining.
• New POST /api/family/join-code:
  • Rotates the code using crypto.randomInt. The browser version used Math.random.
  • Requires a session and the settings PIN.
  • Revokes every other session of the family and keeps the caller's.
• A failed revoke now throws, so the route never reports success when nobody was signed out.
• The confirm text now says exactly what happens (en/de/fr), and failures show a toast.

2. Sending a recipe or the meal plan to the shopping list created duplicates.

• useAddRecipeToShoppingList and useGenerateShoppingFromMealPlan did a plain .insert. Milk already on the list was added a second time, and the same recipe added twice doubled every item.
• lib/shopping-merge.ts already had the right rules, but only the assistant API used them.
• addOrMergeShoppingItems moves from the server-only lib/shopping-enrich.ts into a new browser-safe lib/shopping-add.ts. Its shoppingStore works with either Supabase client. shopping-enrich.ts re-exports it, so the server callers are unchanged.
• Both hooks now merge, and they invalidate the shopping page's real query key (queryKeys.shoppingItems) instead of ["shopping_items", …], which nothing reads.

Type of change

• Bug fix
• New feature
• Refactor (no user-facing change)
• Documentation
• Translation
• Plugin / integration

Test plan

• e2e/join-code-rotation.spec.ts: revokes others but keeps the caller, needs a session and PIN, uses the session's family only, crypto code, the hook goes through the route, strings exist in all locales
• e2e/shopping-merge-ui.spec.ts: merges into an existing item and inserts a new one through a fake Supabase client; both hooks use the merge; shopping-add.ts imports nothing server-only
• Full stack-free spec suite as CI runs it: 10,419 passed
• npm run lint, npx tsc --noEmit, node scripts/check-changelog-sections.mjs
• Not exercised on a running stack: rotate the code on one device and check that a second device lands on the join screen while the first stays in

Screenshots

Text-only change to the existing confirmation dialog.

Checklist

• npm run lint passes
• New strings added to both messages/en.json and messages/de.json (and fr)
• Schema changes ship as a new webapp/docker/migration*.sql file (none needed)
• No secrets, real API keys, or personal hostnames in the diff
• I agree to the licensing of contributions
• CHANGELOG.md updated under [Unreleased] (Fixed and Security)
• Commit follows Conventional Commits

---

Generated by Claude Code