Update features and dependencies

apps/web/app/api/v1/upload/presign/route.ts

@@ -2,6 +2,7 @@ import { NextRequest, NextResponse } from "next/server";
 import { z } from "zod";
 import { requireSession } from "@/lib/api-auth";
 import { createPresignedUploadUrl } from "@/lib/storage";
+import { db, recipes, eq, and } from "@epicure/db";
 
 const ALLOWED_TYPES = ["image/jpeg", "image/png", "image/webp", "image/avif"] as const;
 type AllowedType = (typeof ALLOWED_TYPES)[number];
@@ -23,6 +24,12 @@ export async function POST(req: NextRequest) {
     return NextResponse.json({ error: "Validation error", issues: parsed.error.issues }, { status: 400 });
   }
 
+  const owned = await db.query.recipes.findFirst({
+    where: and(eq(recipes.id, parsed.data.recipeId), eq(recipes.authorId, session!.user.id)),
+    columns: { id: true },
+  });
+  if (!owned) return NextResponse.json({ error: "Not found" }, { status: 404 });
+
   const ext = parsed.data.contentType.split("/")[1] ?? "jpg";
   const key = `recipes/${parsed.data.recipeId}/photos/${session!.user.id}-${crypto.randomUUID()}.${ext}`;
   const url = await createPresignedUploadUrl(key, parsed.data.contentType);