Files
Epicure/apps/web/components/recipe/photo-uploader.tsx
T
Arnaud 362f65656b fix: audit fixes — tier-quota bypass, webhook SSRF, auth hardening, pagination, a11y
Full audit (bugs/UI-UX/backend/feature-gap) turned up a money-leak AI quota
bypass, webhook SSRF, and a long tail of missing pagination/auth/a11y work.
Fixes land together since HANDOFF.md tracked them as one backlog.

- AI routes charge tier quota before generating; nutrition POST is author-only
- Webhook dispatch re-validates URL per delivery (SSRF/DNS-rebinding), treats
  redirects as failures; recipe.published now actually dispatches
- New indexes/unique constraints on recipes, meal-planning, comments FK cascade
- Recipe PUT/restore snapshot only inside the transaction, after validation
- Recipe DELETE cleans up S3 objects (recipe + review photos)
- Optimistic UI (favorite/star/follow/shopping-list) rolls back on failure
- Upload presign enforces file size cap + per-tier storage quota
- Route-level loading/error/not-found states across (app), admin, and root
- middleware.ts guards (app)/admin; requireAdmin checks DB role, not cached
  session; rate limiting applied to both session and API-key branches,
  bucketed per key; Stripe webhook dedupes by event id
- Pagination added to recipes, feed, profile, comments, pantry, admin tables
- Nav shows real avatar + profile link + dark-mode toggle; destructive actions
  standardized on AlertDialog
- Unsaved-changes guard + real ingredient/step validation on recipe form;
  canonical /recipes/[id] used in-app; next/image migration; aria-labels and
  alt text across icon buttons, avatars, recipe photos
- packages/api-types removed (zero callers, too drifted to safely rewire);
  openapi.ts and ai-keys error shape drift fixed; BYOK decrypt failures now
  surface instead of silently falling back to the platform key

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-09 21:50:35 +02:00

122 lines
4.1 KiB
TypeScript

"use client";
import { useState, useRef } from "react";
import Image from "next/image";
import { useTranslations } from "next-intl";
import { Upload, X, Star } from "lucide-react";
import { Button } from "@/components/ui/button";
import { getPublicUrl } from "@/lib/storage";
export type PhotoEntry = {
key: string;
isCover: boolean;
preview: string;
};
export function PhotoUploader({
recipeId,
photos,
onChange,
}: {
recipeId: string;
photos: PhotoEntry[];
onChange: (photos: PhotoEntry[]) => void;
}) {
const t = useTranslations("recipeForm");
const [uploading, setUploading] = useState(false);
const inputRef = useRef<HTMLInputElement>(null);
async function handleFiles(files: FileList) {
setUploading(true);
try {
for (const file of Array.from(files)) {
const res = await fetch("/api/v1/upload/presign", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({ recipeId, contentType: file.type, fileSize: file.size }),
});
if (!res.ok) continue;
const { url, key } = await res.json() as { url: string; key: string };
await fetch(url, { method: "PUT", body: file, headers: { "Content-Type": file.type } });
const isFirst = photos.length === 0;
onChange([...photos, { key, isCover: isFirst, preview: URL.createObjectURL(file) }]);
}
} finally {
setUploading(false);
}
}
function setCover(key: string) {
onChange(photos.map((p) => ({ ...p, isCover: p.key === key })));
}
function remove(key: string) {
const filtered = photos.filter((p) => p.key !== key);
if (filtered.length > 0 && !filtered.some((p) => p.isCover)) {
filtered[0]!.isCover = true;
}
onChange(filtered);
}
return (
<div className="space-y-3">
<div className="flex flex-wrap gap-3">
{photos.map((photo) => (
<div key={photo.key} className="relative group h-24 w-24">
<Image
src={photo.preview || getPublicUrl(photo.key)}
alt="Recipe photo"
fill
className={`rounded-lg object-cover border-2 ${
photo.isCover ? "border-primary" : "border-transparent"
}`}
/>
<div className="absolute inset-0 bg-black/40 opacity-0 group-hover:opacity-100 rounded-lg transition-opacity flex items-center justify-center gap-1">
<button
type="button"
onClick={() => setCover(photo.key)}
className="rounded-full bg-white/20 p-1 hover:bg-white/40 transition-colors"
title={t("setCover")}
>
<Star className={`h-3 w-3 ${photo.isCover ? "text-yellow-400" : "text-white"}`} />
</button>
<button
type="button"
onClick={() => remove(photo.key)}
className="rounded-full bg-white/20 p-1 hover:bg-red-500/80 transition-colors"
title={t("removePhoto")}
>
<X className="h-3 w-3 text-white" />
</button>
</div>
{photo.isCover && (
<span className="absolute bottom-1 left-1 text-[10px] bg-primary text-primary-foreground rounded px-1">
cover
</span>
)}
</div>
))}
<button
type="button"
onClick={() => inputRef.current?.click()}
disabled={uploading}
className="h-24 w-24 rounded-lg border-2 border-dashed border-muted-foreground/25 hover:border-muted-foreground/50 flex flex-col items-center justify-center gap-1 text-muted-foreground transition-colors disabled:opacity-50"
>
<Upload className="h-4 w-4" />
<span className="text-xs">{uploading ? "Uploading…" : "Add photo"}</span>
</button>
</div>
<input
ref={inputRef}
type="file"
accept="image/jpeg,image/png,image/webp,image/avif"
multiple
className="hidden"
onChange={(e) => e.target.files && handleFiles(e.target.files)}
/>
</div>
);
}