From 3e71bd29a26aa41ff070e6ae0092a8ed3acdfb5d Mon Sep 17 00:00:00 2001 From: Arnaud Date: Tue, 14 Jul 2026 11:20:26 +0200 Subject: [PATCH] security: widen API-key auth to content/AI routes (v0.27.0) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Convert requireSession -> requireSessionOrApiKey across recipes, collections, meal-plans, shopping-lists, pantry, feed, and ai/* (52 routes) so API keys work end-to-end, not just for the handful of endpoints that supported them before. Scope was explicitly confirmed per-resource-family with the user before any file was touched. Left session-cookie-only, deliberately: users/me*, ai-keys/*, webhooks/*, conversations/*, notifications/*, push/subscribe, admin/* — account/credential-adjacent surface that shouldn't widen without a separate, explicit decision. Co-Authored-By: Claude Sonnet 5 --- CHANGELOG.md | 5 +++++ apps/web/app/api/v1/ai/adapt/[id]/route.ts | 4 ++-- apps/web/app/api/v1/ai/batch-cook/generate/route.ts | 4 ++-- apps/web/app/api/v1/ai/chat-history/route.ts | 6 +++--- apps/web/app/api/v1/ai/cooking-chat/route.ts | 4 ++-- apps/web/app/api/v1/ai/drinks/[id]/route.ts | 4 ++-- apps/web/app/api/v1/ai/generate-from-idea/route.ts | 4 ++-- apps/web/app/api/v1/ai/generate/route.ts | 4 ++-- apps/web/app/api/v1/ai/import-photo/route.ts | 4 ++-- apps/web/app/api/v1/ai/import-url/route.ts | 4 ++-- apps/web/app/api/v1/ai/meal-plan/generate/route.ts | 4 ++-- apps/web/app/api/v1/ai/pairings/[id]/route.ts | 4 ++-- apps/web/app/api/v1/ai/recipe-chat/route.ts | 4 ++-- apps/web/app/api/v1/ai/recipe-ideas/route.ts | 4 ++-- apps/web/app/api/v1/ai/scale/route.ts | 4 ++-- apps/web/app/api/v1/ai/substitute/route.ts | 4 ++-- apps/web/app/api/v1/ai/translate/[id]/route.ts | 4 ++-- apps/web/app/api/v1/ai/variations/[id]/route.ts | 4 ++-- .../app/api/v1/collections/[id]/favorite/route.ts | 10 +++++----- apps/web/app/api/v1/collections/[id]/fork/route.ts | 6 +++--- .../web/app/api/v1/collections/[id]/members/route.ts | 10 +++++----- apps/web/app/api/v1/collections/[id]/route.ts | 12 ++++++------ apps/web/app/api/v1/collections/route.ts | 6 +++--- apps/web/app/api/v1/feed/for-you/route.ts | 4 ++-- apps/web/app/api/v1/feed/route.ts | 4 ++-- .../[weekStart]/entries/[entryId]/route.ts | 6 +++--- .../v1/meal-plans/[weekStart]/entries/bulk/route.ts | 4 ++-- .../api/v1/meal-plans/[weekStart]/entries/route.ts | 8 ++++---- .../v1/meal-plans/[weekStart]/export/ics/route.ts | 6 +++--- .../api/v1/meal-plans/[weekStart]/members/route.ts | 10 +++++----- .../api/v1/meal-plans/[weekStart]/nutrition/route.ts | 6 +++--- apps/web/app/api/v1/meal-plans/[weekStart]/route.ts | 10 +++++----- .../meal-plans/shared/[mealPlanId]/entries/route.ts | 10 +++++----- .../api/v1/meal-plans/shared/[mealPlanId]/route.ts | 6 +++--- apps/web/app/api/v1/pantry/[id]/route.ts | 8 ++++---- apps/web/app/api/v1/pantry/bulk/route.ts | 4 ++-- apps/web/app/api/v1/pantry/route.ts | 6 +++--- apps/web/app/api/v1/pantry/scan/barcode/route.ts | 4 ++-- apps/web/app/api/v1/pantry/scan/photo/route.ts | 4 ++-- .../[id]/comments/[commentId]/reactions/route.ts | 6 +++--- apps/web/app/api/v1/recipes/[id]/comments/route.ts | 6 +++--- apps/web/app/api/v1/recipes/[id]/cooked/route.ts | 4 ++-- apps/web/app/api/v1/recipes/[id]/favorite/route.ts | 10 +++++----- apps/web/app/api/v1/recipes/[id]/nutrition/route.ts | 10 +++++----- apps/web/app/api/v1/recipes/[id]/rate/route.ts | 4 ++-- apps/web/app/api/v1/recipes/[id]/reviews/route.ts | 6 +++--- apps/web/app/api/v1/recipes/bulk/export/route.ts | 4 ++-- apps/web/app/api/v1/recipes/bulk/route.ts | 6 +++--- .../v1/shopping-lists/[id]/export/instacart/route.ts | 6 +++--- .../app/api/v1/shopping-lists/[id]/export/route.ts | 6 +++--- .../app/api/v1/shopping-lists/[id]/members/route.ts | 10 +++++----- apps/web/app/api/v1/shopping-lists/[id]/route.ts | 12 ++++++------ apps/web/app/api/v1/shopping-lists/route.ts | 8 ++++---- apps/web/lib/changelog.ts | 9 ++++++++- apps/web/package.json | 2 +- package.json | 2 +- 56 files changed, 171 insertions(+), 159 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c294465..8db00f9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,11 @@ All notable changes to Epicure are documented here. This file is mirrored in-app at `/changelog` (and in the admin dashboard) via `apps/web/lib/changelog.ts` — update both together. +## 0.27.0 — 2026-07-14 11:15 + +### Added +- **API keys now work on recipes, collections, meal plans, shopping lists, pantry, feed, and AI generation** — previously most of the API only accepted a session cookie, so keys couldn't actually be used for most endpoints. Account/credential-adjacent routes (profile, AI provider keys, webhooks, notifications, messages, admin) intentionally stay session-only. + ## 0.26.0 — 2026-07-14 10:20 ### Added diff --git a/apps/web/app/api/v1/ai/adapt/[id]/route.ts b/apps/web/app/api/v1/ai/adapt/[id]/route.ts index 813de76..26c68c0 100644 --- a/apps/web/app/api/v1/ai/adapt/[id]/route.ts +++ b/apps/web/app/api/v1/ai/adapt/[id]/route.ts @@ -2,7 +2,7 @@ import { NextRequest, NextResponse } from "next/server"; import { z } from "zod"; import { and, eq } from "@epicure/db"; import { db, recipes, recipeIngredients, recipeSteps } from "@epicure/db"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; import { withAiQuota, resolveAiConfigOrError } from "@/lib/ai/ai-error"; import { adaptRecipe } from "@/lib/ai/features/adapt-recipe"; import { withUserKey } from "@/lib/ai/resolve-user-key"; @@ -18,7 +18,7 @@ const Schema = z.object({ type Params = { params: Promise<{ id: string }> }; export async function POST(req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { id } = await params; diff --git a/apps/web/app/api/v1/ai/batch-cook/generate/route.ts b/apps/web/app/api/v1/ai/batch-cook/generate/route.ts index 8794e2d..d2a725b 100644 --- a/apps/web/app/api/v1/ai/batch-cook/generate/route.ts +++ b/apps/web/app/api/v1/ai/batch-cook/generate/route.ts @@ -1,7 +1,7 @@ import { NextRequest, NextResponse } from "next/server"; import { z } from "zod"; import { db, recipes, recipeIngredients, recipeSteps, recipeBatchDishes } from "@epicure/db"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; import { applyRateLimit } from "@/lib/rate-limit"; import { getDefaultProviderWithKey } from "@/lib/ai/resolve-user-key"; import { withAiQuota, resolveAiConfigOrError } from "@/lib/ai/ai-error"; @@ -19,7 +19,7 @@ const Schema = z.object({ }); export async function POST(req: NextRequest) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const body = await req.json() as unknown; diff --git a/apps/web/app/api/v1/ai/chat-history/route.ts b/apps/web/app/api/v1/ai/chat-history/route.ts index 34984c5..eb827c3 100644 --- a/apps/web/app/api/v1/ai/chat-history/route.ts +++ b/apps/web/app/api/v1/ai/chat-history/route.ts @@ -1,7 +1,7 @@ import { NextRequest, NextResponse } from "next/server"; import { z } from "zod"; import { db, chatMessages, eq, and, isNull, desc, asc, ilike } from "@epicure/db"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; const Schema = z.object({ recipeId: z.string().uuid().optional(), @@ -13,7 +13,7 @@ const Schema = z.object({ }); export async function GET(req: NextRequest) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { searchParams } = new URL(req.url); @@ -60,7 +60,7 @@ const DeleteSchema = z.object({ // No `q` here on purpose — clearing is "this whole conversation" (or // everything), not "every message matching a search term". export async function DELETE(req: NextRequest) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { searchParams } = new URL(req.url); diff --git a/apps/web/app/api/v1/ai/cooking-chat/route.ts b/apps/web/app/api/v1/ai/cooking-chat/route.ts index 3947f58..b0fe7f8 100644 --- a/apps/web/app/api/v1/ai/cooking-chat/route.ts +++ b/apps/web/app/api/v1/ai/cooking-chat/route.ts @@ -2,7 +2,7 @@ import { NextRequest, NextResponse } from "next/server"; import { z } from "zod"; import { generateText } from "ai"; import { db, chatMessages } from "@epicure/db"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; import { applyRateLimit } from "@/lib/rate-limit"; import { withAiQuota, resolveAiConfigOrError } from "@/lib/ai/ai-error"; import { getModelConfigForUseCase } from "@/lib/ai/resolve-user-key"; @@ -16,7 +16,7 @@ const Schema = z.object({ const LANG: Record = { en: "English", fr: "French" }; export async function POST(req: NextRequest) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const body = await req.json() as unknown; diff --git a/apps/web/app/api/v1/ai/drinks/[id]/route.ts b/apps/web/app/api/v1/ai/drinks/[id]/route.ts index a6f8797..894a6ac 100644 --- a/apps/web/app/api/v1/ai/drinks/[id]/route.ts +++ b/apps/web/app/api/v1/ai/drinks/[id]/route.ts @@ -2,7 +2,7 @@ import { NextRequest, NextResponse } from "next/server"; import { z } from "zod"; import { and, eq } from "@epicure/db"; import { db, recipes } from "@epicure/db"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; import { withAiQuota, resolveAiConfigOrError } from "@/lib/ai/ai-error"; import { suggestDrinks } from "@/lib/ai/features/suggest-drinks"; import { withUserKey } from "@/lib/ai/resolve-user-key"; @@ -17,7 +17,7 @@ const Schema = z.object({ type Params = { params: Promise<{ id: string }> }; export async function POST(req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { id } = await params; diff --git a/apps/web/app/api/v1/ai/generate-from-idea/route.ts b/apps/web/app/api/v1/ai/generate-from-idea/route.ts index a434236..d208e8d 100644 --- a/apps/web/app/api/v1/ai/generate-from-idea/route.ts +++ b/apps/web/app/api/v1/ai/generate-from-idea/route.ts @@ -1,6 +1,6 @@ import { NextRequest, NextResponse } from "next/server"; import { z } from "zod"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; import { applyRateLimit } from "@/lib/rate-limit"; import { withAiQuota } from "@/lib/ai/ai-error"; import { generateRecipe } from "@/lib/ai/features/generate-recipe"; @@ -17,7 +17,7 @@ const Schema = z.object({ const LANG: Record = { en: "English", fr: "French" }; export async function POST(req: NextRequest) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const body = await req.json() as unknown; diff --git a/apps/web/app/api/v1/ai/generate/route.ts b/apps/web/app/api/v1/ai/generate/route.ts index 07c4446..5dd2661 100644 --- a/apps/web/app/api/v1/ai/generate/route.ts +++ b/apps/web/app/api/v1/ai/generate/route.ts @@ -1,6 +1,6 @@ import { NextRequest, NextResponse } from "next/server"; import { z } from "zod"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; import { applyRateLimit } from "@/lib/rate-limit"; import { withAiQuota } from "@/lib/ai/ai-error"; import { generateRecipe } from "@/lib/ai/features/generate-recipe"; @@ -15,7 +15,7 @@ const Schema = z.object({ }); export async function POST(req: NextRequest) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const body = await req.json() as unknown; diff --git a/apps/web/app/api/v1/ai/import-photo/route.ts b/apps/web/app/api/v1/ai/import-photo/route.ts index afcf3f1..2b417d4 100644 --- a/apps/web/app/api/v1/ai/import-photo/route.ts +++ b/apps/web/app/api/v1/ai/import-photo/route.ts @@ -1,7 +1,7 @@ import { NextRequest, NextResponse } from "next/server"; import { z } from "zod"; import { db, recipes, recipeIngredients, recipeSteps } from "@epicure/db"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; import { applyRateLimit } from "@/lib/rate-limit"; import { withAiQuota, resolveAiConfigOrError } from "@/lib/ai/ai-error"; import { importFromPhoto } from "@/lib/ai/features/import-photo"; @@ -13,7 +13,7 @@ const Schema = z.object({ }); export async function POST(req: NextRequest) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const body = await req.json() as unknown; diff --git a/apps/web/app/api/v1/ai/import-url/route.ts b/apps/web/app/api/v1/ai/import-url/route.ts index f13280c..029b5f7 100644 --- a/apps/web/app/api/v1/ai/import-url/route.ts +++ b/apps/web/app/api/v1/ai/import-url/route.ts @@ -1,6 +1,6 @@ import { NextRequest, NextResponse } from "next/server"; import { z } from "zod"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; import { applyRateLimit } from "@/lib/rate-limit"; import { withAiQuota } from "@/lib/ai/ai-error"; import { importFromUrl } from "@/lib/ai/features/import-url"; @@ -13,7 +13,7 @@ const Schema = z.object({ }); export async function POST(req: NextRequest) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const body = await req.json() as unknown; diff --git a/apps/web/app/api/v1/ai/meal-plan/generate/route.ts b/apps/web/app/api/v1/ai/meal-plan/generate/route.ts index cf49ee1..2a92eb3 100644 --- a/apps/web/app/api/v1/ai/meal-plan/generate/route.ts +++ b/apps/web/app/api/v1/ai/meal-plan/generate/route.ts @@ -1,7 +1,7 @@ import { NextRequest, NextResponse } from "next/server"; import { z } from "zod"; import { db, recipes, recipeIngredients, recipeSteps, mealPlans, mealPlanEntries, pantryItems, userNutritionGoals, eq, and } from "@epicure/db"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; import { applyRateLimit } from "@/lib/rate-limit"; import { getDefaultProviderWithKey } from "@/lib/ai/resolve-user-key"; import { withAiQuota, resolveAiConfigOrError } from "@/lib/ai/ai-error"; @@ -23,7 +23,7 @@ const Schema = z.object({ }); export async function POST(req: NextRequest) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const body = await req.json() as unknown; diff --git a/apps/web/app/api/v1/ai/pairings/[id]/route.ts b/apps/web/app/api/v1/ai/pairings/[id]/route.ts index 687ecdb..3f2d061 100644 --- a/apps/web/app/api/v1/ai/pairings/[id]/route.ts +++ b/apps/web/app/api/v1/ai/pairings/[id]/route.ts @@ -2,7 +2,7 @@ import { NextRequest, NextResponse } from "next/server"; import { z } from "zod"; import { and, eq } from "@epicure/db"; import { db, recipes } from "@epicure/db"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; import { withAiQuota, resolveAiConfigOrError } from "@/lib/ai/ai-error"; import { suggestPairings } from "@/lib/ai/features/suggest-pairings"; import { withUserKey } from "@/lib/ai/resolve-user-key"; @@ -17,7 +17,7 @@ const Schema = z.object({ type Params = { params: Promise<{ id: string }> }; export async function POST(req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { id } = await params; diff --git a/apps/web/app/api/v1/ai/recipe-chat/route.ts b/apps/web/app/api/v1/ai/recipe-chat/route.ts index f8a9ebd..140aec3 100644 --- a/apps/web/app/api/v1/ai/recipe-chat/route.ts +++ b/apps/web/app/api/v1/ai/recipe-chat/route.ts @@ -1,7 +1,7 @@ import { NextRequest, NextResponse } from "next/server"; import { z } from "zod"; import { generateText } from "ai"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; import { applyRateLimit } from "@/lib/rate-limit"; import { withAiQuota, resolveAiConfigOrError } from "@/lib/ai/ai-error"; import { getModelConfigForUseCase } from "@/lib/ai/resolve-user-key"; @@ -18,7 +18,7 @@ const Schema = z.object({ const LANG: Record = { en: "English", fr: "French" }; export async function POST(req: NextRequest) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const body = await req.json() as unknown; diff --git a/apps/web/app/api/v1/ai/recipe-ideas/route.ts b/apps/web/app/api/v1/ai/recipe-ideas/route.ts index 167b721..8819957 100644 --- a/apps/web/app/api/v1/ai/recipe-ideas/route.ts +++ b/apps/web/app/api/v1/ai/recipe-ideas/route.ts @@ -1,7 +1,7 @@ import { NextRequest, NextResponse } from "next/server"; import { z } from "zod"; import { generateObject } from "ai"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; import { applyRateLimit } from "@/lib/rate-limit"; import { withAiQuota, resolveAiConfigOrError } from "@/lib/ai/ai-error"; import { getModelConfigForUseCase } from "@/lib/ai/resolve-user-key"; @@ -25,7 +25,7 @@ const IdeasSchema = z.object({ }); export async function POST(req: NextRequest) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const body = await req.json() as unknown; diff --git a/apps/web/app/api/v1/ai/scale/route.ts b/apps/web/app/api/v1/ai/scale/route.ts index 82caeb1..e015124 100644 --- a/apps/web/app/api/v1/ai/scale/route.ts +++ b/apps/web/app/api/v1/ai/scale/route.ts @@ -1,7 +1,7 @@ import { NextRequest, NextResponse } from "next/server"; import { z } from "zod"; import { db, recipes, eq, and, or } from "@epicure/db"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; import { applyRateLimit } from "@/lib/rate-limit"; import { getDefaultProviderWithKey } from "@/lib/ai/resolve-user-key"; import { withAiQuota, resolveAiConfigOrError } from "@/lib/ai/ai-error"; @@ -13,7 +13,7 @@ const Schema = z.object({ }); export async function POST(req: NextRequest) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const limited = await applyRateLimit(`rl:ai:scale:${session!.user.id}`, 20, 60); diff --git a/apps/web/app/api/v1/ai/substitute/route.ts b/apps/web/app/api/v1/ai/substitute/route.ts index 5dd7dff..a7bc853 100644 --- a/apps/web/app/api/v1/ai/substitute/route.ts +++ b/apps/web/app/api/v1/ai/substitute/route.ts @@ -1,6 +1,6 @@ import { NextRequest, NextResponse } from "next/server"; import { z } from "zod"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; import { withAiQuota, resolveAiConfigOrError } from "@/lib/ai/ai-error"; import { applyRateLimit } from "@/lib/rate-limit"; import { getDefaultProviderWithKey } from "@/lib/ai/resolve-user-key"; @@ -14,7 +14,7 @@ const Schema = z.object({ }); export async function POST(req: NextRequest) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const body = await req.json() as unknown; diff --git a/apps/web/app/api/v1/ai/translate/[id]/route.ts b/apps/web/app/api/v1/ai/translate/[id]/route.ts index 34a56ce..64ee870 100644 --- a/apps/web/app/api/v1/ai/translate/[id]/route.ts +++ b/apps/web/app/api/v1/ai/translate/[id]/route.ts @@ -2,7 +2,7 @@ import { NextRequest, NextResponse } from "next/server"; import { z } from "zod"; import { and, eq } from "@epicure/db"; import { db, recipes, recipeIngredients, recipeSteps } from "@epicure/db"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; import { withAiQuota } from "@/lib/ai/ai-error"; import { translateRecipe } from "@/lib/ai/features/translate-recipe"; @@ -15,7 +15,7 @@ const Schema = z.object({ type Params = { params: Promise<{ id: string }> }; export async function POST(req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { id } = await params; diff --git a/apps/web/app/api/v1/ai/variations/[id]/route.ts b/apps/web/app/api/v1/ai/variations/[id]/route.ts index be82ae7..88a54f7 100644 --- a/apps/web/app/api/v1/ai/variations/[id]/route.ts +++ b/apps/web/app/api/v1/ai/variations/[id]/route.ts @@ -2,7 +2,7 @@ import { NextRequest, NextResponse } from "next/server"; import { z } from "zod"; import { and, eq } from "@epicure/db"; import { db, recipes } from "@epicure/db"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; import { withAiQuota, resolveAiConfigOrError } from "@/lib/ai/ai-error"; import { suggestVariations } from "@/lib/ai/features/suggest-variations"; import { withUserKey } from "@/lib/ai/resolve-user-key"; @@ -18,7 +18,7 @@ const Schema = z.object({ type Params = { params: Promise<{ id: string }> }; export async function POST(req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { id } = await params; diff --git a/apps/web/app/api/v1/collections/[id]/favorite/route.ts b/apps/web/app/api/v1/collections/[id]/favorite/route.ts index 37eb2a4..6e09281 100644 --- a/apps/web/app/api/v1/collections/[id]/favorite/route.ts +++ b/apps/web/app/api/v1/collections/[id]/favorite/route.ts @@ -1,11 +1,11 @@ import { NextRequest, NextResponse } from "next/server"; import { db, collections, collectionFavorites, eq, and, or } from "@epicure/db"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; type Params = { params: Promise<{ id: string }> }; -export async function POST(_req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); +export async function POST(req: NextRequest, { params }: Params) { + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { id } = await params; @@ -21,8 +21,8 @@ export async function POST(_req: NextRequest, { params }: Params) { return NextResponse.json({ favorited: true }); } -export async function DELETE(_req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); +export async function DELETE(req: NextRequest, { params }: Params) { + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { id } = await params; diff --git a/apps/web/app/api/v1/collections/[id]/fork/route.ts b/apps/web/app/api/v1/collections/[id]/fork/route.ts index 54a4b66..a4845a5 100644 --- a/apps/web/app/api/v1/collections/[id]/fork/route.ts +++ b/apps/web/app/api/v1/collections/[id]/fork/route.ts @@ -1,11 +1,11 @@ import { NextRequest, NextResponse } from "next/server"; import { db, collections, collectionRecipes, eq, and, or } from "@epicure/db"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; type Params = { params: Promise<{ id: string }> }; -export async function