fix: close SSRF/rebinding, IDOR, and stale-session authz gaps found in audit

Bump to 0.5.1. Fixes: unfollowed-redirect SSRF + DNS-rebinding in AI
url-import and webhook dispatch (new safeFetch with IP-pinned undici
dispatcher); cross-user photo deletion via unvalidated recipe/review
storage keys; comment-moderation and tier-quota checks trusting a
stale cached session role/tier instead of the DB.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/api/v1/recipes/[id]/rate/route.ts

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { db, recipes, ratings, eq, and } from "@epicure/db";
 import { requireSession } from "@/lib/api-auth";
 import { createNotification } from "@/lib/notifications";
+import { isOwnedReviewPhotoKey } from "@/lib/storage";
 
 const Schema = z.object({
   score: z.number().int().min(1).max(5),
@@ -29,6 +30,10 @@ export async function POST(req: NextRequest, { params }: Params) {
   const parsed = Schema.safeParse(body);
   if (!parsed.success) return NextResponse.json({ error: "Validation error" }, { status: 400 });
 
+  if (parsed.data.photoKey && !isOwnedReviewPhotoKey(parsed.data.photoKey, id, session!.user.id)) {
+    return NextResponse.json({ error: "Validation error", issues: [{ path: ["photoKey"], message: "Photo key not issued for this review" }] }, { status: 400 });
+  }
+
   const existing = await db.query.ratings.findFirst({
     where: and(eq(ratings.recipeId, id), eq(ratings.userId, session!.user.id)),
   });

apps/web/app/api/v1/recipes/[id]/route.ts

@@ -3,7 +3,7 @@ import { db, recipes, recipeIngredients, recipeSteps, recipePhotos, recipeBatchD
 import { eq, and, max, isNotNull } from "@epicure/db";
 import { z } from "zod";
 import { requireSessionOrApiKey } from "@/lib/api-auth";
-import { deleteObject } from "@/lib/storage";
+import { deleteObject, isOwnedRecipePhotoKey } from "@/lib/storage";
 import { dispatchWebhook } from "@/lib/webhooks";
 import { parseQuantity } from "@/lib/parse-quantity";
 import { extractIngredientQuantity } from "@/lib/extract-ingredient-quantity";
@@ -106,6 +106,10 @@ export async function PUT(req: NextRequest, { params }: Params) {
 
   const data = parsed.data;
 
+  if (data.photos?.some((p) => !isOwnedRecipePhotoKey(p.key, id, session!.user.id))) {
+    return NextResponse.json({ error: "Validation error", issues: [{ path: ["photos"], message: "Photo key not issued for this recipe" }] }, { status: 400 });
+  }
+
   await db.transaction(async (tx) => {
     // Create a snapshot of the current state before updating
     const [maxVersionRow] = await tx

apps/web/app/api/v1/recipes/route.ts

@@ -3,6 +3,7 @@ import { db, recipes, recipeIngredients, recipeSteps, recipePhotos, recipeBatchD
 import { eq, desc, and } from "@epicure/db";
 import { z } from "zod";
 import { requireSessionOrApiKey } from "@/lib/api-auth";
+import { isOwnedRecipePhotoKey } from "@/lib/storage";
 import { checkAndIncrementTierLimit, TierLimitError } from "@/lib/tiers";
 import { dispatchWebhook } from "@/lib/webhooks";
 import { parseQuantity } from "@/lib/parse-quantity";
@@ -93,6 +94,14 @@ export async function POST(req: NextRequest) {
     return NextResponse.json({ error: "Validation error", issues: parsed.error.issues }, { status: 400 });
   }
 
+  const id = crypto.randomUUID();
+  const now = new Date();
+  const data = parsed.data;
+
+  if (data.photos.some((p) => !isOwnedRecipePhotoKey(p.key, id, session!.user.id))) {
+    return NextResponse.json({ error: "Validation error", issues: [{ path: ["photos"], message: "Photo key not issued for this recipe" }] }, { status: 400 });
+  }
+
   try {
     await checkAndIncrementTierLimit(session!.user.id, session!.user.tier as "free" | "pro", "recipe");
   } catch (err) {
@@ -102,10 +111,6 @@ export async function POST(req: NextRequest) {
     throw err;
   }
 
-  const id = crypto.randomUUID();
-  const now = new Date();
-  const data = parsed.data;
-
   await db.transaction(async (tx) => {
     await tx.insert(recipes).values({
       id,