feat: push+email notifications, recipe notes, fork/clone, pantry-aware lists, GDPR export

Five S-sized items from HANDOFF.md's new-features backlog, all wiring up previously-orphaned infra: - createNotification now sends web push + email for every notification type (follow/comment/reply/reaction/rating/mention), not just comments - Personal recipe notes: private per-user notes on any viewable recipe (recipeNotes table had zero API/UI before this) - Recipe fork/clone: deep-copies a viewable recipe into your own library as a private draft, linked via recipeVariations, respects tier quota - Pantry-aware shopping lists: meal-plan-generated lists now subtract on-hand pantry quantities (ingredientId match, falling back to normalized name match) and flag partial/ambiguous matches instead of guessing - GDPR data export: downloadable JSON of a user's own content and activity across every relevant table, secrets/internal tables excluded New migrations 0025 (unique index for recipe-notes upsert) and 0026 (shopping_list_items.in_pantry) generated, left unapplied like 0023/0024. Verified with typecheck, lint, and a full local `docker build`. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-10 07:50:58 +02:00
parent d035378520
commit 45b886e398
23 changed files with 9813 additions and 23 deletions
@@ -0,0 +1,76 @@
+import { NextRequest, NextResponse } from "next/server";
+import { db, recipes, recipeNotes, eq, and, or, inArray } from "@epicure/db";
+import { z } from "zod";
+import { requireSessionOrApiKey } from "@/lib/api-auth";
+
+type Params = { params: Promise<{ id: string }> };
+
+const PutSchema = z.object({
+  content: z.string().max(5000),
+});
+
+async function assertRecipeAccessible(recipeId: string, userId: string) {
+  const recipe = await db.query.recipes.findFirst({
+    where: and(
+      eq(recipes.id, recipeId),
+      or(eq(recipes.authorId, userId), inArray(recipes.visibility, ["public", "unlisted"]))
+    ),
+    columns: { id: true },
+  });
+  return recipe;
+}
+
+export async function GET(req: NextRequest, { params }: Params) {
+  const { session, response } = await requireSessionOrApiKey(req, { rateLimit: { limit: 60, windowSeconds: 60 } });
+  if (response) return response;
+  const { id } = await params;
+
+  const recipe = await assertRecipeAccessible(id, session!.user.id);
+  if (!recipe) return NextResponse.json({ error: "Not found" }, { status: 404 });
+
+  const note = await db.query.recipeNotes.findFirst({
+    where: and(eq(recipeNotes.recipeId, id), eq(recipeNotes.userId, session!.user.id)),
+    columns: { content: true, updatedAt: true },
+  });
+
+  return NextResponse.json({ note: note ?? null });
+}
+
+export async function PUT(req: NextRequest, { params }: Params) {
+  const { session, response } = await requireSessionOrApiKey(req, { rateLimit: { limit: 60, windowSeconds: 60 } });
+  if (response) return response;
+  const { id } = await params;
+
+  const recipe = await assertRecipeAccessible(id, session!.user.id);
+  if (!recipe) return NextResponse.json({ error: "Not found" }, { status: 404 });
+
+  const parsed = PutSchema.safeParse(await req.json());
+  if (!parsed.success) {
+    return NextResponse.json({ error: "Validation error", issues: parsed.error.issues }, { status: 400 });
+  }
+
+  const content = parsed.data.content.trim();
+  const userId = session!.user.id;
+
+  if (content.length === 0) {
+    await db
+      .delete(recipeNotes)
+      .where(and(eq(recipeNotes.recipeId, id), eq(recipeNotes.userId, userId)));
+    return NextResponse.json({ note: null });
+  }
+
+  await db
+    .insert(recipeNotes)
+    .values({ id: crypto.randomUUID(), recipeId: id, userId, content, updatedAt: new Date() })
+    .onConflictDoUpdate({
+      target: [recipeNotes.recipeId, recipeNotes.userId],
+      set: { content, updatedAt: new Date() },
+    });
+
+  const note = await db.query.recipeNotes.findFirst({
+    where: and(eq(recipeNotes.recipeId, id), eq(recipeNotes.userId, userId)),
+    columns: { content: true, updatedAt: true },
+  });
+
+  return NextResponse.json({ note });
+}