arnaudne/Epicure
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

security: widen API-key auth to content/AI routes (v0.27.0)

Browse Source 
Convert requireSession -> requireSessionOrApiKey across recipes,
collections, meal-plans, shopping-lists, pantry, feed, and ai/*
(52 routes) so API keys work end-to-end, not just for the handful of
endpoints that supported them before. Scope was explicitly confirmed
per-resource-family with the user before any file was touched.

Left session-cookie-only, deliberately: users/me*, ai-keys/*,
webhooks/*, conversations/*, notifications/*, push/subscribe, admin/*
— account/credential-adjacent surface that shouldn't widen without a
separate, explicit decision.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Arnaud
2026-07-14 11:20:26 +02:00
parent 6c4fc93aab
commit 3e71bd29a2
56 changed files with 171 additions and 159 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+5
View File
@@ -2,6 +2,11 @@
All notable changes to Epicure are documented here. This file is mirrored in-app at `/changelog` (and in the admin dashboard) via `apps/web/lib/changelog.ts` — update both together.
## 0.27.0 — 2026-07-14 11:15
### Added
- **API keys now work on recipes, collections, meal plans, shopping lists, pantry, feed, and AI generation** — previously most of the API only accepted a session cookie, so keys couldn't actually be used for most endpoints. Account/credential-adjacent routes (profile, AI provider keys, webhooks, notifications, messages, admin) intentionally stay session-only.
## 0.26.0 — 2026-07-14 10:20
### Added
apps/web/app/api/v1/ai/adapt/[id]/route.ts
+2 -2
View File
@@ -2,7 +2,7 @@ import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { and, eq } from "@epicure/db";
import { db, recipes, recipeIngredients, recipeSteps } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { withAiQuota, resolveAiConfigOrError } from "@/lib/ai/ai-error";
import { adaptRecipe } from "@/lib/ai/features/adapt-recipe";
import { withUserKey } from "@/lib/ai/resolve-user-key";
@@ -18,7 +18,7 @@ const Schema = z.object({
type Params = { params: Promise<{ id: string }> };
export async function POST(req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
apps/web/app/api/v1/ai/batch-cook/generate/route.ts
+2 -2
View File
@@ -1,7 +1,7 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { db, recipes, recipeIngredients, recipeSteps, recipeBatchDishes } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { applyRateLimit } from "@/lib/rate-limit";
import { getDefaultProviderWithKey } from "@/lib/ai/resolve-user-key";
import { withAiQuota, resolveAiConfigOrError } from "@/lib/ai/ai-error";
@@ -19,7 +19,7 @@ const Schema = z.object({
});
export async function POST(req: NextRequest) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const body = await req.json() as unknown;
apps/web/app/api/v1/ai/chat-history/route.ts
+3 -3
View File
@@ -1,7 +1,7 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { db, chatMessages, eq, and, isNull, desc, asc, ilike } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
const Schema = z.object({
recipeId: z.string().uuid().optional(),
@@ -13,7 +13,7 @@ const Schema = z.object({
});
export async function GET(req: NextRequest) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { searchParams } = new URL(req.url);
@@ -60,7 +60,7 @@ const DeleteSchema = z.object({
// No `q` here on purpose — clearing is "this whole conversation" (or
// everything), not "every message matching a search term".
