arnaudne/Epicure
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

security: widen API-key auth to content/AI routes (v0.27.0)

Browse Source 
Convert requireSession -> requireSessionOrApiKey across recipes,
collections, meal-plans, shopping-lists, pantry, feed, and ai/*
(52 routes) so API keys work end-to-end, not just for the handful of
endpoints that supported them before. Scope was explicitly confirmed
per-resource-family with the user before any file was touched.

Left session-cookie-only, deliberately: users/me*, ai-keys/*,
webhooks/*, conversations/*, notifications/*, push/subscribe, admin/*
— account/credential-adjacent surface that shouldn't widen without a
separate, explicit decision.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Arnaud
2026-07-14 11:20:26 +02:00
parent 6c4fc93aab
commit 3e71bd29a2
56 changed files with 171 additions and 159 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/web/app/api/v1/ai/adapt/[id]/route.ts
+2 -2
View File
@@ -2,7 +2,7 @@ import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { and, eq } from "@epicure/db";
import { db, recipes, recipeIngredients, recipeSteps } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { withAiQuota, resolveAiConfigOrError } from "@/lib/ai/ai-error";
import { adaptRecipe } from "@/lib/ai/features/adapt-recipe";
import { withUserKey } from "@/lib/ai/resolve-user-key";
@@ -18,7 +18,7 @@ const Schema = z.object({
type Params = { params: Promise<{ id: string }> };
export async function POST(req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
apps/web/app/api/v1/ai/batch-cook/generate/route.ts
+2 -2
View File
@@ -1,7 +1,7 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { db, recipes, recipeIngredients, recipeSteps, recipeBatchDishes } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { applyRateLimit } from "@/lib/rate-limit";
import { getDefaultProviderWithKey } from "@/lib/ai/resolve-user-key";
import { withAiQuota, resolveAiConfigOrError } from "@/lib/ai/ai-error";
@@ -19,7 +19,7 @@ const Schema = z.object({
});
export async function POST(req: NextRequest) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const body = await req.json() as unknown;
apps/web/app/api/v1/ai/chat-history/route.ts
+3 -3
View File
@@ -1,7 +1,7 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { db, chatMessages, eq, and, isNull, desc, asc, ilike } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
const Schema = z.object({
recipeId: z.string().uuid().optional(),
@@ -13,7 +13,7 @@ const Schema = z.object({
});
export async function GET(req: NextRequest) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { searchParams } = new URL(req.url);
@@ -60,7 +60,7 @@ const DeleteSchema = z.object({
// No `q` here on purpose — clearing is "this whole conversation" (or
// everything), not "every message matching a search term".
export async function DELETE(req: NextRequest) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { searchParams } = new URL(req.url);
apps/web/app/api/v1/ai/cooking-chat/route.ts
+2 -2
View File
@@ -2,7 +2,7 @@ import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { generateText } from "ai";
import { db, chatMessages } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { applyRateLimit } from "@/lib/rate-limit";
import { withAiQuota, resolveAiConfigOrError } from "@/lib/ai/ai-error";
import { getModelConfigForUseCase } from "@/lib/ai/resolve-user-key";
@@ -16,7 +16,7 @@ const Schema = z.object({
const LANG: Record<string, string> = { en: "English", fr: "French" };
export async function POST(req: NextRequest) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const body = await req.json() as unknown;
apps/web/app/api/v1/ai/drinks/[id]/route.ts
+2 -2
View File
@@ -2,7 +2,7 @@ import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { and, eq } from "@epicure/db";
import { db, recipes } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { withAiQuota, resolveAiConfigOrError } from "@/lib/ai/ai-error";
import { suggestDrinks } from "@/lib/ai/features/suggest-drinks";
import { withUserKey } from "@/lib/ai/resolve-user-key";
@@ -17,7 +17,7 @@ const Schema = z.object({
type Params = { params: Promise<{ id: string }> };
export async function POST(req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
apps/web/app/api/v1/ai/generate-from-idea/route.ts
+2 -2
View File
@@ -1,6 +1,6 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { applyRateLimit } from "@/lib/rate-limit";
import { withAiQuota } from "@/lib/ai/ai-error";
import { generateRecipe } from "@/lib/ai/features/generate-recipe";
@@ -17,7 +17,7 @@ const Schema = z.object({
const LANG: Record<string, string> = { en: "English", fr: "French" };
export async function POST(req: NextRequest) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const body = await req.json() as unknown;
apps/web/app/api/v1/ai/generate/route.ts
+2 -2
View File
@@ -1,6 +1,6 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { applyRateLimit } from "@/lib/rate-limit";
import { withAiQuota } from "@/lib/ai/ai-error";
import { generateRecipe } from "@/lib/ai/features/generate-recipe";
@@ -15,7 +15,7 @@ const Schema = z.object({
});
export async function POST(req: NextRequest) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const body = await req.json() as unknown;
apps/web/app/api/v1/ai/import-photo/route.ts
+2 -2
View File
@@ -1,7 +1,7 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { db, recipes, recipeIngredients, recipeSteps } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { applyRateLimit } from "@/lib/rate-limit";
