arnaudne/Epicure
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

security: widen API-key auth to content/AI routes (v0.27.0)

Browse Source 
Convert requireSession -> requireSessionOrApiKey across recipes,
collections, meal-plans, shopping-lists, pantry, feed, and ai/*
(52 routes) so API keys work end-to-end, not just for the handful of
endpoints that supported them before. Scope was explicitly confirmed
per-resource-family with the user before any file was touched.

Left session-cookie-only, deliberately: users/me*, ai-keys/*,
webhooks/*, conversations/*, notifications/*, push/subscribe, admin/*
— account/credential-adjacent surface that shouldn't widen without a
separate, explicit decision.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Arnaud
2026-07-14 11:20:26 +02:00
parent 6c4fc93aab
commit 3e71bd29a2
56 changed files with 171 additions and 159 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/web/app/api/v1/recipes/[id]/comments/[commentId]/reactions/route.ts
+3 -3
View File
@@ -1,7 +1,7 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { db, comments, commentReactions, eq, and, count } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { applyRateLimit } from "@/lib/rate-limit";
import { createNotification } from "@/lib/notifications";
@@ -34,7 +34,7 @@ export async function GET(req: NextRequest, { params }: Params) {
// Optional auth — GET reactions is public; session present means also return user's own reactions
// response intentionally ignored: unauthenticated callers get counts only with empty userReactions
const { session } = await requireSession();
const { session } = await requireSessionOrApiKey(req);
let userReactions: string[] = [];
if (session) {
@@ -49,7 +49,7 @@ export async function GET(req: NextRequest, { params }: Params) {
}
export async function POST(req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const limited = await applyRateLimit(`rl:reaction:${session!.user.id}`, 60, 60);
apps/web/app/api/v1/recipes/[id]/comments/route.ts
+3 -3
View File
@@ -1,7 +1,7 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { db, recipes, comments, users, userBlocks, eq, and, inArray, isNull, sql } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { applyRateLimit } from "@/lib/rate-limit";
import { dispatchWebhook } from "@/lib/webhooks";
import { createNotification } from "@/lib/notifications";
@@ -34,7 +34,7 @@ export async function GET(req: NextRequest, { params }: Params) {
return NextResponse.json({ error: "Not found" }, { status: 404 });
}
const { session } = await requireSession();
const { session } = await requireSessionOrApiKey(req);
const { searchParams } = req.nextUrl;
const limitRaw = parseInt(searchParams.get("limit") ?? "20");
@@ -88,7 +88,7 @@ export async function GET(req: NextRequest, { params }: Params) {
}
export async function POST(req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
apps/web/app/api/v1/recipes/[id]/cooked/route.ts
+2 -2
View File
@@ -1,7 +1,7 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { db, recipes, cookingHistory, pantryItems, recipeIngredients, recipeBatchDishes, eq, and } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
type Params = { params: Promise<{ id: string }> };
@@ -13,7 +13,7 @@ const Schema = z.object({
});
export async function POST(req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
const userId = session!.user.id;
apps/web/app/api/v1/recipes/[id]/favorite/route.ts
+5 -5
View File
@@ -1,11 +1,11 @@
import { NextRequest, NextResponse } from "next/server";
import { db, recipes, favorites, eq, and } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
type Params = { params: Promise<{ id: string }> };
export async function POST(_req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
export async function POST(req: NextRequest, { params }: Params) {
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
@@ -18,8 +18,8 @@ export async function POST(_req: NextRequest, { params }: Params) {
return NextResponse.json({ favorited: true });
}
export async function DELETE(_req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
export async function DELETE(req: NextRequest, { params }: Params) {
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
apps/web/app/api/v1/recipes/[id]/nutrition/route.ts
+5 -5
View File
@@ -1,15 +1,15 @@
import { NextRequest, NextResponse } from "next/server";
import { db, recipes, recipeIngredients } from "@epicure/db";
import { eq, and, or, ne } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { applyRateLimit } from "@/lib/rate-limit";
import { withAiQuota } from "@/lib/ai/ai-error";
import { estimateNutrition } from "@/lib/ai/features/estimate-nutrition";
type Params = { params: Promise<{ id: string }> };
export async function GET(_req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
export async function GET(req: NextRequest, { params }: Params) {
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
@@ -28,8 +28,8 @@ export async function GET(_req: NextRequest, { params }: Params) {
return NextResponse.json({ nutrition: recipe.nutritionData ?? null });
}
export async function POST(_req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
export async function POST(req: NextRequest, { params }: Params) {
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
apps/web/app/api/v1/recipes/[id]/rate/route.ts
+2 -2
View File
@@ -1,7 +1,7 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { db, recipes, ratings, eq, and } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { createNotification } from "@/lib/notifications";
import { isOwnedReviewPhotoKey } from "@/lib/storage";
@@ -14,7 +14,7 @@ const Schema = z.object({
type Params = { params: Promise<{ id: string }> };
export async function POST(req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
apps/web/app/api/v1/recipes/[id]/reviews/route.ts
+3 -3
View File
@@ -1,11 +1,11 @@
import { NextRequest, NextResponse } from "next/server";
import { db, recipes, ratings, eq, and, or, inArray, desc } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
type Params = { params: Promise<{ id: string }> };
export async function GET(_req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
export async function GET(req: NextRequest, { params }: Params) {
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { id } = await params;
apps/web/app/api/v1/recipes/bulk/export/route.ts
+2 -2
View File
@@ -1,6 +1,6 @@
import { type NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { db, recipes, eq, and, inArray } from "@epicure/db";
import { recipeToMarkdown } from "@/lib/markdown/recipe";
@@ -9,7 +9,7 @@ const ExportSchema = z.object({
});
export async function POST(req: NextRequest) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const body = ExportSchema.safeParse(await req.json());
apps/web/app/api/v1/recipes/bulk/route.ts
+3 -3
View File
@@ -1,6 +1,6 @@
import { type NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { requireSession } from "@/lib/api-auth";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { db, recipes, eq, and, inArray } from "@epicure/db";
const BulkDeleteSchema = z.object({
@@ -15,7 +15,7 @@ const BulkUpdateSchema = z.object({
});
export async function DELETE(req: NextRequest) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const body = BulkDeleteSchema.safeParse(await req.json());
@@ -29,7 +29,7 @@ export async function DELETE(req: NextRequest) {
}
export async function PATCH(req: NextRequest) {
const { session, response } = await requireSession();
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const body = BulkUpdateSchema.safeParse(await req.json());