export async function DELETE(req: NextRequest) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { searchParams } = new URL(req.url);
apps/web/app/api/v1/ai/cooking-chat/route.ts
+2 -2
View File
@@ -2,7 +2,7 @@ import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { generateText } from "ai";
import { db, chatMessages } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { applyRateLimit } from "@/lib/rate-limit";
import { withAiQuota, resolveAiConfigOrError } from "@/lib/ai/ai-error";
import { getModelConfigForUseCase } from "@/lib/ai/resolve-user-key";
@@ -16,7 +16,7 @@ const Schema = z.object({
const LANG: Record<string, string> = { en: "English", fr: "French" };
export async function POST(req: NextRequest) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const body = await req.json() as unknown;
apps/web/app/api/v1/ai/drinks/[id]/route.ts
+2 -2
View File
@@ -2,7 +2,7 @@ import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { and, eq } from "@epicure/db";
import { db, recipes } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { withAiQuota, resolveAiConfigOrError } from "@/lib/ai/ai-error";
import { suggestDrinks } from "@/lib/ai/features/suggest-drinks";
import { withUserKey } from "@/lib/ai/resolve-user-key";
@@ -17,7 +17,7 @@ const Schema = z.object({
type Params = { params: Promise<{ id: string }> };
export async function POST(req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
apps/web/app/api/v1/ai/generate-from-idea/route.ts
+2 -2
View File
@@ -1,6 +1,6 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { applyRateLimit } from "@/lib/rate-limit";
import { withAiQuota } from "@/lib/ai/ai-error";
import { generateRecipe } from "@/lib/ai/features/generate-recipe";
@@ -17,7 +17,7 @@ const Schema = z.object({
const LANG: Record<string, string> = { en: "English", fr: "French" };
export async function POST(req: NextRequest) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const body = await req.json() as unknown;
apps/web/app/api/v1/ai/generate/route.ts
+2 -2
View File
@@ -1,6 +1,6 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { applyRateLimit } from "@/lib/rate-limit";
import { withAiQuota } from "@/lib/ai/ai-error";
import { generateRecipe } from "@/lib/ai/features/generate-recipe";
@@ -15,7 +15,7 @@ const Schema = z.object({
});
export async function POST(req: NextRequest) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const body = await req.json() as unknown;
apps/web/app/api/v1/ai/import-photo/route.ts
+2 -2
View File
@@ -1,7 +1,7 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { db, recipes, recipeIngredients, recipeSteps } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { applyRateLimit } from "@/lib/rate-limit";
import { withAiQuota, resolveAiConfigOrError } from "@/lib/ai/ai-error";
import { importFromPhoto } from "@/lib/ai/features/import-photo";
@@ -13,7 +13,7 @@ const Schema = z.object({
});
export async function POST(req: NextRequest) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const body = await req.json() as unknown;
apps/web/app/api/v1/ai/import-url/route.ts
+2 -2
View File
@@ -1,6 +1,6 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { applyRateLimit } from "@/lib/rate-limit";
import { withAiQuota } from "@/lib/ai/ai-error";
import { importFromUrl } from "@/lib/ai/features/import-url";
@@ -13,7 +13,7 @@ const Schema = z.object({
});
export async function POST(req: NextRequest) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const body = await req.json() as unknown;
apps/web/app/api/v1/ai/meal-plan/generate/route.ts
+2 -2
View File
@@ -1,7 +1,7 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { db, recipes, recipeIngredients, recipeSteps, mealPlans, mealPlanEntries, pantryItems, userNutritionGoals, eq, and } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { applyRateLimit } from "@/lib/rate-limit";
import { getDefaultProviderWithKey } from "@/lib/ai/resolve-user-key";
import { withAiQuota, resolveAiConfigOrError } from "@/lib/ai/ai-error";
@@ -23,7 +23,7 @@ const Schema = z.object({
});
export async function POST(req: NextRequest) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const body = await req.json() as unknown;
apps/web/app/api/v1/ai/pairings/[id]/route.ts
+2 -2
View File
@@ -2,7 +2,7 @@ import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { and, eq } from "@epicure/db";
import { db, recipes } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { withAiQuota, resolveAiConfigOrError } from "@/lib/ai/ai-error";
import { suggestPairings } from "@/lib/ai/features/suggest-pairings";
import { withUserKey } from "@/lib/ai/resolve-user-key";
@@ -17,7 +17,7 @@ const Schema = z.object({
type Params = { params: Promise<{ id: string }> };
export async function POST(req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
apps/web/app/api/v1/ai/recipe-chat/route.ts
+2 -2
View File
@@ -1,7 +1,7 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { generateText } from "ai";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { applyRateLimit } from "@/lib/rate-limit";
import { withAiQuota, resolveAiConfigOrError } from "@/lib/ai/ai-error";
import { getModelConfigForUseCase } from "@/lib/ai/resolve-user-key";
@@ -18,7 +18,7 @@ const Schema = z.object({
const LANG: Record<string, string> = { en: "English", fr: "French" };
