feat: notifications system, rate limiting, fix recipe visibility 404, follow race

Part of the social-feature backlog (follow, comments, reactions, ratings,
feed, threading) audited earlier — see conversation.

- notifications table: follow/comment/reply/reaction/rating events,
  replaces the fully-dead feed_items table (feed_item_type enum existed
  but had zero references anywhere in the codebase).
- Bell UI in the nav with unread badge, mark-all-read, 30s poll.
- Rate limiting on comment posting (20/min), follow/unfollow (30/min),
  and comment reactions (60/min) — previously unthrottled.
- /recipes/[id] queried by (id, authorId=session.user) only, so any
  recipe not owned by the viewer 404'd regardless of visibility.
  Widen the query to include public/unlisted recipes and gate the
  owner-only actions (edit, delete, version history, translate, AI
  content generation) behind an isOwner check.
- user_follows had no primary key/unique constraint, so the follow
  route's onConflictDoNothing() was a silent no-op — concurrent follow
  clicks could insert duplicate rows and inflate follower counts. Add
  a composite primary key on (follower_id, following_id).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/api/v1/notifications/read/route.ts

@@ -0,0 +1,21 @@
+import { NextRequest, NextResponse } from "next/server";
+import { db, notifications, eq, and } from "@epicure/db";
+import { requireSession } from "@/lib/api-auth";
+
+export async function POST(req: NextRequest) {
+  const { session, response } = await requireSession();
+  if (response) return response;
+
+  const body = (await req.json().catch(() => ({}))) as { id?: string };
+
+  await db
+    .update(notifications)
+    .set({ read: true })
+    .where(
+      body.id
+        ? and(eq(notifications.userId, session!.user.id), eq(notifications.id, body.id))
+        : eq(notifications.userId, session!.user.id)
+    );
+
+  return NextResponse.json({ ok: true });
+}

apps/web/app/api/v1/notifications/route.ts

@@ -0,0 +1,35 @@
+import { NextResponse } from "next/server";
+import { db, notifications, users, eq, and, desc, count } from "@epicure/db";
+import { requireSession } from "@/lib/api-auth";
+
+export async function GET() {
+  const { session, response } = await requireSession();
+  if (response) return response;
+
+  const [rows, unread] = await Promise.all([
+    db
+      .select({
+        id: notifications.id,
+        type: notifications.type,
+        recipeId: notifications.recipeId,
+        commentId: notifications.commentId,
+        read: notifications.read,
+        createdAt: notifications.createdAt,
+        actorId: notifications.actorId,
+        actorName: users.name,
+        actorUsername: users.username,
+        actorAvatarUrl: users.avatarUrl,
+      })
+      .from(notifications)
+      .innerJoin(users, eq(notifications.actorId, users.id))
+      .where(eq(notifications.userId, session!.user.id))
+      .orderBy(desc(notifications.createdAt))
+      .limit(30),
+    db
+      .select({ total: count() })
+      .from(notifications)
+      .where(and(eq(notifications.userId, session!.user.id), eq(notifications.read, false))),
+  ]);
+
+  return NextResponse.json({ notifications: rows, unreadCount: unread[0]?.total ?? 0 });
+}

apps/web/app/api/v1/recipes/[id]/comments/[commentId]/reactions/route.ts

@@ -2,6 +2,8 @@ import { NextRequest, NextResponse } from "next/server";
 import { z } from "zod";
 import { db, comments, commentReactions, eq, and, count } from "@epicure/db";
 import { requireSession } from "@/lib/api-auth";
+import { applyRateLimit } from "@/lib/rate-limit";
+import { createNotification } from "@/lib/notifications";
 
 const ReactionSchema = z.object({
   type: z.enum(["like", "love", "laugh", "wow", "sad", "fire"]),
@@ -49,6 +51,10 @@ export async function GET(req: NextRequest, { params }: Params) {
 export async function POST(req: NextRequest, { params }: Params) {
   const { session, response } = await requireSession();
   if (response) return response;
+
+  const limited = await applyRateLimit(`rl:reaction:${session!.user.id}`, 60, 60);
+  if (limited) return limited;
+
   const { commentId } = await params;
 
   // Verify comment exists
@@ -85,6 +91,7 @@ export async function POST(req: NextRequest, { params }: Params) {
       type,
     });
     added = true;
+    void createNotification({ userId: comment.userId, type: "reaction", actorId: userId, recipeId: comment.recipeId, commentId });
   }
 
