arnaudne/Epicure
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

fix: close TOCTOU race + missing checks in tier limits, add AI rate limits, patch CVEs (v0.60.0)

Browse Source 
Security audit fixes (see SECURITY_AUDIT.md):
- lib/tiers.ts: checkAndIncrementTierLimit's recipe/storage branches did a
  live count/sum check with no lock tying it to the later write, so two
  concurrent requests near the cap could both pass and both write past the
  limit. Added checkTierLimitInTransaction — holds a per-user Postgres
  advisory lock for the duration of the caller's transaction, so the check
  and the write are atomic together. Applied to every recipe/storage write
  path (recipes create/update, fork, rate, avatar, and 7 AI recipe-creation
  routes).
- Adversarial re-verification of that fix caught a bigger gap in the same
  area: four AI routes (photo import, idea generation, batch-cook,
  translate-to-new-draft) had no recipe-limit check at all. Fixed.
- Added missing per-user rate limits to 5 AI endpoints (adapt, drinks,
  pairings, translate, variations) that had none, unlike their siblings.
- search page now checks for a session server-side, matching every other
  page under (app)/ — defense in depth; the underlying API was already
  public by design and proxy.ts already blocked unauthenticated requests.
- admin/settings route now uses the shared requireAdmin instead of a local
  duplicate.
- Documented two admin support-ticket endpoints missing from the OpenAPI
  spec; verified full route/OpenAPI parity otherwise.
- Bumped drizzle-orm to fix a SQL-identifier-escaping CVE, and overrode two
  transitive deps (esbuild, postcss) with known CVEs. pnpm audit is clean.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Arnaud
2026-07-20 22:21:51 +02:00
parent 623e5bcd34
commit 7626f1b496
31 changed files with 561 additions and 509 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/web/app/api/v1/recipes/[id]/fork/route.ts
+59 -60
View File
@@ -2,7 +2,7 @@ import { NextRequest, NextResponse } from "next/server";
import { db, recipes, recipeIngredients, recipeSteps, recipeVariations } from "@epicure/db";
import { eq, and, or, inArray } from "@epicure/db";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { checkAndIncrementTierLimit, TierLimitError } from "@/lib/tiers";
import { checkTierLimitInTransaction, TierLimitError } from "@/lib/tiers";
type Params = { params: Promise<{ id: string }> };
@@ -23,8 +23,65 @@ export async function POST(req: NextRequest, { params }: Params) {
});
if (!source) return NextResponse.json({ error: "Not found" }, { status: 404 });
const newId = crypto.randomUUID();
const now = new Date();
try {
await checkAndIncrementTierLimit(session!.user.id, session!.user.tier as "free" | "pro" | "family", "recipe");
await db.transaction(async (tx) => {
await checkTierLimitInTransaction(tx, session!.user.id, session!.user.tier as "free" | "pro" | "family", "recipe");
await tx.insert(recipes).values({
id: newId,
authorId: session!.user.id,
title: source.title,
description: source.description,
baseServings: source.baseServings,
visibility: "private",
difficulty: source.difficulty,
prepMins: source.prepMins,
cookMins: source.cookMins,
tags: source.tags,
dietaryTags: source.dietaryTags ?? {},
aiGenerated: false,
language: source.language,
createdAt: now,
updatedAt: now,
});
if (source.ingredients.length > 0) {
await tx.insert(recipeIngredients).values(
source.ingredients.map((ing) => ({
id: crypto.randomUUID(),
recipeId: newId,
rawName: ing.rawName,
quantity: ing.quantity,
unit: ing.unit,
note: ing.note,
order: ing.order,
}))
);
}
if (source.steps.length > 0) {
await tx.insert(recipeSteps).values(
source.steps.map((step) => ({
id: crypto.randomUUID(),
recipeId: newId,
instruction: step.instruction,
timerSeconds: step.timerSeconds,
order: step.order,
}))
);
}
await tx.insert(recipeVariations).values({
id: crypto.randomUUID(),
parentRecipeId: source.id,
childRecipeId: newId,
description: null,
aiGenerated: false,
createdAt: now,
});
});
} catch (err) {
if (err instanceof TierLimitError) {
return NextResponse.json({ error: "Recipe limit reached for your tier" }, { status: 403 });
@@ -32,63 +89,5 @@ export async function POST(req: NextRequest, { params }: Params) {