export async function POST(req: NextRequest) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const body = await req.json() as unknown;
apps/web/app/api/v1/ai/recipe-ideas/route.ts
+2 -2
View File
@@ -1,7 +1,7 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { generateObject } from "ai";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { applyRateLimit } from "@/lib/rate-limit";
import { withAiQuota, resolveAiConfigOrError } from "@/lib/ai/ai-error";
import { getModelConfigForUseCase } from "@/lib/ai/resolve-user-key";
@@ -25,7 +25,7 @@ const IdeasSchema = z.object({
});
export async function POST(req: NextRequest) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const body = await req.json() as unknown;
apps/web/app/api/v1/ai/scale/route.ts
+2 -2
View File
@@ -1,7 +1,7 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { db, recipes, eq, and, or } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { applyRateLimit } from "@/lib/rate-limit";
import { getDefaultProviderWithKey } from "@/lib/ai/resolve-user-key";
import { withAiQuota, resolveAiConfigOrError } from "@/lib/ai/ai-error";
@@ -13,7 +13,7 @@ const Schema = z.object({
});
export async function POST(req: NextRequest) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const limited = await applyRateLimit(`rl:ai:scale:${session!.user.id}`, 20, 60);
apps/web/app/api/v1/ai/substitute/route.ts
+2 -2
View File
@@ -1,6 +1,6 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { withAiQuota, resolveAiConfigOrError } from "@/lib/ai/ai-error";
import { applyRateLimit } from "@/lib/rate-limit";
import { getDefaultProviderWithKey } from "@/lib/ai/resolve-user-key";
@@ -14,7 +14,7 @@ const Schema = z.object({
});
export async function POST(req: NextRequest) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const body = await req.json() as unknown;
apps/web/app/api/v1/ai/translate/[id]/route.ts
+2 -2
View File
@@ -2,7 +2,7 @@ import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { and, eq } from "@epicure/db";
import { db, recipes, recipeIngredients, recipeSteps } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { withAiQuota } from "@/lib/ai/ai-error";
import { translateRecipe } from "@/lib/ai/features/translate-recipe";
@@ -15,7 +15,7 @@ const Schema = z.object({
type Params = { params: Promise<{ id: string }> };
export async function POST(req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
apps/web/app/api/v1/ai/variations/[id]/route.ts
+2 -2
View File
@@ -2,7 +2,7 @@ import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { and, eq } from "@epicure/db";
import { db, recipes } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { withAiQuota, resolveAiConfigOrError } from "@/lib/ai/ai-error";
import { suggestVariations } from "@/lib/ai/features/suggest-variations";
import { withUserKey } from "@/lib/ai/resolve-user-key";
@@ -18,7 +18,7 @@ const Schema = z.object({
type Params = { params: Promise<{ id: string }> };
export async function POST(req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
apps/web/app/api/v1/collections/[id]/favorite/route.ts
+5 -5
View File
@@ -1,11 +1,11 @@
import { NextRequest, NextResponse } from "next/server";
import { db, collections, collectionFavorites, eq, and, or } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
type Params = { params: Promise<{ id: string }> };
export async function POST(_req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
export async function POST(req: NextRequest, { params }: Params) {
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
@@ -21,8 +21,8 @@ export async function POST(_req: NextRequest, { params }: Params) {
return NextResponse.json({ favorited: true });
}
export async function DELETE(_req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
export async function DELETE(req: NextRequest, { params }: Params) {
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
apps/web/app/api/v1/collections/[id]/fork/route.ts
+3 -3
View File
@@ -1,11 +1,11 @@
import { NextRequest, NextResponse } from "next/server";
import { db, collections, collectionRecipes, eq, and, or } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
type Params = { params: Promise<{ id: string }> };
export async function POST(_req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
export async function POST(req: NextRequest, { params }: Params) {
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
apps/web/app/api/v1/collections/[id]/members/route.ts
+5 -5
View File
@@ -1,14 +1,14 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { db, collections, collectionMembers, users, eq, and } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
type Params = { params: Promise<{ id: string }> };
// ─── GET /api/v1/collections/[id]/members ────────────────────────────────────
// Owner only — returns members joined with basic user info.
export async function GET(_req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
export async function GET(req: NextRequest, { params }: Params) {
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
@@ -52,7 +52,7 @@ const InviteSchema = z
});
export async function POST(req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
@@ -103,7 +103,7 @@ export async function POST(req: NextRequest, { params }: Params) {
// ─── DELETE /api/v1/collections/[id]/members?memberId=… ──────────────────────
// Owner OR the member themselves can remove.
