Files
Epicure/apps/web/components/recipe/recipe-chat-panel.tsx
T
Arnaud 362f65656b fix: audit fixes — tier-quota bypass, webhook SSRF, auth hardening, pagination, a11y
Full audit (bugs/UI-UX/backend/feature-gap) turned up a money-leak AI quota
bypass, webhook SSRF, and a long tail of missing pagination/auth/a11y work.
Fixes land together since HANDOFF.md tracked them as one backlog.

- AI routes charge tier quota before generating; nutrition POST is author-only
- Webhook dispatch re-validates URL per delivery (SSRF/DNS-rebinding), treats
  redirects as failures; recipe.published now actually dispatches
- New indexes/unique constraints on recipes, meal-planning, comments FK cascade
- Recipe PUT/restore snapshot only inside the transaction, after validation
- Recipe DELETE cleans up S3 objects (recipe + review photos)
- Optimistic UI (favorite/star/follow/shopping-list) rolls back on failure
- Upload presign enforces file size cap + per-tier storage quota
- Route-level loading/error/not-found states across (app), admin, and root
- middleware.ts guards (app)/admin; requireAdmin checks DB role, not cached
  session; rate limiting applied to both session and API-key branches,
  bucketed per key; Stripe webhook dedupes by event id
- Pagination added to recipes, feed, profile, comments, pantry, admin tables
- Nav shows real avatar + profile link + dark-mode toggle; destructive actions
  standardized on AlertDialog
- Unsaved-changes guard + real ingredient/step validation on recipe form;
  canonical /recipes/[id] used in-app; next/image migration; aria-labels and
  alt text across icon buttons, avatars, recipe photos
- packages/api-types removed (zero callers, too drifted to safely rewire);
  openapi.ts and ai-keys error shape drift fixed; BYOK decrypt failures now
  surface instead of silently falling back to the platform key

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-09 21:50:35 +02:00

182 lines
6.3 KiB
TypeScript

"use client";
import { useState, useRef, useEffect } from "react";
import { useTranslations } from "next-intl";
import { Button } from "@/components/ui/button";
import { Input } from "@/components/ui/input";
import { Sheet, SheetContent, SheetHeader, SheetTitle } from "@/components/ui/sheet";
import { MessageCircle, Send, Bot, User } from "lucide-react";
import ReactMarkdown from "react-markdown";
import { cn } from "@/lib/utils";
type Message = {
role: "user" | "assistant";
content: string;
};
type Props = {
recipeId: string;
recipeTitle: string;
};
export function RecipeChatPanel({ recipeId, recipeTitle }: Props) {
const t = useTranslations("recipeChat");
const [open, setOpen] = useState(false);
const [messages, setMessages] = useState<Message[]>([]);
const [input, setInput] = useState("");
const [loading, setLoading] = useState(false);
const bottomRef = useRef<HTMLDivElement>(null);
useEffect(() => {
if (open && bottomRef.current) {
bottomRef.current.scrollIntoView({ behavior: "smooth" });
}
}, [messages, open]);
const handleSubmit = async (e: React.FormEvent) => {
e.preventDefault();
const question = input.trim();
if (!question || loading) return;
setInput("");
setMessages((prev) => [...prev, { role: "user", content: question }]);
setLoading(true);
try {
const res = await fetch("/api/v1/ai/recipe-chat", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({ recipeId, question }),
});
const data = await res.json() as { answer?: string; error?: string };
setMessages((prev) => [
...prev,
{ role: "assistant", content: data.answer ?? t("sorry") },
]);
} catch {
setMessages((prev) => [
...prev,
{ role: "assistant", content: t("error") },
]);
} finally {
setLoading(false);
}
};
const suggestions = [
t("suggestion1"),
t("suggestion2"),
t("suggestion3"),
t("suggestion4"),
];
return (
<>
<Button
variant="default"
size="icon"
className="fixed bottom-6 right-6 h-12 w-12 rounded-full shadow-lg z-40"
onClick={() => setOpen(true)}
aria-label={t("ariaLabel")}
>
<MessageCircle className="h-5 w-5" />
</Button>
<Sheet open={open} onOpenChange={setOpen}>
<SheetContent side="right" className="w-full sm:w-[420px] flex flex-col p-0">
<SheetHeader className="px-4 py-3 pr-10 border-b shrink-0">
<SheetTitle className="text-base flex items-center gap-2">
<Bot className="h-4 w-4 text-primary" />
{t("title")}
</SheetTitle>
<p className="text-xs text-muted-foreground text-left">{recipeTitle}</p>
</SheetHeader>
<div className="flex-1 overflow-y-auto px-4 py-4 space-y-4 min-h-0">
{messages.length === 0 && (
<div className="space-y-3">
<p className="text-sm text-muted-foreground text-center py-4">
{t("intro")}
</p>
<div className="space-y-2">
{suggestions.map((s) => (
<button
key={s}
onClick={() => setInput(s)}
className="w-full text-left text-sm px-3 py-2 rounded-lg border bg-muted/50 hover:bg-muted transition-colors"
>
{s}
</button>
))}
</div>
</div>
)}
{messages.map((msg, i) => (
<div
key={i}
className={cn(
"flex gap-2 items-start",
msg.role === "user" && "flex-row-reverse"
)}
>
<div className={cn(
"h-7 w-7 shrink-0 rounded-full flex items-center justify-center",
msg.role === "user"
? "bg-primary text-primary-foreground"
: "bg-muted text-muted-foreground"
)}>
{msg.role === "user" ? <User className="h-3.5 w-3.5" /> : <Bot className="h-3.5 w-3.5" />}
</div>
<div className={cn(
"rounded-xl px-3 py-2 text-sm max-w-[80%] leading-relaxed",
msg.role === "user"
? "bg-primary text-primary-foreground whitespace-pre-wrap"
: "bg-muted space-y-2 [&_ul]:list-disc [&_ol]:list-decimal [&_ul]:pl-4 [&_ol]:pl-4 [&_strong]:font-semibold [&_li]:my-0.5"
)}>
{msg.role === "assistant" ? (
<ReactMarkdown>{msg.content}</ReactMarkdown>
) : (
msg.content
)}
</div>
</div>
))}
{loading && (
<div className="flex gap-2 items-start">
<div className="h-7 w-7 shrink-0 rounded-full flex items-center justify-center bg-muted text-muted-foreground">
<Bot className="h-3.5 w-3.5" />
</div>
<div className="rounded-xl px-3 py-2 bg-muted">
<span className="flex gap-1">
<span className="w-1.5 h-1.5 rounded-full bg-muted-foreground animate-bounce [animation-delay:0ms]" />
<span className="w-1.5 h-1.5 rounded-full bg-muted-foreground animate-bounce [animation-delay:150ms]" />
<span className="w-1.5 h-1.5 rounded-full bg-muted-foreground animate-bounce [animation-delay:300ms]" />
</span>
</div>
</div>
)}
<div ref={bottomRef} />
</div>
<form onSubmit={handleSubmit} className="px-4 py-3 border-t shrink-0 flex gap-2">
<Input
value={input}
onChange={(e) => setInput(e.target.value)}
placeholder={t("inputPlaceholder")}
disabled={loading}
className="flex-1"
autoComplete="off"
/>
<Button type="submit" size="icon" disabled={loading || !input.trim()} aria-label={t("send")}>
<Send className="h-4 w-4" />
</Button>
</form>
</SheetContent>
</Sheet>
</>
);
}