Arnaud
362f65656b
Full audit (bugs/UI-UX/backend/feature-gap) turned up a money-leak AI quota bypass, webhook SSRF, and a long tail of missing pagination/auth/a11y work. Fixes land together since HANDOFF.md tracked them as one backlog. - AI routes charge tier quota before generating; nutrition POST is author-only - Webhook dispatch re-validates URL per delivery (SSRF/DNS-rebinding), treats redirects as failures; recipe.published now actually dispatches - New indexes/unique constraints on recipes, meal-planning, comments FK cascade - Recipe PUT/restore snapshot only inside the transaction, after validation - Recipe DELETE cleans up S3 objects (recipe + review photos) - Optimistic UI (favorite/star/follow/shopping-list) rolls back on failure - Upload presign enforces file size cap + per-tier storage quota - Route-level loading/error/not-found states across (app), admin, and root - middleware.ts guards (app)/admin; requireAdmin checks DB role, not cached session; rate limiting applied to both session and API-key branches, bucketed per key; Stripe webhook dedupes by event id - Pagination added to recipes, feed, profile, comments, pantry, admin tables - Nav shows real avatar + profile link + dark-mode toggle; destructive actions standardized on AlertDialog - Unsaved-changes guard + real ingredient/step validation on recipe form; canonical /recipes/[id] used in-app; next/image migration; aria-labels and alt text across icon buttons, avatars, recipe photos - packages/api-types removed (zero callers, too drifted to safely rewire); openapi.ts and ai-keys error shape drift fixed; BYOK decrypt failures now surface instead of silently falling back to the platform key Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
45 lines
2.0 KiB
TypeScript
45 lines
2.0 KiB
TypeScript
import { notFound } from "next/navigation";
|
|
import { headers } from "next/headers";
|
|
import Link from "next/link";
|
|
import { auth } from "@/lib/auth/server";
|
|
import { db, conversations, users, eq } from "@epicure/db";
|
|
import { ConversationsList } from "@/components/social/conversations-list";
|
|
import { MessageThread } from "@/components/social/message-thread";
|
|
import { Avatar, AvatarFallback, AvatarImage } from "@/components/ui/avatar";
|
|
import { isParticipant, otherParticipantId } from "@/lib/messaging";
|
|
|
|
type Params = { params: Promise<{ id: string }> };
|
|
|
|
export default async function ConversationPage({ params }: Params) {
|
|
const { id } = await params;
|
|
const session = await auth.api.getSession({ headers: await headers() });
|
|
if (!session) return null;
|
|
|
|
const conversation = await db.query.conversations.findFirst({ where: eq(conversations.id, id) });
|
|
if (!conversation || !isParticipant(conversation, session.user.id)) notFound();
|
|
|
|
const otherId = otherParticipantId(conversation, session.user.id);
|
|
const other = await db.query.users.findFirst({ where: eq(users.id, otherId) });
|
|
if (!other) notFound();
|
|
|
|
return (
|
|
<div className="max-w-5xl mx-auto h-[calc(100vh-8rem)] border rounded-xl overflow-hidden flex">
|
|
<div className="hidden sm:block w-80 border-r shrink-0 overflow-y-auto">
|
|
<ConversationsList />
|
|
</div>
|
|
<div className="flex-1 flex flex-col min-w-0">
|
|
<div className="border-b p-3 flex items-center gap-3">
|
|
<Link href={`/u/${other.username}`} className="flex items-center gap-3">
|
|
<Avatar className="h-8 w-8">
|
|
{other.avatarUrl && <AvatarImage src={other.avatarUrl} alt={other.name} />}
|
|
<AvatarFallback className="text-xs">{other.name.slice(0, 2).toUpperCase()}</AvatarFallback>
|
|
</Avatar>
|
|
<span className="font-medium text-sm hover:underline">{other.name}</span>
|
|
</Link>
|
|
</div>
|
|
<MessageThread conversationId={id} currentUserId={session.user.id} />
|
|
</div>
|
|
</div>
|
|
);
|
|
}
|