export async function DELETE(req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
apps/web/app/api/v1/collections/[id]/route.ts
+6 -6
View File
@@ -1,12 +1,12 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { db, collections, collectionRecipes, recipes, eq, and, or, ne, inArray } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
type Params = { params: Promise<{ id: string }> };
export async function GET(_req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
export async function GET(req: NextRequest, { params }: Params) {
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
@@ -20,7 +20,7 @@ export async function GET(_req: NextRequest, { params }: Params) {
}
export async function PUT(req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
@@ -77,8 +77,8 @@ export async function PUT(req: NextRequest, { params }: Params) {
return NextResponse.json({ updated: true });
}
export async function DELETE(_req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
export async function DELETE(req: NextRequest, { params }: Params) {
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
apps/web/app/api/v1/collections/route.ts
+3 -3
View File
@@ -1,7 +1,7 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { db, collections, eq, desc, sql } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
const Schema = z.object({
name: z.string().min(1).max(100),
@@ -10,7 +10,7 @@ const Schema = z.object({
});
export async function GET(req: NextRequest) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { searchParams } = req.nextUrl;
@@ -48,7 +48,7 @@ export async function GET(req: NextRequest) {
}
export async function POST(req: NextRequest) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const body = await req.json() as unknown;
apps/web/app/api/v1/feed/for-you/route.ts
+2 -2
View File
@@ -1,10 +1,10 @@
import { NextRequest, NextResponse } from "next/server";
import { db, recipes, users, favorites, ratings, userFollows, eq, and, or, ne, gte, notInArray, inArray, desc, isNotNull } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { buildPreferenceMap, rankForYou } from "@/lib/for-you-ranking";
export async function GET(req: NextRequest) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const userId = session!.user.id;
apps/web/app/api/v1/feed/route.ts
+2 -2
View File
@@ -1,10 +1,10 @@
import { NextRequest, NextResponse } from "next/server";
import { db, recipes, users, userFollows, eq, and, ne, sql } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { desc, inArray } from "@epicure/db";
export async function GET(req: NextRequest) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { searchParams } = new URL(req.url);
apps/web/app/api/v1/meal-plans/[weekStart]/entries/[entryId]/route.ts
+3 -3
View File
@@ -1,11 +1,11 @@
import { NextRequest, NextResponse } from "next/server";
import { db, mealPlans, mealPlanEntries, eq, and } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
type Params = { params: Promise<{ weekStart: string; entryId: string }> };
export async function DELETE(_req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
export async function DELETE(req: NextRequest, { params }: Params) {
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { weekStart, entryId } = await params;
apps/web/app/api/v1/meal-plans/[weekStart]/entries/bulk/route.ts
+2 -2
View File
@@ -1,7 +1,7 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { db, mealPlans, mealPlanEntries, eq, and, inArray } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
type Params = { params: Promise<{ weekStart: string }> };
@@ -13,7 +13,7 @@ const BulkDeleteSchema = z.object({
// so this is only ever called with either one day's entry ids or the whole
// week's, scoped to the caller's own plan.
export async function DELETE(req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { weekStart } = await params;
apps/web/app/api/v1/meal-plans/[weekStart]/entries/route.ts
+4 -4
View File
@@ -1,7 +1,7 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { db, mealPlans, mealPlanEntries, recipes, recipeBatchDishes, eq, and, or, ne } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { dispatchWebhook } from "@/lib/webhooks";
type Params = { params: Promise<{ weekStart: string }> };
@@ -30,8 +30,8 @@ async function getOrCreatePlan(userId: string, weekStart: string) {
// added/removed by a collaborator via the shared view show up here too — a
// lean shape (no photos join) unlike the full plan GET at
// meal-plans/[weekStart]/route.ts, since this runs every few seconds.