throw err;
}
const newId = crypto.randomUUID();
const now = new Date();
await db.transaction(async (tx) => {
await tx.insert(recipes).values({
id: newId,
authorId: session!.user.id,
title: source.title,
description: source.description,
baseServings: source.baseServings,
visibility: "private",
difficulty: source.difficulty,
prepMins: source.prepMins,
cookMins: source.cookMins,
tags: source.tags,
dietaryTags: source.dietaryTags ?? {},
aiGenerated: false,
language: source.language,
createdAt: now,
updatedAt: now,
});
if (source.ingredients.length > 0) {
await tx.insert(recipeIngredients).values(
source.ingredients.map((ing) => ({
id: crypto.randomUUID(),
recipeId: newId,
rawName: ing.rawName,
quantity: ing.quantity,
unit: ing.unit,
note: ing.note,
order: ing.order,
}))
);
}
if (source.steps.length > 0) {
await tx.insert(recipeSteps).values(
source.steps.map((step) => ({
id: crypto.randomUUID(),
recipeId: newId,
instruction: step.instruction,
timerSeconds: step.timerSeconds,
order: step.order,
}))
);
}
await tx.insert(recipeVariations).values({
id: crypto.randomUUID(),
parentRecipeId: source.id,
childRecipeId: newId,
description: null,
aiGenerated: false,
createdAt: now,
});
});
return NextResponse.json({ id: newId }, { status: 201 });
}
apps/web/app/api/v1/recipes/[id]/rate/route.ts
+39 -17
View File
@@ -4,6 +4,7 @@ import { db, recipes, ratings, eq, and } from "@epicure/db";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { createNotification } from "@/lib/notifications";
import { isOwnedReviewPhotoKey } from "@/lib/storage";
import { checkTierLimitInTransaction, TierLimitError } from "@/lib/tiers";
const Schema = z.object({
score: z.number().int().min(1).max(5),
@@ -39,28 +40,49 @@ export async function POST(req: NextRequest, { params }: Params) {
where: and(eq(ratings.recipeId, id), eq(ratings.userId, session!.user.id)),
});
if (existing) {
await db.update(ratings)
.set({
const newPhotoSizeMb = parsed.data.photoKey ? parsed.data.photoSizeMb : 0;
const photoSizeDeltaMb = newPhotoSizeMb - (existing?.photoSizeMb ?? 0);
try {
if (existing) {
await db.transaction(async (tx) => {
if (photoSizeDeltaMb > 0) {
await checkTierLimitInTransaction(tx, session!.user.id, session!.user.tier as "free" | "pro" | "family", "storage", photoSizeDeltaMb);
}
await tx.update(ratings)
.set({
score: parsed.data.score,
reviewText: parsed.data.reviewText,
photoKey: parsed.data.photoKey,
photoSizeMb: newPhotoSizeMb,
updatedAt: new Date(),
})
.where(eq(ratings.id, existing.id));
});
return NextResponse.json({ updated: true });
}
await db.transaction(async (tx) => {
if (photoSizeDeltaMb > 0) {
await checkTierLimitInTransaction(tx, session!.user.id, session!.user.tier as "free" | "pro" | "family", "storage", photoSizeDeltaMb);
}
await tx.insert(ratings).values({
id: crypto.randomUUID(),
recipeId: id,
userId: session!.user.id,
score: parsed.data.score,
reviewText: parsed.data.reviewText,
photoKey: parsed.data.photoKey,
photoSizeMb: parsed.data.photoKey ? parsed.data.photoSizeMb : 0,
updatedAt: new Date(),
})
.where(eq(ratings.id, existing.id));
return NextResponse.json({ updated: true });
photoSizeMb: newPhotoSizeMb,
});
});
} catch (err) {
if (err instanceof TierLimitError) {
return NextResponse.json({ error: "Storage limit reached for your tier" }, { status: 403 });
}
throw err;
}
await db.insert(ratings).values({
id: crypto.randomUUID(),
recipeId: id,
userId: session!.user.id,
score: parsed.data.score,
reviewText: parsed.data.reviewText,
photoKey: parsed.data.photoKey,
photoSizeMb: parsed.data.photoKey ? parsed.data.photoSizeMb : 0,
});
void createNotification({ userId: recipe.authorId, type: "rating", actorId: session!.user.id, recipeId: id, score: parsed.data.score });
return NextResponse.json({ created: true }, { status: 201 });
}
apps/web/app/api/v1/recipes/[id]/route.ts
+17 -2
View File
@@ -3,6 +3,7 @@ import { db, recipes, recipeIngredients, recipeSteps, recipePhotos, recipeBatchD
import { eq, and, max, isNotNull } from "@epicure/db";
import { z } from "zod";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { checkTierLimitInTransaction, TierLimitError } from "@/lib/tiers";
import { deleteObject, isOwnedRecipePhotoKey } from "@/lib/storage";
