arnaudne/Epicure
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

feat: notifications system, rate limiting, fix recipe visibility 404, follow race

Browse Source 
Part of the social-feature backlog (follow, comments, reactions, ratings,
feed, threading) audited earlier — see conversation.

- notifications table: follow/comment/reply/reaction/rating events,
  replaces the fully-dead feed_items table (feed_item_type enum existed
  but had zero references anywhere in the codebase).
- Bell UI in the nav with unread badge, mark-all-read, 30s poll.
- Rate limiting on comment posting (20/min), follow/unfollow (30/min),
  and comment reactions (60/min) — previously unthrottled.
- /recipes/[id] queried by (id, authorId=session.user) only, so any
  recipe not owned by the viewer 404'd regardless of visibility.
  Widen the query to include public/unlisted recipes and gate the
  owner-only actions (edit, delete, version history, translate, AI
  content generation) behind an isOwner check.
- user_follows had no primary key/unique constraint, so the follow
  route's onConflictDoNothing() was a silent no-op — concurrent follow
  clicks could insert duplicate rows and inflate follower counts. Add
  a composite primary key on (follower_id, following_id).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Arnaud
2026-07-03 21:56:34 +02:00
parent e0e1ac49d9
commit 1abab17ca8
21 changed files with 11216 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/web/app/(app)/recipes/[id]/page.tsx
+51 -40
View File
@@ -17,7 +17,7 @@ import { NutritionPanel } from "@/components/recipe/nutrition-panel";
import { GenerateContentButton } from "@/components/recipe/generate-content-button";
import { auth } from "@/lib/auth/server";
import { db, recipes, ratings, favorites, avg } from "@epicure/db";
import { and, eq, count } from "@epicure/db";
import { and, eq, or, count, inArray } from "@epicure/db";
import { Badge } from "@/components/ui/badge";
import { buttonVariants } from "@/components/ui/button";
import { Separator } from "@/components/ui/separator";
@@ -53,7 +53,10 @@ export default async function RecipePage({ params }: Params) {
const [recipe, ratingData, favoriteData] = await Promise.all([
db.query.recipes.findFirst({
where: and(eq(recipes.id, id), eq(recipes.authorId, session.user.id)),
where: and(
eq(recipes.id, id),
or(eq(recipes.authorId, session.user.id), inArray(recipes.visibility, ["public", "unlisted"]))
),
with: {
ingredients: { orderBy: (t, { asc }) => asc(t.order) },
steps: { orderBy: (t, { asc }) => asc(t.order) },
@@ -66,6 +69,8 @@ export default async function RecipePage({ params }: Params) {
if (!recipe) notFound();
const isOwner = recipe.authorId === session.user.id;
const avgScore = ratingData[0]?.avgScore ? parseFloat(ratingData[0].avgScore) : null;
const ratingCount = ratingData[0]?.total ?? 0;
const isFavorited = !!favoriteData;
@@ -121,7 +126,7 @@ export default async function RecipePage({ params }: Params) {
}))}
/>
)}
{(!recipe.language || recipe.language !== (session.user as { locale?: string }).locale) && (
{isOwner && (!recipe.language || recipe.language !== (session.user as { locale?: string }).locale) && (
<TranslateButton recipeId={id} />
)}
{recipe.ingredients.length > 0 && (
@@ -151,32 +156,36 @@ export default async function RecipePage({ params }: Params) {
/>
<ShareRecipeButton recipeId={id} visibility={recipe.visibility} />
<PrintButton recipeId={id} />
<VersionHistoryButton
recipeId={id}
currentSnapshot={{
title: recipe.title,
description: recipe.description,
ingredients: recipe.ingredients.map((ing) => ({
rawName: ing.rawName,
quantity: ing.quantity,
unit: ing.unit,
note: ing.note,
})),
steps: recipe.steps.map((s) => ({
instruction: s.instruction,
timerSeconds: s.timerSeconds,
})),
}}
/>
<Tooltip>
<TooltipTrigger render={
<Link href={`/recipes/${id}/edit`} className={cn(buttonVariants({ variant: "ghost", size: "icon" }))}>
<Pencil className="h-4 w-4" />
</Link>
} />
<TooltipContent>{m.recipe.edit}</TooltipContent>
</Tooltip>
<DeleteRecipeButton recipeId={id} />
{isOwner && (
<>
<VersionHistoryButton
recipeId={id}
currentSnapshot={{
title: recipe.title,
description: recipe.description,
ingredients: recipe.ingredients.map((ing) => ({
rawName: ing.rawName,
quantity: ing.quantity,
unit: ing.unit,
note: ing.note,
})),
steps: recipe.steps.map((s) => ({
instruction: s.instruction,
timerSeconds: s.timerSeconds,