export async function GET(_req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
export async function GET(req: NextRequest, { params }: Params) {
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { weekStart } = await params;
@@ -62,7 +62,7 @@ export async function GET(_req: NextRequest, { params }: Params) {
}
export async function POST(req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { weekStart } = await params;
apps/web/app/api/v1/meal-plans/[weekStart]/export/ics/route.ts
+3 -3
View File
@@ -1,6 +1,6 @@
import { NextRequest, NextResponse } from "next/server";
import { db, mealPlans, eq, and } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { buildIcs, type IcsEvent } from "@/lib/ics";
type Params = { params: Promise<{ weekStart: string }> };
@@ -16,8 +16,8 @@ const MEAL_TIME: Record<string, { hour: number; minute: number; durationMinutes:
snack: { hour: 15, minute: 30, durationMinutes: 15 },
};
export async function GET(_req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
export async function GET(req: NextRequest, { params }: Params) {
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { weekStart } = await params;
apps/web/app/api/v1/meal-plans/[weekStart]/members/route.ts
+5 -5
View File
@@ -1,7 +1,7 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { db, mealPlans, mealPlanMembers, users, eq, and } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
type Params = { params: Promise<{ weekStart: string }> };
@@ -18,8 +18,8 @@ async function getOrCreatePlan(userId: string, weekStart: string) {
// ─── GET /api/v1/meal-plans/[weekStart]/members ──────────────────────────────
// Owner only — returns members joined with basic user info.
export async function GET(_req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
export async function GET(req: NextRequest, { params }: Params) {
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { weekStart } = await params;
@@ -57,7 +57,7 @@ const InviteSchema = z
});
export async function POST(req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { weekStart } = await params;
@@ -97,7 +97,7 @@ export async function POST(req: NextRequest, { params }: Params) {
// ─── DELETE /api/v1/meal-plans/[weekStart]/members?memberId=… ────────────────
// Owner OR the member themselves can remove.
export async function DELETE(req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { weekStart } = await params;
const memberId = req.nextUrl.searchParams.get("memberId");
apps/web/app/api/v1/meal-plans/[weekStart]/nutrition/route.ts
+3 -3
View File
@@ -1,6 +1,6 @@
import { NextRequest, NextResponse } from "next/server";
import { db, mealPlans, mealPlanEntries, userNutritionGoals, eq, and } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
type Params = { params: Promise<{ weekStart: string }> };
@@ -12,8 +12,8 @@ function emptyTotals(): Totals {
return { calories: 0, protein: 0, carbs: 0, fat: 0 };
}
export async function GET(_req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
export async function GET(req: NextRequest, { params }: Params) {
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { weekStart } = await params;
apps/web/app/api/v1/meal-plans/[weekStart]/route.ts
+5 -5
View File
@@ -1,11 +1,11 @@
import { NextRequest, NextResponse } from "next/server";
import { db, mealPlans, eq, and } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
type Params = { params: Promise<{ weekStart: string }> };
export async function GET(_req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
export async function GET(req: NextRequest, { params }: Params) {
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { weekStart } = await params;
@@ -26,8 +26,8 @@ export async function GET(_req: NextRequest, { params }: Params) {
return NextResponse.json(plan);
}
export async function POST(_req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
export async function POST(req: NextRequest, { params }: Params) {
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { weekStart } = await params;
apps/web/app/api/v1/meal-plans/shared/[mealPlanId]/entries/route.ts
+5 -5
View File
@@ -1,7 +1,7 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { db, mealPlanEntries, recipes, eq, and, or, ne, inArray } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { getMealPlanAccessById, canWriteMealPlan } from "@/lib/meal-plan-access";
import { dispatchWebhook } from "@/lib/webhooks";
@@ -10,8 +10,8 @@ type Params = { params: Promise<{ mealPlanId: string }> };
// Polled by SharedMealPlanView so every collaborator sees each other's
// changes, and the plan owner's own tab (a different component/URL, per
// meal-plans/[weekStart]/entries) picks up edits made from here too.
