fix: resolve TODO.md security/perf/test-coverage backlog

Fixes the 13-item codebase health scan backlog: wraps meal-plan
generation in a transaction, adds missing userId/GIN indexes, fixes
an IPv6-parsing gap in the webhook SSRF guard (and an identical
duplicated bug in the AI URL-import path, now consolidated onto one
implementation), paginates the collections list, dedupes the AI
recipe Zod schemas, wires up Stripe tier sync, rate-limits AI key
rotation, gets `pnpm typecheck` actually working, and adds test
coverage for the previously-untested admin/webhooks routes.

Two flagged issues (collection removeRecipeId IDOR, tier-limit race)
turned out to already be fixed/non-issues on inspection — noted in
TODO.md rather than silently dropped.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

This commit is contained in:

Arnaud

2026-07-02 12:12:42 +02:00

parent 2154512e54

commit d2faf98ac1

38 changed files with 7598 additions and 315 deletions

									
										packages/db/tsconfig.json
									
		+2
		-1
	
												View File
												
				@@ -2,7 +2,8 @@

				  "extends": "../../tsconfig.base.json",

				  "compilerOptions": {

				    "outDir": "./dist",

				    "rootDir": "./src"

				    "rootDir": "./src",

				    "types": ["node"]

				  },

				  "include": ["src"]

				}