POST(_req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); +export async function POST(req: NextRequest, { params }: Params) { + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { id } = await params; diff --git a/apps/web/app/api/v1/collections/[id]/members/route.ts b/apps/web/app/api/v1/collections/[id]/members/route.ts index b90d9b9..0a3f150 100644 --- a/apps/web/app/api/v1/collections/[id]/members/route.ts +++ b/apps/web/app/api/v1/collections/[id]/members/route.ts @@ -1,14 +1,14 @@ import { NextRequest, NextResponse } from "next/server"; import { z } from "zod"; import { db, collections, collectionMembers, users, eq, and } from "@epicure/db"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; type Params = { params: Promise<{ id: string }> }; // ─── GET /api/v1/collections/[id]/members ──────────────────────────────────── // Owner only — returns members joined with basic user info. -export async function GET(_req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); +export async function GET(req: NextRequest, { params }: Params) { + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { id } = await params; @@ -52,7 +52,7 @@ const InviteSchema = z }); export async function POST(req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { id } = await params; @@ -103,7 +103,7 @@ export async function POST(req: NextRequest, { params }: Params) { // ─── DELETE /api/v1/collections/[id]/members?memberId=… ────────────────────── // Owner OR the member themselves can remove. export async function DELETE(req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { id } = await params; diff --git a/apps/web/app/api/v1/collections/[id]/route.ts b/apps/web/app/api/v1/collections/[id]/route.ts index a285091..925e71a 100644 --- a/apps/web/app/api/v1/collections/[id]/route.ts +++ b/apps/web/app/api/v1/collections/[id]/route.ts @@ -1,12 +1,12 @@ import { NextRequest, NextResponse } from "next/server"; import { z } from "zod"; import { db, collections, collectionRecipes, recipes, eq, and, or, ne, inArray } from "@epicure/db"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; type Params = { params: Promise<{ id: string }> }; -export async function GET(_req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); +export async function GET(req: NextRequest, { params }: Params) { + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { id } = await params; @@ -20,7 +20,7 @@ export async function GET(_req: NextRequest, { params }: Params) { } export async function PUT(req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { id } = await params; @@ -77,8 +77,8 @@ export async function PUT(req: NextRequest, { params }: Params) { return NextResponse.json({ updated: true }); } -export async function DELETE(_req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); +export async function DELETE(req: NextRequest, { params }: Params) { + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { id } = await params; diff --git a/apps/web/app/api/v1/collections/route.ts b/apps/web/app/api/v1/collections/route.ts index 25daa2c..772c824 100644 --- a/apps/web/app/api/v1/collections/route.ts +++ b/apps/web/app/api/v1/collections/route.ts @@ -1,7 +1,7 @@ import { NextRequest, NextResponse } from "next/server"; import { z } from "zod"; import { db, collections, eq, desc, sql } from "@epicure/db"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; const Schema = z.object({ name: z.string().min(1).max(100), @@ -10,7 +10,7 @@ const Schema = z.object({ }); export async function GET(req: NextRequest) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { searchParams } = req.nextUrl; @@ -48,7 +48,7 @@ export async function GET(req: NextRequest) { } export async function POST(req: NextRequest) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const body = await req.json() as unknown; diff --git a/apps/web/app/api/v1/feed/for-you/route.ts b/apps/web/app/api/v1/feed/for-you/route.ts index 496f36b..f29f080 100644 --- a/apps/web/app/api/v1/feed/for-you/route.ts +++ b/apps/web/app/api/v1/feed/for-you/route.ts @@ -1,10 +1,10 @@ import { NextRequest, NextResponse } from "next/server"; import { db, recipes, users, favorites, ratings, userFollows, eq, and, or, ne, gte, notInArray, inArray, desc, isNotNull } from "@epicure/db"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; import { buildPreferenceMap, rankForYou } from "@/lib/for-you-ranking"; export async function GET(req: NextRequest) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const userId = session!.user.id; diff --git a/apps/web/app/api/v1/feed/route.ts b/apps/web/app/api/v1/feed/route.ts index fe56184..557a25a 100644 --- a/apps/web/app/api/v1/feed/route.ts +++ b/apps/web/app/api/v1/feed/route.ts @@ -1,10 +1,10 @@ import { NextRequest, NextResponse } from "next/server"; import { db, recipes, users, userFollows, eq, and, ne, sql } from "@epicure/db"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; import { desc, inArray } from "@epicure/db"; export async function GET(req: NextRequest) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { searchParams } = new URL(req.url); diff --git a/apps/web/app/api/v1/meal-plans/[weekStart]/entries/[entryId]/route.ts b/apps/web/app/api/v1/meal-plans/[weekStart]/entries/[entryId]/route.ts index 595024a..2f82c8f 100644 --- a/apps/web/app/api/v1/meal-plans/[weekStart]/entries/[entryId]/route.ts +++ b/apps/web/app/api/v1/meal-plans/[weekStart]/entries/[entryId]/route.ts @@ -1,11 +1,11 @@ import { NextRequest, NextResponse } from "next/server"; import { db, mealPlans, mealPlanEntries, eq, and } from "@epicure/db"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; type Params = { params: Promise<{ weekStart: string; entryId: string }> }; -export async function DELETE(_req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); +export async function DELETE(req: NextRequest, { params }: Params) { + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { weekStart, entryId } = await params; diff --git a/apps/web/app/api/v1/meal-plans/[weekStart]/entries/bulk/route.ts b/apps/web/app/api/v1/meal-plans/[weekStart]/entries/bulk/route.ts index 9ea2852..096a2d0 100644 --- a/apps/web/app/api/v1/meal-plans/[weekStart]/entries/bulk/route.ts +++ b/apps/web/app/api/v1/meal-plans/[weekStart]/entries/bulk/route.ts @@ -1,7 +1,7 @@ import { NextRequest, NextResponse } from "next/server"; import { z } from "zod"; import { db, mealPlans, mealPlanEntries, eq, and, inArray } from "@epicure/db"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; type Params = { params: Promise<{ weekStart: string }> }; @@ -13,7 +13,7 @@ const BulkDeleteSchema = z.object({ // so this is only ever called with either one day's entry ids or the whole // week's, scoped to the caller's own plan. export async function DELETE(req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { weekStart } = await params; diff --git a/apps/web/app/api/v1/meal-plans/[weekStart]/entries/route.ts b/apps/web/app/api/v1/meal-plans/[weekStart]/entries/route.ts index 