export async function GET(_req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
export async function GET(req: NextRequest, { params }: Params) {
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { mealPlanId } = await params;
@@ -43,7 +43,7 @@ const Schema = z.object({
});
export async function POST(req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { mealPlanId } = await params;
@@ -89,7 +89,7 @@ export async function POST(req: NextRequest, { params }: Params) {
}
export async function DELETE(req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { mealPlanId } = await params;
apps/web/app/api/v1/meal-plans/shared/[mealPlanId]/route.ts
+3 -3
View File
@@ -1,12 +1,12 @@
import { NextRequest, NextResponse } from "next/server";
import { db, mealPlans, users, eq } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { getMealPlanAccessById } from "@/lib/meal-plan-access";
type Params = { params: Promise<{ mealPlanId: string }> };
export async function GET(_req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
export async function GET(req: NextRequest, { params }: Params) {
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { mealPlanId } = await params;
apps/web/app/api/v1/pantry/[id]/route.ts
+4 -4
View File
@@ -1,12 +1,12 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { db, pantryItems, eq, and } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
type Params = { params: Promise<{ id: string }> };
export async function PUT(req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
@@ -33,8 +33,8 @@ export async function PUT(req: NextRequest, { params }: Params) {
return NextResponse.json({ updated: true });
}
export async function DELETE(_req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
export async function DELETE(req: NextRequest, { params }: Params) {
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
apps/web/app/api/v1/pantry/bulk/route.ts
+2 -2
View File
@@ -1,7 +1,7 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { db, pantryItems, eq } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
const Schema = z.object({
items: z.array(z.object({
@@ -12,7 +12,7 @@ const Schema = z.object({
});
export async function POST(req: NextRequest) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const body = await req.json() as unknown;
apps/web/app/api/v1/pantry/route.ts
+3 -3
View File
@@ -1,7 +1,7 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { db, pantryItems, eq, desc, sql } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
const Schema = z.object({
rawName: z.string().min(1).max(200),
@@ -11,7 +11,7 @@ const Schema = z.object({
});
export async function GET(req: NextRequest) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { searchParams } = req.nextUrl;
@@ -39,7 +39,7 @@ export async function GET(req: NextRequest) {
}
export async function POST(req: NextRequest) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const body = await req.json() as unknown;
apps/web/app/api/v1/pantry/scan/barcode/route.ts
+2 -2
View File
@@ -1,6 +1,6 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { applyRateLimit } from "@/lib/rate-limit";
const Schema = z.object({
@@ -30,7 +30,7 @@ function extractUnit(quantity: string | undefined): string | undefined {
}
export async function POST(req: NextRequest) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const body = await req.json() as unknown;
apps/web/app/api/v1/pantry/scan/photo/route.ts
+2 -2
View File
@@ -1,6 +1,6 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { applyRateLimit } from "@/lib/rate-limit";
import { withAiQuota, resolveAiConfigOrError } from "@/lib/ai/ai-error";
import { getModelConfigForUseCase } from "@/lib/ai/resolve-user-key";
@@ -12,7 +12,7 @@ const Schema = z.object({
});
export async function POST(req: NextRequest) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const body = await req.json() as unknown;
apps/web/app/api/v1/recipes/[id]/comments/[commentId]/reactions/route.ts
+3 -3
View File
@@ -1,7 +1,7 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { db, comments, commentReactions, eq, and, count } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { applyRateLimit } from "@/lib/rate-limit";
import { createNotification } from "@/lib/notifications";
@@ -34,7 +34,7 @@ export async function GET(req: NextRequest, { params }: Params) {
// Optional auth — GET reactions is public; session present means also return user's own reactions
// response intentionally ignored: unauthenticated callers get counts only with empty userReactions
const { session } = await requireSession();
const { session } = await requireSessionOrApiKey(req);
let userReactions: string[] = [];
if (session) {
@@ -49,7 +49,7 @@ export async function GET(req: NextRequest, { params }: Params) {
}
export async function POST(req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const limited = await applyRateLimit(`rl:reaction:${session!.user.id}`, 60, 60);
apps/web/app/api/v1/recipes/[id]/comments/route.ts
+3 -3
View File
@@ -1,7 +1,7 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { db, recipes, comments, users, userBlocks, eq, and, inArray, isNull, sql } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { applyRateLimit } from "@/lib/rate-limit";
import { dispatchWebhook } from "@/lib/webhooks";
import { createNotification } from "@/lib/notifications";
@@ -34,7 +34,7 @@ export async function GET(req: NextRequest, { params }: Params) {
return NextResponse.json({ error: "Not found" }, { status: 404 });
}
const { session } = await requireSession();
const { session } = await requireSessionOrApiKey(req);
const { searchParams } = req.nextUrl;
const limitRaw = parseInt(searchParams.get("limit") ?? "20");
@@ -88,7 +88,7 @@ export async function GET(req: NextRequest, { params }: Params) {
}
export async function POST(req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
apps/web/app/api/v1/recipes/[id]/cooked/route.ts
+2 -2
View File
@@ -1,7 +1,7 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { db, recipes, cookingHistory, pantryItems, recipeIngredients, recipeBatchDishes, eq, and } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
