Arnaud
d2faf98ac1
Fixes the 13-item codebase health scan backlog: wraps meal-plan generation in a transaction, adds missing userId/GIN indexes, fixes an IPv6-parsing gap in the webhook SSRF guard (and an identical duplicated bug in the AI URL-import path, now consolidated onto one implementation), paginates the collections list, dedupes the AI recipe Zod schemas, wires up Stripe tier sync, rate-limits AI key rotation, gets `pnpm typecheck` actually working, and adds test coverage for the previously-untested admin/webhooks routes. Two flagged issues (collection removeRecipeId IDOR, tier-limit race) turned out to already be fixed/non-issues on inspection — noted in TODO.md rather than silently dropped. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
28 lines
887 B
TypeScript
28 lines
887 B
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
|
import { requireAdmin } from "@/lib/api-auth";
|
|
import { sendEmail, verifyEmailHtml } from "@/lib/email";
|
|
|
|
export async function POST(req: NextRequest) {
|
|
const { response } = await requireAdmin();
|
|
if (response) return response;
|
|
|
|
const { to } = await req.json() as { to: string };
|
|
if (!to) return NextResponse.json({ error: "Missing 'to'" }, { status: 400 });
|
|
|
|
const baseUrl = process.env["BETTER_AUTH_URL"];
|
|
if (!baseUrl) {
|
|
return NextResponse.json({ error: "BETTER_AUTH_URL is not configured" }, { status: 500 });
|
|
}
|
|
|
|
try {
|
|
await sendEmail({
|
|
to,
|
|
subject: "Epicure — test email",
|
|
html: verifyEmailHtml(`${baseUrl}/verify-email?token=test`),
|
|
});
|
|
return NextResponse.json({ ok: true });
|
|
} catch (err) {
|
|
return NextResponse.json({ error: String(err) }, { status: 500 });
|
|
}
|
|
}
|