fix: close SSRF/rebinding, IDOR, and stale-session authz gaps found in audit

Bump to 0.5.1. Fixes: unfollowed-redirect SSRF + DNS-rebinding in AI
url-import and webhook dispatch (new safeFetch with IP-pinned undici
dispatcher); cross-user photo deletion via unvalidated recipe/review
storage keys; comment-moderation and tier-quota checks trusting a
stale cached session role/tier instead of the DB.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/api/v1/comments/[id]/route.ts

@@ -1,6 +1,6 @@
 import { NextRequest, NextResponse } from "next/server";
 import { z } from "zod";
-import { db, comments, eq, and } from "@epicure/db";
+import { db, comments, users, eq } from "@epicure/db";
 import { requireSession } from "@/lib/api-auth";
 
 type Params = { params: Promise<{ id: string }> };
@@ -30,8 +30,17 @@ export async function DELETE(_req: NextRequest, { params }: Params) {
 
   const comment = await db.query.comments.findFirst({ where: eq(comments.id, id) });
   if (!comment) return NextResponse.json({ error: "Not found" }, { status: 404 });
-  if (comment.userId !== session!.user.id && session!.user.role === "user") {
-    return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+  if (comment.userId !== session!.user.id) {
+    // session.user.role comes from a 5-minute cookieCache — a just-demoted
+    // moderator/admin would keep access for up to 5 minutes. Re-query fresh.
+    const [dbUser] = await db
+      .select({ role: users.role })
+      .from(users)
+      .where(eq(users.id, session!.user.id))
+      .limit(1);
+    if (dbUser?.role !== "admin" && dbUser?.role !== "moderator") {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+    }
   }
 
   await db.delete(comments).where(eq(comments.id, id));

apps/web/app/api/v1/recipes/[id]/rate/route.ts

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { db, recipes, ratings, eq, and } from "@epicure/db";
 import { requireSession } from "@/lib/api-auth";
 import { createNotification } from "@/lib/notifications";
+import { isOwnedReviewPhotoKey } from "@/lib/storage";
 
 const Schema = z.object({
   score: z.number().int().min(1).max(5),
@@ -29,6 +30,10 @@ export async function POST(req: NextRequest, { params }: Params) {
   const parsed = Schema.safeParse(body);
   if (!parsed.success) return NextResponse.json({ error: "Validation error" }, { status: 400 });
 
+  if (parsed.data.photoKey && !isOwnedReviewPhotoKey(parsed.data.photoKey, id, session!.user.id)) {
+    return NextResponse.json({ error: "Validation error", issues: [{ path: ["photoKey"], message: "Photo key not issued for this review" }] }, { status: 400 });
+  }
+
   const existing = await db.query.ratings.findFirst({
     where: and(eq(ratings.recipeId, id), eq(ratings.userId, session!.user.id)),
   });

apps/web/app/api/v1/recipes/[id]/route.ts

@@ -3,7 +3,7 @@ import { db, recipes, recipeIngredients, recipeSteps, recipePhotos, recipeBatchD
 import { eq, and, max, isNotNull } from "@epicure/db";
 import { z } from "zod";
 import { requireSessionOrApiKey } from "@/lib/api-auth";
-import { deleteObject } from "@/lib/storage";
+import { deleteObject, isOwnedRecipePhotoKey } from "@/lib/storage";
 import { dispatchWebhook } from "@/lib/webhooks";
 import { parseQuantity } from "@/lib/parse-quantity";
 import { extractIngredientQuantity } from "@/lib/extract-ingredient-quantity";
@@ -106,6 +106,10 @@ export async function PUT(req: NextRequest, { params }: Params) {
 
   const data = parsed.data;
 
+  if (data.photos?.some((p) => !isOwnedRecipePhotoKey(p.key, id, session!.user.id))) {
+    return NextResponse.json({ error: "Validation error", issues: [{ path: ["photos"], message: "Photo key not issued for this recipe" }] }, { status: 400 });
+  }
+
   await db.transaction(async (tx) => {
     // Create a snapshot of the current state before updating
     const [maxVersionRow] = await tx

apps/web/app/api/v1/recipes/route.ts

@@ -3,6 +3,7 @@ import { db, recipes, recipeIngredients, recipeSteps, recipePhotos, recipeBatchD
 import { eq, desc, and } from "@epicure/db";
 import { z } from "zod";
 import { requireSessionOrApiKey } from "@/lib/api-auth";
+import { isOwnedRecipePhotoKey } from "@/lib/storage";
 import { checkAndIncrementTierLimit, TierLimitError } from "@/lib/tiers";
 import { dispatchWebhook } from "@/lib/webhooks";
 import { parseQuantity } from "@/lib/parse-quantity";
@@ -93,6 +94,14 @@ export async function POST(req: NextRequest) {
     return NextResponse.json({ error: "Validation error", issues: parsed.error.issues }, { status: 400 });
   }
 
+  const id = crypto.randomUUID();
+  const now = new Date();
+  const data = parsed.data;
+
+  if (data.photos.some((p) => !isOwnedRecipePhotoKey(p.key, id, session!.user.id))) {
+    return NextResponse.json({ error: "Validation error", issues: [{ path: ["photos"], message: "Photo key not issued for this recipe" }] }, { status: 400 });
+  }
+
   try {
     await checkAndIncrementTierLimit(session!.user.id, session!.user.tier as "free" | "pro", "recipe");
   } catch (err) {
@@ -102,10 +111,6 @@ export async function POST(req: NextRequest) {
     throw err;
   }
 
-  const id = crypto.randomUUID();
-  const now = new Date();
-  const data = parsed.data;
-
   await db.transaction(async (tx) => {
     await tx.insert(recipes).values({
       id,