arnaudne/Epicure
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

fix: resolve TODO.md security/perf/test-coverage backlog

Browse Source 
Fixes the 13-item codebase health scan backlog: wraps meal-plan
generation in a transaction, adds missing userId/GIN indexes, fixes
an IPv6-parsing gap in the webhook SSRF guard (and an identical
duplicated bug in the AI URL-import path, now consolidated onto one
implementation), paginates the collections list, dedupes the AI
recipe Zod schemas, wires up Stripe tier sync, rate-limits AI key
rotation, gets `pnpm typecheck` actually working, and adds test
coverage for the previously-untested admin/webhooks routes.

Two flagged issues (collection removeRecipeId IDOR, tier-limit race)
turned out to already be fixed/non-issues on inspection — noted in
TODO.md rather than silently dropped.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Arnaud
2026-07-02 12:12:42 +02:00
parent 2154512e54
commit d2faf98ac1
38 changed files with 7598 additions and 315 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/web/lib/ai/__tests__/resolve-user-key.test.ts
+3 -3
View File
@@ -92,7 +92,7 @@ describe("withUserKey", () => {
vi.mocked(mockUserAiKeysFindMany); // just ensure mock is ready
// withUserKey uses findFirst via userAiKeys
const mockFindFirst = vi.fn().mockResolvedValue({ encryptedKey: encKey });
vi.mocked((await import("@epicure/db")).db.query.userAiKeys as unknown as { findFirst: typeof mockFindFirst }).findFirst = mockFindFirst;
((await import("@epicure/db")).db.query.userAiKeys as unknown as { findFirst: typeof mockFindFirst }).findFirst = mockFindFirst;
const config = await withUserKey("user1", { provider: "openai" });
expect(config.apiKey).toBe("sk-user-key");
@@ -100,7 +100,7 @@ describe("withUserKey", () => {
it("returns config unchanged when no user key for provider", async () => {
const mockFindFirst = vi.fn().mockResolvedValue(null);
vi.mocked((await import("@epicure/db")).db.query.userAiKeys as unknown as { findFirst: typeof mockFindFirst }).findFirst = mockFindFirst;
((await import("@epicure/db")).db.query.userAiKeys as unknown as { findFirst: typeof mockFindFirst }).findFirst = mockFindFirst;
const config = await withUserKey("user1", { provider: "anthropic" });
expect(config.apiKey).toBeUndefined();
@@ -118,7 +118,7 @@ describe("getModelConfigForUseCase", () => {
mealPlanModel: null,
});
const mockFindFirst = vi.fn().mockResolvedValue(null); // no BYOK key
vi.mocked((await import("@epicure/db")).db.query.userAiKeys as unknown as { findFirst: typeof mockFindFirst }).findFirst = mockFindFirst;
((await import("@epicure/db")).db.query.userAiKeys as unknown as { findFirst: typeof mockFindFirst }).findFirst = mockFindFirst;
const config = await getModelConfigForUseCase("user1", "text");
expect(config.provider).toBe("anthropic");