8809546..f8f417c 100644 --- a/apps/web/app/api/v1/meal-plans/[weekStart]/entries/route.ts +++ b/apps/web/app/api/v1/meal-plans/[weekStart]/entries/route.ts @@ -1,7 +1,7 @@ import { NextRequest, NextResponse } from "next/server"; import { z } from "zod"; import { db, mealPlans, mealPlanEntries, recipes, recipeBatchDishes, eq, and, or, ne } from "@epicure/db"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; import { dispatchWebhook } from "@/lib/webhooks"; type Params = { params: Promise<{ weekStart: string }> }; @@ -30,8 +30,8 @@ async function getOrCreatePlan(userId: string, weekStart: string) { // added/removed by a collaborator via the shared view show up here too — a // lean shape (no photos join) unlike the full plan GET at // meal-plans/[weekStart]/route.ts, since this runs every few seconds. -export async function GET(_req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); +export async function GET(req: NextRequest, { params }: Params) { + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { weekStart } = await params; @@ -62,7 +62,7 @@ export async function GET(_req: NextRequest, { params }: Params) { } export async function POST(req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { weekStart } = await params; diff --git a/apps/web/app/api/v1/meal-plans/[weekStart]/export/ics/route.ts b/apps/web/app/api/v1/meal-plans/[weekStart]/export/ics/route.ts index 374a747..1dd85a2 100644 --- a/apps/web/app/api/v1/meal-plans/[weekStart]/export/ics/route.ts +++ b/apps/web/app/api/v1/meal-plans/[weekStart]/export/ics/route.ts @@ -1,6 +1,6 @@ import { NextRequest, NextResponse } from "next/server"; import { db, mealPlans, eq, and } from "@epicure/db"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; import { buildIcs, type IcsEvent } from "@/lib/ics"; type Params = { params: Promise<{ weekStart: string }> }; @@ -16,8 +16,8 @@ const MEAL_TIME: Record }; @@ -18,8 +18,8 @@ async function getOrCreatePlan(userId: string, weekStart: string) { // ─── GET /api/v1/meal-plans/[weekStart]/members ────────────────────────────── // Owner only — returns members joined with basic user info. -export async function GET(_req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); +export async function GET(req: NextRequest, { params }: Params) { + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { weekStart } = await params; @@ -57,7 +57,7 @@ const InviteSchema = z }); export async function POST(req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { weekStart } = await params; @@ -97,7 +97,7 @@ export async function POST(req: NextRequest, { params }: Params) { // ─── DELETE /api/v1/meal-plans/[weekStart]/members?memberId=… ──────────────── // Owner OR the member themselves can remove. export async function DELETE(req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { weekStart } = await params; const memberId = req.nextUrl.searchParams.get("memberId"); diff --git a/apps/web/app/api/v1/meal-plans/[weekStart]/nutrition/route.ts b/apps/web/app/api/v1/meal-plans/[weekStart]/nutrition/route.ts index 924448f..99e03f9 100644 --- a/apps/web/app/api/v1/meal-plans/[weekStart]/nutrition/route.ts +++ b/apps/web/app/api/v1/meal-plans/[weekStart]/nutrition/route.ts @@ -1,6 +1,6 @@ import { NextRequest, NextResponse } from "next/server"; import { db, mealPlans, mealPlanEntries, userNutritionGoals, eq, and } from "@epicure/db"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; type Params = { params: Promise<{ weekStart: string }> }; @@ -12,8 +12,8 @@ function emptyTotals(): Totals { return { calories: 0, protein: 0, carbs: 0, fat: 0 }; } -export async function GET(_req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); +export async function GET(req: NextRequest, { params }: Params) { + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { weekStart } = await params; diff --git a/apps/web/app/api/v1/meal-plans/[weekStart]/route.ts b/apps/web/app/api/v1/meal-plans/[weekStart]/route.ts index c32e630..3cdb5d6 100644 --- a/apps/web/app/api/v1/meal-plans/[weekStart]/route.ts +++ b/apps/web/app/api/v1/meal-plans/[weekStart]/route.ts @@ -1,11 +1,11 @@ import { NextRequest, NextResponse } from "next/server"; import { db, mealPlans, eq, and } from "@epicure/db"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; type Params = { params: Promise<{ weekStart: string }> }; -export async function GET(_req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); +export async function GET(req: NextRequest, { params }: Params) { + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { weekStart } = await params; @@ -26,8 +26,8 @@ export async function GET(_req: NextRequest, { params }: Params) { return NextResponse.json(plan); } -export async function POST(_req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); +export async function POST(req: NextRequest, { params }: Params) { + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { weekStart } = await params; diff --git a/apps/web/app/api/v1/meal-plans/shared/[mealPlanId]/entries/route.ts b/apps/web/app/api/v1/meal-plans/shared/[mealPlanId]/entries/route.ts index af582b2..9b57c4c 100644 --- a/apps/web/app/api/v1/meal-plans/shared/[mealPlanId]/entries/route.ts +++ b/apps/web/app/api/v1/meal-plans/shared/[mealPlanId]/entries/route.ts @@ -1,7 +1,7 @@ import { NextRequest, NextResponse } from "next/server"; import { z } from "zod"; import { db, mealPlanEntries, recipes, eq, and, or, ne, inArray } from "@epicure/db"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; import { getMealPlanAccessById, canWriteMealPlan } from "@/lib/meal-plan-access"; import { dispatchWebhook } from "@/lib/webhooks"; @@ -10,8 +10,8 @@ type Params = { params: Promise<{ mealPlanId: string }> }; // Polled by SharedMealPlanView so every collaborator sees each other's // changes, and the plan owner's own tab (a different component/URL, per // meal-plans/[weekStart]/entries) picks up edits made from here too. -export async function GET(_req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); +export async function GET(req: NextRequest, { params }: Params) { + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { mealPlanId } = await params; @@ -43,7 +43,7 @@ const Schema = z.object({ }); export async function POST(req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { mealPlanId } = await params; @@ -89,7 +89,7 @@ export async function POST(req: NextRequest, { params }: Params) { } export async function DELETE(req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { mealPlanId } = await params; diff --git a/apps/web/app/api/v1/meal-plans/shared/[mealPlanId]/route.ts b/apps/web/app/api/v1/meal-plans/shared/[mealPlanId]/route.ts index f211f47..5b92ed6 100644 --- a/apps/web/app/api/v1/meal-plans/shared/[mealPlanId]/route.ts +++ b/apps/web/app/api/v1/meal-plans/shared/[mealPlanId]/route.ts @@ -1,12 +1,12 @@ import { NextRequest, NextResponse } from "next/server"; import { db, mealPlans, users, eq } from "@epicure/db"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; import { getMealPlanAccessById } from "@/lib/meal-plan-access"; type Params = { params: Promise<{ mealPlanId: string }> }; -export async function GET(_req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); +export async function GET(req: NextRequest, { params }: Params) { + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { mealPlanId } = await params; diff --git a/apps/web/app/api/v1/pantry/[id]/route.ts b/apps/web/app/api/v1/pantry/[id]/route.ts index d31798d..04beaae 100644 --- a/apps/web/app/api/v1/pantry/[id]/route.ts +++ b/apps/web/app/api/v1/pantry/[id]/route.ts @@ -1,12 +1,12 @@ import { NextRequest, NextResponse } from "next/server"; import { z } from "zod"; import { db, pantryItems, eq, and } from "@epicure/db"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; type Params = { params: Promise<{ id: string }> }; export async function PUT(req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { id } = await params; @@ -33,8 +33,8 @@ export async function PUT(req: NextRequest, { params }: Params) { return NextResponse.json({ updated: true }); } -export async function DELETE(_req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); +export async function DELETE(req: NextRequest, { params }: Params) { + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { id } = await params; diff --git a/apps/web/app/api/v1/pantry/bulk/route.ts b/apps/web/app/api/v1/pantry/bulk/route.ts index c2db4d5..a27cc4e 100644 --- a/apps/web/app/api/v1/pantry/bulk/route.ts +++ b/apps/web/app/api/v1/pantry/bulk/route.ts @@ -1,7 +1,7 @@ import { NextRequest, NextResponse } from "next/server"; import { z } from "zod"; import { db, pantryItems, eq } from "@epicure/db"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; const Schema = z.object({ items: z.array(z.object({ @@ -12,7 +12,7 @@ const Schema = z.object({ }); export async function POST(req: NextRequest) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const body = await req.json() as unknown; diff --git a/apps/web/app/api/v1/pantry/route.ts b/apps/web/app/api/v1/pantry/route.ts index c37c2ac..714fac4 100644 --- a/apps/web/app/api/v1/pantry/route.ts +++ b/apps/web/app/api/v1/pantry/route.ts @@ -1,7 +1,7 @@ import { NextRequest, NextResponse } from "next/server"; import { z } from "zod"; import { db, pantryItems, eq, desc, sql } from "@epicure/db"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; const Schema = z.object({ rawName: z.string().min(1).max(200), @@ -11,7 +11,7 @@ const Schema = z.object({ }); export async function GET(req: NextRequest) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { searchParams } = req.nextUrl; @@ -39,7 +39,7 @@ export async function GET(req: NextRequest) { } export async function POST(req: NextRequest) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const body = await req.json() as unknown; diff --git a/apps/web/app/api/v1/pantry/scan/barcode/route.ts b/apps/web/app/api/v1/pantry/scan/barcode/route.ts index e53df6d..78f4077 100644 --- a/apps/web/app/api/v1/pantry/scan/barcode/route.ts +++ b/apps/web/app/api/v1/pantry/scan/barcode/route.ts @@ -1,6 +1,6 @@ import { NextRequest, NextResponse } from "next/server"; import { z } from "zod"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; import { applyRateLimit } from "@/lib/rate-limit"; const Schema = z.object({ @@ -30,7 +30,7 @@ function extractUnit(quantity: string | undefined): string | undefined { } export async function POST(req: NextRequest) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const body = await req.json() as unknown; diff --git a/apps/web/app/api/v1/pantry/scan/photo/route.ts b/apps/web/app/api/v1/pantry/scan/photo/route.ts index 7542e15..626e813 100644 --- a/apps/web/app/api/v1/pantry/scan/photo/route.ts +++ b/apps/web/app/api/v1/pantry/scan/photo/route.ts @@ -1,6 +1,6 @@ import { NextRequest, NextResponse } from "next/server"; import { z } from "zod"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; import { applyRateLimit } from "@/lib/rate-limit"; import { withAiQuota, resolveAiConfigOrError } from "@/lib/ai/ai-error"; import { getModelConfigForUseCase } from "@/lib/ai/resolve-user-key"; @@ -12,7 +12,7 @@ const Schema = z.object({ }); export async function POST(req: NextRequest) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const body = await req.json() as unknown; diff --git a/apps/web/app/api/v1/recipes/[id]/comments/[commentId]/reactions/route.ts b/apps/web/app/api/v1/recipes/[id]/comments/[commentId]/reactions/route.ts index 510a20a..0d48406 100644 --- a/apps/web/app/api/v1/recipes/[id]/comments/[commentId]/reactions/route.ts +++ b/apps/web/app/api/v1/recipes/[id]/comments/[commentId]/reactions/route.ts @@ -1,7 +1,7 @@ import { NextRequest, NextResponse } from "next/server"; import { z } from "zod"; import { db, comments, commentReactions, eq, and, count } from "@epicure/db"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; import { applyRateLimit } from "@/lib/rate-limit"; import { createNotification } from "@/lib/notifications"; @@ -34,7 +34,7 @@ export async function GET(req: NextRequest, { params }: Params) { // Optional auth — GET reactions is public; session present means also return user's own reactions // response intentionally ignored: unauthenticated callers get counts only with empty userReactions - const { session } = await requireSession(); + const { session } = await requireSessionOrApiKey(req); let userReactions: string[] = []; if (session) { @@ -49,7 +49,7 @@ export async function GET(req: NextRequest, { params }: Params) { } export async function POST(req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const limited = await applyRateLimit(`rl:reaction:${session!.user.id}`, 60, 60); diff --git a/apps/web/app/api/v1/recipes/[id]/comments/route.ts b/apps/web/app/api/v1/recipes/[id]/comments/route.ts index 5faa854..7ff8e82 100644 --- a/apps/web/app/api/v1/recipes/[id]/comments/route.ts +++ b/apps/web/app/api/v1/recipes/[id]/comments/route.ts @@ -1,7 +1,7 @@ import { NextRequest, NextResponse } from "next/server"; import { z } from "zod"; import { db, recipes, comments, users, userBlocks, eq, and, inArray, isNull, sql } from "@epicure/db"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; import { applyRateLimit } from "@/lib/rate-limit"; import { dispatchWebhook } from "@/lib/webhooks"; import { createNotification } from "@/lib/notifications"; @@ -34,7 +34,7 @@ export async function GET(req: NextRequest, { params }: Params) { return NextResponse.json({ error: "Not found" }, { status: 404 }); } - const { session } = await requireSession(); + const { session } = await requireSessionOrApiKey(req); const { searchParams } = req.nextUrl; const limitRaw = parseInt(searchParams.get("limit") ?? "20"); @@ -88,7 +88,7 @@ export async function GET(req: NextRequest, { params }: Params) { } export async function POST(req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { id } = await params; diff --git a/apps/web/app/api/v1/recipes/[id]/cooked/route.ts