type Params = { params: Promise<{ id: string }> };
@@ -13,7 +13,7 @@ const Schema = z.object({
});
export async function POST(req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
const userId = session!.user.id;
apps/web/app/api/v1/recipes/[id]/favorite/route.ts
+5 -5
View File
@@ -1,11 +1,11 @@
import { NextRequest, NextResponse } from "next/server";
import { db, recipes, favorites, eq, and } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
type Params = { params: Promise<{ id: string }> };
export async function POST(_req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
export async function POST(req: NextRequest, { params }: Params) {
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
@@ -18,8 +18,8 @@ export async function POST(_req: NextRequest, { params }: Params) {
return NextResponse.json({ favorited: true });
}
export async function DELETE(_req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
export async function DELETE(req: NextRequest, { params }: Params) {
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
apps/web/app/api/v1/recipes/[id]/nutrition/route.ts
+5 -5
View File
@@ -1,15 +1,15 @@
import { NextRequest, NextResponse } from "next/server";
import { db, recipes, recipeIngredients } from "@epicure/db";
import { eq, and, or, ne } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { applyRateLimit } from "@/lib/rate-limit";
import { withAiQuota } from "@/lib/ai/ai-error";
import { estimateNutrition } from "@/lib/ai/features/estimate-nutrition";
type Params = { params: Promise<{ id: string }> };
export async function GET(_req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
export async function GET(req: NextRequest, { params }: Params) {
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
@@ -28,8 +28,8 @@ export async function GET(_req: NextRequest, { params }: Params) {
return NextResponse.json({ nutrition: recipe.nutritionData ?? null });
}
export async function POST(_req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
export async function POST(req: NextRequest, { params }: Params) {
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
apps/web/app/api/v1/recipes/[id]/rate/route.ts
+2 -2
View File
@@ -1,7 +1,7 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { db, recipes, ratings, eq, and } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { createNotification } from "@/lib/notifications";
import { isOwnedReviewPhotoKey } from "@/lib/storage";
@@ -14,7 +14,7 @@ const Schema = z.object({
type Params = { params: Promise<{ id: string }> };
export async function POST(req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
apps/web/app/api/v1/recipes/[id]/reviews/route.ts
+3 -3
View File
@@ -1,11 +1,11 @@
import { NextRequest, NextResponse } from "next/server";
import { db, recipes, ratings, eq, and, or, inArray, desc } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
type Params = { params: Promise<{ id: string }> };
export async function GET(_req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
export async function GET(req: NextRequest, { params }: Params) {
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
apps/web/app/api/v1/recipes/bulk/export/route.ts
+2 -2
View File
@@ -1,6 +1,6 @@
import { type NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { db, recipes, eq, and, inArray } from "@epicure/db";
import { recipeToMarkdown } from "@/lib/markdown/recipe";
@@ -9,7 +9,7 @@ const ExportSchema = z.object({
});
export async function POST(req: NextRequest) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const body = ExportSchema.safeParse(await req.json());
apps/web/app/api/v1/recipes/bulk/route.ts
+3 -3
View File
@@ -1,6 +1,6 @@
import { type NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { db, recipes, eq, and, inArray } from "@epicure/db";
const BulkDeleteSchema = z.object({
@@ -15,7 +15,7 @@ const BulkUpdateSchema = z.object({
});
export async function DELETE(req: NextRequest) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const body = BulkDeleteSchema.safeParse(await req.json());
@@ -29,7 +29,7 @@ export async function DELETE(req: NextRequest) {
}
export async function PATCH(req: NextRequest) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const body = BulkUpdateSchema.safeParse(await req.json());
apps/web/app/api/v1/shopping-lists/[id]/export/instacart/route.ts
+3 -3
View File
@@ -1,14 +1,14 @@
import { NextRequest, NextResponse } from "next/server";
import { db, shoppingLists, eq } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { getShoppingListAccess } from "@/lib/shopping-list-access";
import { buildGroceryExportPayload } from "@/lib/grocery-export";
import { createInstacartShoppingListLink } from "@/lib/grocery-providers/instacart";
type Params = { params: Promise<{ id: string }> };
export async function POST(_req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
export async function POST(req: NextRequest, { params }: Params) {
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
apps/web/app/api/v1/shopping-lists/[id]/export/route.ts
+3 -3
View File
@@ -1,13 +1,13 @@
import { NextRequest, NextResponse } from "next/server";
import { db, shoppingLists, eq } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { getShoppingListAccess } from "@/lib/shopping-list-access";
import { buildGroceryExportPayload } from "@/lib/grocery-export";
type Params = { params: Promise<{ id: string }> };
export async function GET(_req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
export async function GET(req: NextRequest, { params }: Params) {
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
apps/web/app/api/v1/shopping-lists/[id]/members/route.ts
+5 -5
View File
@@ -1,14 +1,14 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { db, shoppingLists, shoppingListMembers, users, eq, and } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
type Params = { params: Promise<{ id: string }> };
// ─── GET /api/v1/shopping-lists/[id]/members ─────────────────────────────────
// Owner only — returns members joined with basic user info.
