arnaudne/Epicure
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

security: widen API-key auth to content/AI routes (v0.27.0)

Browse Source 
Convert requireSession -> requireSessionOrApiKey across recipes,
collections, meal-plans, shopping-lists, pantry, feed, and ai/*
(52 routes) so API keys work end-to-end, not just for the handful of
endpoints that supported them before. Scope was explicitly confirmed
per-resource-family with the user before any file was touched.

Left session-cookie-only, deliberately: users/me*, ai-keys/*,
webhooks/*, conversations/*, notifications/*, push/subscribe, admin/*
— account/credential-adjacent surface that shouldn't widen without a
separate, explicit decision.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Arnaud
2026-07-14 11:20:26 +02:00
parent 6c4fc93aab
commit 3e71bd29a2
56 changed files with 171 additions and 159 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/web/app/api/v1/meal-plans/[weekStart]/entries/[entryId]/route.ts
+3 -3
View File
@@ -1,11 +1,11 @@
import { NextRequest, NextResponse } from "next/server";
import { db, mealPlans, mealPlanEntries, eq, and } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
type Params = { params: Promise<{ weekStart: string; entryId: string }> };
export async function DELETE(_req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
export async function DELETE(req: NextRequest, { params }: Params) {
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { weekStart, entryId } = await params;
apps/web/app/api/v1/meal-plans/[weekStart]/entries/bulk/route.ts
+2 -2
View File
@@ -1,7 +1,7 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { db, mealPlans, mealPlanEntries, eq, and, inArray } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
type Params = { params: Promise<{ weekStart: string }> };
@@ -13,7 +13,7 @@ const BulkDeleteSchema = z.object({
// so this is only ever called with either one day's entry ids or the whole
// week's, scoped to the caller's own plan.
export async function DELETE(req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { weekStart } = await params;
apps/web/app/api/v1/meal-plans/[weekStart]/entries/route.ts
+4 -4
View File
@@ -1,7 +1,7 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { db, mealPlans, mealPlanEntries, recipes, recipeBatchDishes, eq, and, or, ne } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { dispatchWebhook } from "@/lib/webhooks";
type Params = { params: Promise<{ weekStart: string }> };
@@ -30,8 +30,8 @@ async function getOrCreatePlan(userId: string, weekStart: string) {
// added/removed by a collaborator via the shared view show up here too — a
// lean shape (no photos join) unlike the full plan GET at
// meal-plans/[weekStart]/route.ts, since this runs every few seconds.
export async function GET(_req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
export async function GET(req: NextRequest, { params }: Params) {
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { weekStart } = await params;
@@ -62,7 +62,7 @@ export async function GET(_req: NextRequest, { params }: Params) {
}
export async function POST(req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { weekStart } = await params;
apps/web/app/api/v1/meal-plans/[weekStart]/export/ics/route.ts
+3 -3
View File
@@ -1,6 +1,6 @@
import { NextRequest, NextResponse } from "next/server";
import { db, mealPlans, eq, and } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { buildIcs, type IcsEvent } from "@/lib/ics";
type Params = { params: Promise<{ weekStart: string }> };
@@ -16,8 +16,8 @@ const MEAL_TIME: Record<string, { hour: number; minute: number; durationMinutes:
snack: { hour: 15, minute: 30, durationMinutes: 15 },
};
export async function GET(_req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
export async function GET(req: NextRequest, { params }: Params) {
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { weekStart } = await params;
apps/web/app/api/v1/meal-plans/[weekStart]/members/route.ts
+5 -5
View File
@@ -1,7 +1,7 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { db, mealPlans, mealPlanMembers, users, eq, and } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
type Params = { params: Promise<{ weekStart: string }> };
@@ -18,8 +18,8 @@ async function getOrCreatePlan(userId: string, weekStart: string) {
// ─── GET /api/v1/meal-plans/[weekStart]/members ──────────────────────────────
// Owner only — returns members joined with basic user info.
export async function GET(_req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
export async function GET(req: NextRequest, { params }: Params) {
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { weekStart } = await params;
@@ -57,7 +57,7 @@ const InviteSchema = z
});
export async function POST(req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { weekStart } = await params;
@@ -97,7 +97,7 @@ export async function POST(req: NextRequest, { params }: Params) {
// ─── DELETE /api/v1/meal-plans/[weekStart]/members?memberId=… ────────────────
// Owner OR the member themselves can remove.
export async function DELETE(req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { weekStart } = await params;
const memberId = req.nextUrl.searchParams.get("memberId");
apps/web/app/api/v1/meal-plans/[weekStart]/nutrition/route.ts
+3 -3
View File
@@ -1,6 +1,6 @@
import { NextRequest, NextResponse } from "next/server";
import { db, mealPlans, mealPlanEntries, userNutritionGoals, eq, and } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
type Params = { params: Promise<{ weekStart: string }> };
@@ -12,8 +12,8 @@ function emptyTotals(): Totals {
return { calories: 0, protein: 0, carbs: 0, fat: 0 };
}
export async function GET(_req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
export async function GET(req: NextRequest, { params }: Params) {
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { weekStart } = await params;
apps/web/app/api/v1/meal-plans/[weekStart]/route.ts
+5 -5
View File
@@ -1,11 +1,11 @@
import { NextRequest, NextResponse } from "next/server";
import { db, mealPlans, eq, and } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
type Params = { params: Promise<{ weekStart: string }> };
export async function GET(_req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
export async function GET(req: NextRequest, { params }: Params) {
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { weekStart } = await params;
@@ -26,8 +26,8 @@ export async function GET(_req: NextRequest, { params }: Params) {
return NextResponse.json(plan);
}
export async function POST(_req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
export async function POST(req: NextRequest, { params }: Params) {
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { weekStart } = await params;