b/apps/web/app/api/v1/recipes/[id]/cooked/route.ts index 17a809c..5534ef1 100644 --- a/apps/web/app/api/v1/recipes/[id]/cooked/route.ts +++ b/apps/web/app/api/v1/recipes/[id]/cooked/route.ts @@ -1,7 +1,7 @@ import { NextRequest, NextResponse } from "next/server"; import { z } from "zod"; import { db, recipes, cookingHistory, pantryItems, recipeIngredients, recipeBatchDishes, eq, and } from "@epicure/db"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; type Params = { params: Promise<{ id: string }> }; @@ -13,7 +13,7 @@ const Schema = z.object({ }); export async function POST(req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { id } = await params; const userId = session!.user.id; diff --git a/apps/web/app/api/v1/recipes/[id]/favorite/route.ts b/apps/web/app/api/v1/recipes/[id]/favorite/route.ts index ff2a031..d50e0a0 100644 --- a/apps/web/app/api/v1/recipes/[id]/favorite/route.ts +++ b/apps/web/app/api/v1/recipes/[id]/favorite/route.ts @@ -1,11 +1,11 @@ import { NextRequest, NextResponse } from "next/server"; import { db, recipes, favorites, eq, and } from "@epicure/db"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; type Params = { params: Promise<{ id: string }> }; -export async function POST(_req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); +export async function POST(req: NextRequest, { params }: Params) { + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { id } = await params; @@ -18,8 +18,8 @@ export async function POST(_req: NextRequest, { params }: Params) { return NextResponse.json({ favorited: true }); } -export async function DELETE(_req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); +export async function DELETE(req: NextRequest, { params }: Params) { + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { id } = await params; diff --git a/apps/web/app/api/v1/recipes/[id]/nutrition/route.ts b/apps/web/app/api/v1/recipes/[id]/nutrition/route.ts index d3900a1..e5963c0 100644 --- a/apps/web/app/api/v1/recipes/[id]/nutrition/route.ts +++ b/apps/web/app/api/v1/recipes/[id]/nutrition/route.ts @@ -1,15 +1,15 @@ import { NextRequest, NextResponse } from "next/server"; import { db, recipes, recipeIngredients } from "@epicure/db"; import { eq, and, or, ne } from "@epicure/db"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; import { applyRateLimit } from "@/lib/rate-limit"; import { withAiQuota } from "@/lib/ai/ai-error"; import { estimateNutrition } from "@/lib/ai/features/estimate-nutrition"; type Params = { params: Promise<{ id: string }> }; -export async function GET(_req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); +export async function GET(req: NextRequest, { params }: Params) { + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { id } = await params; @@ -28,8 +28,8 @@ export async function GET(_req: NextRequest, { params }: Params) { return NextResponse.json({ nutrition: recipe.nutritionData ?? null }); } -export async function POST(_req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); +export async function POST(req: NextRequest, { params }: Params) { + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { id } = await params; diff --git a/apps/web/app/api/v1/recipes/[id]/rate/route.ts b/apps/web/app/api/v1/recipes/[id]/rate/route.ts index 129d597..911e389 100644 --- a/apps/web/app/api/v1/recipes/[id]/rate/route.ts +++ b/apps/web/app/api/v1/recipes/[id]/rate/route.ts @@ -1,7 +1,7 @@ import { NextRequest, NextResponse } from "next/server"; import { z } from "zod"; import { db, recipes, ratings, eq, and } from "@epicure/db"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; import { createNotification } from "@/lib/notifications"; import { isOwnedReviewPhotoKey } from "@/lib/storage"; @@ -14,7 +14,7 @@ const Schema = z.object({ type Params = { params: Promise<{ id: string }> }; export async function POST(req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { id } = await params; diff --git a/apps/web/app/api/v1/recipes/[id]/reviews/route.ts b/apps/web/app/api/v1/recipes/[id]/reviews/route.ts index b740f03..896b320 100644 --- a/apps/web/app/api/v1/recipes/[id]/reviews/route.ts +++ b/apps/web/app/api/v1/recipes/[id]/reviews/route.ts @@ -1,11 +1,11 @@ import { NextRequest, NextResponse } from "next/server"; import { db, recipes, ratings, eq, and, or, inArray, desc } from "@epicure/db"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; type Params = { params: Promise<{ id: string }> }; -export async function GET(_req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); +export async function GET(req: NextRequest, { params }: Params) { + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { id } = await params; diff --git a/apps/web/app/api/v1/recipes/bulk/export/route.ts b/apps/web/app/api/v1/recipes/bulk/export/route.ts index 607b5a3..3cf9ae1 100644 --- a/apps/web/app/api/v1/recipes/bulk/export/route.ts +++ b/apps/web/app/api/v1/recipes/bulk/export/route.ts @@ -1,6 +1,6 @@ import { type NextRequest, NextResponse } from "next/server"; import { z } from "zod"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; import { db, recipes, eq, and, inArray } from "@epicure/db"; import { recipeToMarkdown } from "@/lib/markdown/recipe"; @@ -9,7 +9,7 @@ const ExportSchema = z.object({ }); export async function POST(req: NextRequest) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const body = ExportSchema.safeParse(await req.json()); diff --git a/apps/web/app/api/v1/recipes/bulk/route.ts b/apps/web/app/api/v1/recipes/bulk/route.ts index e55c154..ecce5ae 100644 --- a/apps/web/app/api/v1/recipes/bulk/route.ts +++ b/apps/web/app/api/v1/recipes/bulk/route.ts @@ -1,6 +1,6 @@ import { type NextRequest, NextResponse } from "next/server"; import { z } from "zod"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; import { db, recipes, eq, and, inArray } from "@epicure/db"; const BulkDeleteSchema = z.object({ @@ -15,7 +15,7 @@ const BulkUpdateSchema = z.object({ }); export async function DELETE(req: NextRequest) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const body = BulkDeleteSchema.safeParse(await req.json()); @@ -29,7 +29,7 @@ export async function DELETE(req: NextRequest) { } export async function PATCH(req: NextRequest) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const body = BulkUpdateSchema.safeParse(await req.json()); diff --git a/apps/web/app/api/v1/shopping-lists/[id]/export/instacart/route.ts b/apps/web/app/api/v1/shopping-lists/[id]/export/instacart/route.ts index 49116d3..278cee9 100644 --- a/apps/web/app/api/v1/shopping-lists/[id]/export/instacart/route.ts +++ b/apps/web/app/api/v1/shopping-lists/[id]/export/instacart/route.ts @@ -1,14 +1,14 @@ import { NextRequest, NextResponse } from "next/server"; import { db, shoppingLists, eq } from "@epicure/db"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; import { getShoppingListAccess } from "@/lib/shopping-list-access"; import { buildGroceryExportPayload } from "@/lib/grocery-export"; import { createInstacartShoppingListLink } from "@/lib/grocery-providers/instacart"; type Params = { params: Promise<{ id: string }> }; -export async function POST(_req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); +export async function POST(req: NextRequest, { params }: Params) { + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { id } = await params; diff --git a/apps/web/app/api/v1/shopping-lists/[id]/export/route.ts b/apps/web/app/api/v1/shopping-lists/[id]/export/route.ts index 1245ebf..96fa391 100644 --- a/apps/web/app/api/v1/shopping-lists/[id]/export/route.ts +++ b/apps/web/app/api/v1/shopping-lists/[id]/export/route.ts @@ -1,13 +1,13 @@ import { NextRequest, NextResponse } from "next/server"; import { db, shoppingLists, eq } from "@epicure/db"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; import { getShoppingListAccess } from "@/lib/shopping-list-access"; import { buildGroceryExportPayload } from "@/lib/grocery-export"; type Params = { params: Promise<{ id: string }> }; -export async function GET(_req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); +export async function GET(req: NextRequest, { params }: Params) { + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { id } = await params; diff --git a/apps/web/app/api/v1/shopping-lists/[id]/members/route.ts b/apps/web/app/api/v1/shopping-lists/[id]/members/route.ts index d7b7319..2415a2b 100644 --- a/apps/web/app/api/v1/shopping-lists/[id]/members/route.ts +++ b/apps/web/app/api/v1/shopping-lists/[id]/members/route.ts @@ -1,14 +1,14 @@ import { NextRequest, NextResponse } from "next/server"; import { z } from "zod"; import { db, shoppingLists, shoppingListMembers, users, eq, and } from "@epicure/db"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; type Params = { params: Promise<{ id: string }> }; // ─── GET /api/v1/shopping-lists/[id]/members ───────────────────────────────── // Owner only — returns members joined with basic user info. -export async function GET(_req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); +export async function GET(req: NextRequest, { params }: Params) { + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { id } = await params; @@ -51,7 +51,7 @@ const InviteSchema = z }); export async function POST(req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { id } = await params; @@ -98,7 +98,7 @@ export async function POST(req: NextRequest, { params }: Params) { // ─── DELETE /api/v1/shopping-lists/[id]/members?memberId=… ─────────────────── // Owner OR the member themselves can remove. export async function DELETE(req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { id } = await params; diff --git a/apps/web/app/api/v1/shopping-lists/[id]/route.ts b/apps/web/app/api/v1/shopping-lists/[id]/route.ts index a7af385..d1e5d35 100644 --- a/apps/web/app/api/v1/shopping-lists/[id]/route.ts +++ b/apps/web/app/api/v1/shopping-lists/[id]/route.ts @@ -1,14 +1,14 @@ import { NextRequest, NextResponse } from "next/server"; import { z } from "zod"; import { db, shoppingLists, shoppingListItems, eq } from "@epicure/db"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; import { dispatchWebhook } from "@/lib/webhooks"; import { getShoppingListAccess, canWriteShoppingList } from "@/lib/shopping-list-access"; type Params = { params: Promise<{ id: string }> }; -export async function GET(_req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); +export async function GET(req: NextRequest, { params }: Params) { + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { id } = await params; @@ -31,7 +31,7 @@ const PatchSchema = z.object({ }); export async function PATCH(req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { id } = await params; @@ -72,8 +72,8 @@ export async function PATCH(req: NextRequest, { params }: Params) { return NextResponse.json({ updated: true }); } -export async function DELETE(_req: NextRequest, { params }: Params) { - const { session, response } = await requireSession(); +export async function DELETE(req: NextRequest, { params }: Params) { + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const { id } = await params; diff --git a/apps/web/app/api/v1/shopping-lists/route.ts b/apps/web/app/api/v1/shopping-lists/route.ts index c636197..86f6e6a 100644 --- a/apps/web/app/api/v1/shopping-lists/route.ts +++ b/apps/web/app/api/v1/shopping-lists/route.ts @@ -1,7 +1,7 @@ import { NextRequest, NextResponse } from "next/server"; import { z } from "zod"; import { db, shoppingLists, shoppingListItems, mealPlans, mealPlanEntries, recipeIngredients, pantryItems, eq, and, desc, inArray } from "@epicure/db"; -import { requireSession } from "@/lib/api-auth"; +import { requireSessionOrApiKey } from "@/lib/api-auth"; import { applyPantryToItems, mergeIngredients } from "@/lib/pantry-shopping-match"; import { guessAisle } from "@/lib/grocery-categories"; @@ -16,8 +16,8 @@ const CreateSchema = z.object({ fromMealPlanWeek: z.string().optional(), }); -export async function GET(_req: NextRequest) { - const { session, response } = await requireSession(); +export async function GET(req: NextRequest) { + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const lists = await db.query.shoppingLists.findMany({ @@ -30,7 +30,7 @@ export async function GET(_req: NextRequest) { } export async function POST(req: NextRequest) { - const { session, response } = await requireSession(); + const { session, response } = await requireSessionOrApiKey(req); if (response) return response; const body = await req.json() as unknown; diff --git a/apps/web/lib/changelog.ts b/apps/web/lib/changelog.ts index c8fb64b..c4ba018 100644 --- a/apps/web/lib/changelog.ts +++ b/apps/web/lib/changelog.ts @@ -1,5 +1,5 @@ // Mirrors CHANGELOG.md at the repo root — update both together. -export const APP_VERSION = "0.26.0"; +export const APP_VERSION = "0.27.0"; export type ChangelogEntry = { version: string; @@ -11,6 +11,13 @@ export type ChangelogEntry = { }; export const CHANGELOG: ChangelogEntry[] = [ + { + version: "0.27.0", + date: "2026-07-14 11:15", + added: [ + "**API keys now work on recipes, collections, meal plans, shopping lists, pantry, feed, and AI generation** — previously most of the API only accepted a session cookie, so keys couldn't actually be used for most endpoints. Account/credential-adjacent routes (profile, AI provider keys, webhooks, notifications, messages, admin) intentionally stay session-only.", + ], + }, { version: "0.26.0", date: "2026-07-14 10:20", diff --git a/apps/web/package.json b/apps/web/package.json index b28cb02..5e5f7c7 100644 --- a/apps/web/package.json +++ b/apps/web/package.json @@ -1,6 +1,6 @@ { "name": "@epicure/web", - "version": "0.26.0", + "version": "0.27.0", "private": true, "scripts": { "dev": "next dev", diff --git a/package.json b/package.json index 769ca23..2e37cf5 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "epicure", - "version": "0.26.0", + "version": "0.27.0", "private": true, "scripts": { "dev": "pnpm --filter web dev",