Files
Epicure/apps/web/app/api/v1/meal-plans/[weekStart]/route.ts
T
Arnaud 3e71bd29a2 security: widen API-key auth to content/AI routes (v0.27.0)
Convert requireSession -> requireSessionOrApiKey across recipes,
collections, meal-plans, shopping-lists, pantry, feed, and ai/*
(52 routes) so API keys work end-to-end, not just for the handful of
endpoints that supported them before. Scope was explicitly confirmed
per-resource-family with the user before any file was touched.

Left session-cookie-only, deliberately: users/me*, ai-keys/*,
webhooks/*, conversations/*, notifications/*, push/subscribe, admin/*
— account/credential-adjacent surface that shouldn't widen without a
separate, explicit decision.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-14 11:20:26 +02:00

44 lines
1.4 KiB
TypeScript

import { NextRequest, NextResponse } from "next/server";
import { db, mealPlans, eq, and } from "@epicure/db";
import { requireSessionOrApiKey } from "@/lib/api-auth";
type Params = { params: Promise<{ weekStart: string }> };
export async function GET(req: NextRequest, { params }: Params) {
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { weekStart } = await params;
const plan = await db.query.mealPlans.findFirst({
where: and(eq(mealPlans.userId, session!.user.id), eq(mealPlans.weekStart, weekStart)),
with: {
entries: {
with: {
recipe: {
with: { photos: true },
},
},
},
},
});
if (!plan) return NextResponse.json({ weekStart, entries: [] });
return NextResponse.json(plan);
}
export async function POST(req: NextRequest, { params }: Params) {
const { session, response } = await requireSessionOrApiKey(req);
if (response) return response;
const { weekStart } = await params;
const existing = await db.query.mealPlans.findFirst({
where: and(eq(mealPlans.userId, session!.user.id), eq(mealPlans.weekStart, weekStart)),
});
if (existing) return NextResponse.json(existing);
const id = crypto.randomUUID();
await db.insert(mealPlans).values({ id, userId: session!.user.id, weekStart });
return NextResponse.json({ id, weekStart }, { status: 201 });
}