arnaudne/Epicure
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add "cooked it" photo reviews

Browse Source 
Users can rate a recipe with review text and an optional photo. Adds
ratings.photo_key column, a reviews list endpoint, and a review-purpose
presign path (reviewer isn't the recipe owner, so the upload
authorization differs from cover-photo uploads).

Also fixes CSP connect-src/img-src to allow the storage origin —
direct-to-S3/MinIO presigned uploads and stored images were silently
blocked by Content-Security-Policy in the browser.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Arnaud
2026-07-09 15:20:05 +02:00
parent a8406e9963
commit f2a0c20f07
12 changed files with 4507 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/web/app/api/v1/upload/presign/route.ts
+15 -7
View File
@@ -12,6 +12,7 @@ const Schema = z.object({
message: "Content type must be jpeg, png, webp, or avif",
}),
recipeId: z.string().uuid(),
purpose: z.enum(["recipe", "review"]).default("recipe"),
});
export async function POST(req: NextRequest) {
@@ -24,15 +25,22 @@ export async function POST(req: NextRequest) {
return NextResponse.json({ error: "Validation error", issues: parsed.error.issues }, { status: 400 });
}
const owned = await db.query.recipes.findFirst({
where: and(eq(recipes.id, parsed.data.recipeId), eq(recipes.authorId, session!.user.id)),
columns: { id: true },
const { recipeId, contentType, purpose } = parsed.data;
const recipe = await db.query.recipes.findFirst({
where: purpose === "recipe"
? and(eq(recipes.id, recipeId), eq(recipes.authorId, session!.user.id))
: eq(recipes.id, recipeId),
columns: { id: true, visibility: true, authorId: true },
});
if (!owned) return NextResponse.json({ error: "Not found" }, { status: 404 });
if (!recipe) return NextResponse.json({ error: "Not found" }, { status: 404 });
if (purpose === "review" && recipe.visibility === "private" && recipe.authorId !== session!.user.id) {
return NextResponse.json({ error: "Not found" }, { status: 404 });
}
const ext = parsed.data.contentType.split("/")[1] ?? "jpg";
const key = `recipes/${parsed.data.recipeId}/photos/${session!.user.id}-${crypto.randomUUID()}.${ext}`;
const url = await createPresignedUploadUrl(key, parsed.data.contentType);
const ext = contentType.split("/")[1] ?? "jpg";
const folder = purpose === "review" ? "reviews" : "photos";
const key = `recipes/${recipeId}/${folder}/${session!.user.id}-${crypto.randomUUID()}.${ext}`;
const url = await createPresignedUploadUrl(key, contentType);
return NextResponse.json({ url, key });
}