fix: close TOCTOU race + missing checks in tier limits, add AI rate limits, patch CVEs (v0.60.0)

Security audit fixes (see SECURITY_AUDIT.md):
- lib/tiers.ts: checkAndIncrementTierLimit's recipe/storage branches did a
  live count/sum check with no lock tying it to the later write, so two
  concurrent requests near the cap could both pass and both write past the
  limit. Added checkTierLimitInTransaction — holds a per-user Postgres
  advisory lock for the duration of the caller's transaction, so the check
  and the write are atomic together. Applied to every recipe/storage write
  path (recipes create/update, fork, rate, avatar, and 7 AI recipe-creation
  routes).
- Adversarial re-verification of that fix caught a bigger gap in the same
  area: four AI routes (photo import, idea generation, batch-cook,
  translate-to-new-draft) had no recipe-limit check at all. Fixed.
- Added missing per-user rate limits to 5 AI endpoints (adapt, drinks,
  pairings, translate, variations) that had none, unlike their siblings.
- search page now checks for a session server-side, matching every other
  page under (app)/ — defense in depth; the underlying API was already
  public by design and proxy.ts already blocked unauthenticated requests.
- admin/settings route now uses the shared requireAdmin instead of a local
  duplicate.
- Documented two admin support-ticket endpoints missing from the OpenAPI
  spec; verified full route/OpenAPI parity otherwise.
- Bumped drizzle-orm to fix a SQL-identifier-escaping CVE, and overrode two
  transitive deps (esbuild, postcss) with known CVEs. pnpm audit is clean.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

This commit is contained in:

Arnaud

2026-07-20 22:21:51 +02:00

parent 623e5bcd34

commit 7626f1b496

31 changed files with 561 additions and 509 deletions

									
										apps/web/app/(app)/search/page.tsx
									
		+5
		
												View File
												
				@@ -1,8 +1,13 @@

				import { headers } from "next/headers";

				import { auth } from "@/lib/auth/server";

				import { SearchPageContent } from "@/components/search/search-page-content";

				type Params = { searchParams: Promise<{ q?: string; difficulty?: string; dietary?: string }> };

				export default async function SearchPage({ searchParams }: Params) {

				  const session = await auth.api.getSession({ headers: await headers() });

				  if (!session) return null;

				  const { q } = await searchParams;

				  return <SearchPageContent initialQuery={q ?? ""} />;

				}