export async function GET(_req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
export async function GET(req: NextRequest, { params }: Params) {
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
@@ -51,7 +51,7 @@ const InviteSchema = z
});
export async function POST(req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
@@ -98,7 +98,7 @@ export async function POST(req: NextRequest, { params }: Params) {
// ─── DELETE /api/v1/shopping-lists/[id]/members?memberId=… ───────────────────
// Owner OR the member themselves can remove.
export async function DELETE(req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
apps/web/app/api/v1/shopping-lists/[id]/route.ts
+6 -6
View File
@@ -1,14 +1,14 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { db, shoppingLists, shoppingListItems, eq } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { dispatchWebhook } from "@/lib/webhooks";
import { getShoppingListAccess, canWriteShoppingList } from "@/lib/shopping-list-access";
type Params = { params: Promise<{ id: string }> };
export async function GET(_req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
export async function GET(req: NextRequest, { params }: Params) {
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
@@ -31,7 +31,7 @@ const PatchSchema = z.object({
});
export async function PATCH(req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
@@ -72,8 +72,8 @@ export async function PATCH(req: NextRequest, { params }: Params) {
return NextResponse.json({ updated: true });
}
export async function DELETE(_req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
export async function DELETE(req: NextRequest, { params }: Params) {
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
apps/web/app/api/v1/shopping-lists/route.ts
+4 -4
View File
@@ -1,7 +1,7 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { db, shoppingLists, shoppingListItems, mealPlans, mealPlanEntries, recipeIngredients, pantryItems, eq, and, desc, inArray } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { applyPantryToItems, mergeIngredients } from "@/lib/pantry-shopping-match";
import { guessAisle } from "@/lib/grocery-categories";
@@ -16,8 +16,8 @@ const CreateSchema = z.object({
fromMealPlanWeek: z.string().optional(),
});
export async function GET(_req: NextRequest) {
const { session, response } = await requireSession();
export async function GET(req: NextRequest) {
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const lists = await db.query.shoppingLists.findMany({
@@ -30,7 +30,7 @@ export async function GET(_req: NextRequest) {
}
export async function POST(req: NextRequest) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const body = await req.json() as unknown;
apps/web/lib/changelog.ts
+8 -1
View File
@@ -1,5 +1,5 @@
// Mirrors CHANGELOG.md at the repo root — update both together.
export const APP_VERSION = "0.26.0";
export const APP_VERSION = "0.27.0";
export type ChangelogEntry = {
version: string;
@@ -11,6 +11,13 @@ export type ChangelogEntry = {
};
export const CHANGELOG: ChangelogEntry[] = [
{
version: "0.27.0",
date: "2026-07-14 11:15",
added: [
"**API keys now work on recipes, collections, meal plans, shopping lists, pantry, feed, and AI generation** — previously most of the API only accepted a session cookie, so keys couldn't actually be used for most endpoints. Account/credential-adjacent routes (profile, AI provider keys, webhooks, notifications, messages, admin) intentionally stay session-only.",
],
},
{
version: "0.26.0",
date: "2026-07-14 10:20",
apps/web/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@epicure/web",
"version": "0.26.0",
"version": "0.27.0",
"private": true,
"scripts": {
"dev": "next dev",
package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "epicure",
"version": "0.26.0",
"version": "0.27.0",
"private": true,
"scripts": {
"dev": "pnpm --filter web dev",