import { withAiQuota, resolveAiConfigOrError } from "@/lib/ai/ai-error";
import { importFromPhoto } from "@/lib/ai/features/import-photo";
@@ -13,7 +13,7 @@ const Schema = z.object({
});
export async function POST(req: NextRequest) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const body = await req.json() as unknown;
apps/web/app/api/v1/ai/import-url/route.ts
+2 -2
View File
@@ -1,6 +1,6 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { applyRateLimit } from "@/lib/rate-limit";
import { withAiQuota } from "@/lib/ai/ai-error";
import { importFromUrl } from "@/lib/ai/features/import-url";
@@ -13,7 +13,7 @@ const Schema = z.object({
});
export async function POST(req: NextRequest) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const body = await req.json() as unknown;
apps/web/app/api/v1/ai/meal-plan/generate/route.ts
+2 -2
View File
@@ -1,7 +1,7 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { db, recipes, recipeIngredients, recipeSteps, mealPlans, mealPlanEntries, pantryItems, userNutritionGoals, eq, and } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { applyRateLimit } from "@/lib/rate-limit";
import { getDefaultProviderWithKey } from "@/lib/ai/resolve-user-key";
import { withAiQuota, resolveAiConfigOrError } from "@/lib/ai/ai-error";
@@ -23,7 +23,7 @@ const Schema = z.object({
});
export async function POST(req: NextRequest) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const body = await req.json() as unknown;
apps/web/app/api/v1/ai/pairings/[id]/route.ts
+2 -2
View File
@@ -2,7 +2,7 @@ import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { and, eq } from "@epicure/db";
import { db, recipes } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { withAiQuota, resolveAiConfigOrError } from "@/lib/ai/ai-error";
import { suggestPairings } from "@/lib/ai/features/suggest-pairings";
import { withUserKey } from "@/lib/ai/resolve-user-key";
@@ -17,7 +17,7 @@ const Schema = z.object({
type Params = { params: Promise<{ id: string }> };
export async function POST(req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
apps/web/app/api/v1/ai/recipe-chat/route.ts
+2 -2
View File
@@ -1,7 +1,7 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { generateText } from "ai";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { applyRateLimit } from "@/lib/rate-limit";
import { withAiQuota, resolveAiConfigOrError } from "@/lib/ai/ai-error";
import { getModelConfigForUseCase } from "@/lib/ai/resolve-user-key";
@@ -18,7 +18,7 @@ const Schema = z.object({
const LANG: Record<string, string> = { en: "English", fr: "French" };
export async function POST(req: NextRequest) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const body = await req.json() as unknown;
apps/web/app/api/v1/ai/recipe-ideas/route.ts
+2 -2
View File
@@ -1,7 +1,7 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { generateObject } from "ai";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { applyRateLimit } from "@/lib/rate-limit";
import { withAiQuota, resolveAiConfigOrError } from "@/lib/ai/ai-error";
import { getModelConfigForUseCase } from "@/lib/ai/resolve-user-key";
@@ -25,7 +25,7 @@ const IdeasSchema = z.object({
});
export async function POST(req: NextRequest) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const body = await req.json() as unknown;
apps/web/app/api/v1/ai/scale/route.ts
+2 -2
View File
@@ -1,7 +1,7 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { db, recipes, eq, and, or } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { applyRateLimit } from "@/lib/rate-limit";
import { getDefaultProviderWithKey } from "@/lib/ai/resolve-user-key";
import { withAiQuota, resolveAiConfigOrError } from "@/lib/ai/ai-error";
@@ -13,7 +13,7 @@ const Schema = z.object({
});
export async function POST(req: NextRequest) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const limited = await applyRateLimit(`rl:ai:scale:${session!.user.id}`, 20, 60);
apps/web/app/api/v1/ai/substitute/route.ts
+2 -2
View File
@@ -1,6 +1,6 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { withAiQuota, resolveAiConfigOrError } from "@/lib/ai/ai-error";
import { applyRateLimit } from "@/lib/rate-limit";
import { getDefaultProviderWithKey } from "@/lib/ai/resolve-user-key";
@@ -14,7 +14,7 @@ const Schema = z.object({
});
export async function POST(req: NextRequest) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const body = await req.json() as unknown;
apps/web/app/api/v1/ai/translate/[id]/route.ts
+2 -2
View File
@@ -2,7 +2,7 @@ import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { and, eq } from "@epicure/db";
import { db, recipes, recipeIngredients, recipeSteps } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { withAiQuota } from "@/lib/ai/ai-error";
import { translateRecipe } from "@/lib/ai/features/translate-recipe";
@@ -15,7 +15,7 @@ const Schema = z.object({
type Params = { params: Promise<{ id: string }> };
export async function POST(req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
apps/web/app/api/v1/ai/variations/[id]/route.ts
+2 -2
View File
@@ -2,7 +2,7 @@ import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { and, eq } from "@epicure/db";
import { db, recipes } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { withAiQuota, resolveAiConfigOrError } from "@/lib/ai/ai-error";
import { suggestVariations } from "@/lib/ai/features/suggest-variations";
import { withUserKey } from "@/lib/ai/resolve-user-key";
@@ -18,7 +18,7 @@ const Schema = z.object({
type Params = { params: Promise<{ id: string }> };
export async function POST(req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;