import { dispatchWebhook } from "@/lib/webhooks";
import { parseQuantity } from "@/lib/parse-quantity";
@@ -124,7 +125,15 @@ export async function PUT(req: NextRequest, { params }: Params) {
return NextResponse.json({ error: "Validation error", issues: [{ path: ["photos"], message: "Photo key not issued for this recipe" }] }, { status: 400 });
}
await db.transaction(async (tx) => {
const photosSizeDeltaMb = data.photos !== undefined
? data.photos.reduce((sum, p) => sum + p.sizeMb, 0) - existing.photos.reduce((sum, p) => sum + p.sizeMb, 0)
: 0;
try {
await db.transaction(async (tx) => {
if (photosSizeDeltaMb > 0) {
await checkTierLimitInTransaction(tx, session!.user.id, session!.user.tier as "free" | "pro" | "family", "storage", photosSizeDeltaMb);
}
// Create a snapshot of the current state before updating
const [maxVersionRow] = await tx
.select({ v: max(recipeSnapshots.version) })
@@ -248,7 +257,13 @@ export async function PUT(req: NextRequest, { params }: Params) {
);
}
}
});
});
} catch (err) {
if (err instanceof TierLimitError) {
return NextResponse.json({ error: "Storage limit reached for your tier" }, { status: 403 });
}
throw err;
}
if (data.photos !== undefined) {
const newKeys = new Set(data.photos.map((p) => p.key));
apps/web/app/api/v1/recipes/__tests__/route.test.ts
+3 -5
View File
@@ -12,8 +12,7 @@ vi.mock("@/lib/api-auth", () => ({
}));
vi.mock("@/lib/tiers", () => ({
checkAndIncrementTierLimit: vi.fn(),
incrementUsage: vi.fn(),
checkTierLimitInTransaction: vi.fn(),
TierLimitError: class TierLimitError extends Error {},
}));
@@ -134,9 +133,8 @@ describe("POST /api/v1/recipes", () => {
});
it("returns 403 when tier limit reached", async () => {
const { checkAndIncrementTierLimit } = await import("@/lib/tiers");
const { TierLimitError } = await import("@/lib/tiers");
vi.mocked(checkAndIncrementTierLimit).mockRejectedValue(new TierLimitError("recipe", "free"));
const { checkTierLimitInTransaction, TierLimitError } = await import("@/lib/tiers");
vi.mocked(checkTierLimitInTransaction).mockRejectedValue(new TierLimitError("recipe", "free"));
const res = await POST(makeRequest("POST", validRecipe));
expect(res.status).toBe(403);
apps/web/app/api/v1/recipes/route.ts
+15 -11
View File
@@ -4,7 +4,7 @@ import { eq, desc, and } from "@epicure/db";
import { z } from "zod";
import { requireSessionOrApiKey } from "@/lib/api-auth";
import { isOwnedRecipePhotoKey } from "@/lib/storage";
import { checkAndIncrementTierLimit, TierLimitError } from "@/lib/tiers";
import { checkTierLimitInTransaction, TierLimitError } from "@/lib/tiers";
import { dispatchWebhook } from "@/lib/webhooks";
import { parseQuantity } from "@/lib/parse-quantity";
import { extractIngredientQuantity } from "@/lib/extract-ingredient-quantity";
@@ -119,16 +119,14 @@ export async function POST(req: NextRequest) {
return NextResponse.json({ error: "Validation error", issues: [{ path: ["photos"], message: "Photo key not issued for this recipe" }] }, { status: 400 });
}
try {
await checkAndIncrementTierLimit(session!.user.id, session!.user.tier as "free" | "pro" | "family", "recipe");
} catch (err) {
if (err instanceof TierLimitError) {
return NextResponse.json({ error: "Recipe limit reached for your tier" }, { status: 403 });
}
throw err;
}
const photosSizeMb = data.photos.reduce((sum, p) => sum + p.sizeMb, 0);
await db.transaction(async (tx) => {
try {
await db.transaction(async (tx) => {
await checkTierLimitInTransaction(tx, session!.user.id, session!.user.tier as "free" | "pro" | "family", "recipe");
if (photosSizeMb > 0) {
await checkTierLimitInTransaction(tx, session!.user.id, session!.user.tier as "free" | "pro" | "family", "storage", photosSizeMb);
}
await tx.insert(recipes).values({
id,
authorId: session!.user.id,
@@ -209,7 +207,13 @@ export async function POST(req: NextRequest) {
}))
);
}
});
});
} catch (err) {
if (err instanceof TierLimitError) {
return NextResponse.json({ error: `${err.limit === "storage" ? "Storage" : "Recipe"} limit reached for your tier` }, { status: 403 });
}
throw err;
}
const recipe = await db.query.recipes.findFirst({ where: eq(recipes.id, id) });
void dispatchWebhook(session!.user.id, "recipe.created", { id, title: data.title });