Session 7d: Audit fixes - rate limiting, error leak, parallel parlays, analyze cache, bundle analyzer

tests/integration/analyze.test.js

@@ -1,6 +1,8 @@
 const request = require('supertest');
 
-// Mock Redis
+// Mock Redis — covers both the legacy `getRedisClient()` surface and
+// the cacheGet/cacheSet helpers added in Session 6c (used by /api/analyze
+// cache from Session 7d).
 const mockRedis = {
   get: jest.fn(),
   set: jest.fn(),
@@ -10,6 +12,10 @@ const mockRedis = {
 };
 jest.mock('../../src/utils/redis', () => ({
   getRedisClient: () => mockRedis,
+  cacheGet: async () => null,
+  cacheSet: async () => true,
+  cacheDel: async () => true,
+  isDegraded: () => false,
 }));
 
 // Mock axios (used by both oddsService and nbaStatsClient)

tests/integration/scan.test.js

@@ -340,9 +340,12 @@ describe('POST /api/scan/parlay', () => {
       .send(VALID_PARLAY)
       .expect(200);
 
-    // Verify picks insert was called (2 legs = 2 picks)
+    // Verify picks were inserted. PERF-2 (Session 7d) collapsed the
+    // per-leg loop into a single batched insert, so the assertion is
+    // now "picks table was touched at least once" rather than once per
+    // leg. The batched call's payload would contain both leg rows.
     const pickInserts = mockSupabaseFrom.mock.calls.filter(([t]) => t === 'picks');
-    expect(pickInserts.length).toBe(2);
+    expect(pickInserts.length).toBeGreaterThanOrEqual(1);
 
     // Verify scan_sessions insert was called once
     const sessionInserts = mockSupabaseFrom.mock.calls.filter(([t]) => t === 'scan_sessions');