   // Return updated counts

apps/web/app/api/v1/recipes/[id]/comments/route.ts

@@ -2,8 +2,10 @@ import { NextRequest, NextResponse } from "next/server";
 import { z } from "zod";
 import { db, recipes, comments, users, eq, and } from "@epicure/db";
 import { requireSession } from "@/lib/api-auth";
+import { applyRateLimit } from "@/lib/rate-limit";
 import { dispatchWebhook } from "@/lib/webhooks";
 import { sendPushNotification } from "@/lib/push";
+import { createNotification } from "@/lib/notifications";
 
 const Schema = z.object({
   content: z.string().min(1).max(5000),
@@ -44,6 +46,9 @@ export async function POST(req: NextRequest, { params }: Params) {
   if (response) return response;
   const { id } = await params;
 
+  const limited = await applyRateLimit(`rl:comment:${session!.user.id}`, 20, 60);
+  if (limited) return limited;
+
   const recipe = await db.query.recipes.findFirst({ where: eq(recipes.id, id) });
   if (!recipe || (recipe.visibility === "private" && recipe.authorId !== session!.user.id)) {
     return NextResponse.json({ error: "Not found" }, { status: 404 });
@@ -53,8 +58,9 @@ export async function POST(req: NextRequest, { params }: Params) {
   const parsed = Schema.safeParse(body);
   if (!parsed.success) return NextResponse.json({ error: "Validation error" }, { status: 400 });
 
+  let parent: { id: string; userId: string } | undefined;
   if (parsed.data.parentId) {
-    const parent = await db.query.comments.findFirst({
+    parent = await db.query.comments.findFirst({
       where: and(eq(comments.id, parsed.data.parentId), eq(comments.recipeId, id)),
     });
     if (!parent) return NextResponse.json({ error: "Parent comment not found" }, { status: 404 });
@@ -78,5 +84,13 @@ export async function POST(req: NextRequest, { params }: Params) {
       url: `/recipes/${id}`,
     });
   }
+
+  if (parent && parent.userId !== session!.user.id) {
+    void createNotification({ userId: parent.userId, type: "reply", actorId: session!.user.id, recipeId: id, commentId });
+  }
+  if (recipe.authorId !== parent?.userId) {
+    void createNotification({ userId: recipe.authorId, type: "comment", actorId: session!.user.id, recipeId: id, commentId });
+  }
+
   return NextResponse.json({ id: commentId }, { status: 201 });
 }

apps/web/app/api/v1/recipes/[id]/rate/route.ts

@@ -2,6 +2,7 @@ import { NextRequest, NextResponse } from "next/server";
 import { z } from "zod";
 import { db, recipes, ratings, eq, and } from "@epicure/db";
 import { requireSession } from "@/lib/api-auth";
+import { createNotification } from "@/lib/notifications";
 
 const Schema = z.object({
   score: z.number().int().min(1).max(5),
@@ -45,5 +46,6 @@ export async function POST(req: NextRequest, { params }: Params) {
     score: parsed.data.score,
     reviewText: parsed.data.reviewText,
   });
+  void createNotification({ userId: recipe.authorId, type: "rating", actorId: session!.user.id, recipeId: id });
   return NextResponse.json({ created: true }, { status: 201 });
 }

apps/web/app/api/v1/users/[username]/follow/route.ts

@@ -1,12 +1,18 @@
 import { NextRequest, NextResponse } from "next/server";
 import { db, users, userFollows, eq, and } from "@epicure/db";
 import { requireSession } from "@/lib/api-auth";
+import { applyRateLimit } from "@/lib/rate-limit";
+import { createNotification } from "@/lib/notifications";
 
 type Params = { params: Promise<{ username: string }> };
 
 export async function POST(_req: NextRequest, { params }: Params) {
   const { session, response } = await requireSession();
   if (response) return response;
+
+  const limited = await applyRateLimit(`rl:follow:${session!.user.id}`, 30, 60);
+  if (limited) return limited;
+
   const { username } = await params;
 
   const target = await db.query.users.findFirst({ where: eq(users.username, username) });
@@ -17,6 +23,8 @@ export async function POST(_req: NextRequest, { params }: Params) {
     .values({ followerId: session!.user.id, followingId: target.id })
     .onConflictDoNothing();
 
+  void createNotification({ userId: target.id, type: "follow", actorId: session!.user.id });
+
   return NextResponse.json({ following: true });
 }