})),
}}
/>
<Tooltip>
<TooltipTrigger render={
<Link href={`/recipes/${id}/edit`} className={cn(buttonVariants({ variant: "ghost", size: "icon" }))}>
<Pencil className="h-4 w-4" />
</Link>
} />
<TooltipContent>{m.recipe.edit}</TooltipContent>
</Tooltip>
<DeleteRecipeButton recipeId={id} />
</>
)}
</div>
</TooltipProvider>
@@ -246,17 +255,19 @@ export default async function RecipePage({ params }: Params) {
{recipe.ingredients.length === 0 && recipe.steps.length === 0 && (
<div className="flex flex-col items-center gap-4 py-12 text-center">
<p className="text-muted-foreground">No ingredients or steps yet.</p>
<div className="flex items-center gap-2">
<GenerateContentButton
recipeId={id}
title={recipe.title}
description={recipe.description}
/>
<Link href={`/recipes/${id}/edit`} className={cn(buttonVariants({ variant: "outline", size: "sm" }))}>
<Pencil className="h-4 w-4" />
Edit manually
</Link>
</div>
{isOwner && (
<div className="flex items-center gap-2">
<GenerateContentButton
recipeId={id}
title={recipe.title}
description={recipe.description}
/>
<Link href={`/recipes/${id}/edit`} className={cn(buttonVariants({ variant: "outline", size: "sm" }))}>
<Pencil className="h-4 w-4" />
Edit manually
</Link>
</div>
)}
</div>
)}
apps/web/app/api/v1/notifications/read/route.ts
+21
View File
@@ -0,0 +1,21 @@
import { NextRequest, NextResponse } from "next/server";
import { db, notifications, eq, and } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
export async function POST(req: NextRequest) {
const { session, response } = await requireSession();
if (response) return response;
const body = (await req.json().catch(() => ({}))) as { id?: string };
await db
.update(notifications)
.set({ read: true })
.where(
body.id
? and(eq(notifications.userId, session!.user.id), eq(notifications.id, body.id))
: eq(notifications.userId, session!.user.id)
);
return NextResponse.json({ ok: true });
}
apps/web/app/api/v1/notifications/route.ts
+35
View File
@@ -0,0 +1,35 @@
import { NextResponse } from "next/server";
import { db, notifications, users, eq, and, desc, count } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
export async function GET() {
const { session, response } = await requireSession();
if (response) return response;
const [rows, unread] = await Promise.all([
db
.select({
id: notifications.id,
type: notifications.type,
recipeId: notifications.recipeId,
commentId: notifications.commentId,
read: notifications.read,
createdAt: notifications.createdAt,
actorId: notifications.actorId,
actorName: users.name,
actorUsername: users.username,
actorAvatarUrl: users.avatarUrl,
})
.from(notifications)
.innerJoin(users, eq(notifications.actorId, users.id))
.where(eq(notifications.userId, session!.user.id))
.orderBy(desc(notifications.createdAt))
.limit(30),
db
.select({ total: count() })
.from(notifications)
.where(and(eq(notifications.userId, session!.user.id), eq(notifications.read, false))),
]);
return NextResponse.json({ notifications: rows, unreadCount: unread[0]?.total ?? 0 });
}
apps/web/app/api/v1/recipes/[id]/comments/[commentId]/reactions/route.ts
+7
View File
@@ -2,6 +2,8 @@ import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { db, comments, commentReactions, eq, and, count } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { applyRateLimit } from "@/lib/rate-limit";
import { createNotification } from "@/lib/notifications";
const ReactionSchema = z.object({
type: z.enum(["like", "love", "laugh", "wow", "sad", "fire"]),
@@ -49,6 +51,10 @@ export async function GET(req: NextRequest, { params }: Params) {
export async function POST(req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
if (response) return response;
const limited = await applyRateLimit(`rl:reaction:${session!.user.id}`, 60, 60);
if (limited) return limited;
const { commentId } = await params;
// Verify comment exists
@@ -85,6 +91,7 @@ export async function POST(req: NextRequest, { params }: Params) {
type,
});
added = true;
void createNotification({ userId: comment.userId, type: "reaction", actorId: userId, recipeId: comment.recipeId, commentId });
}
// Return updated counts
apps/web/app/api/v1/recipes/[id]/comments/route.ts
+15 -1
View File
@@ -2,8 +2,10 @@ import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { db, recipes, comments, users, eq, and } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { applyRateLimit } from "@/lib/rate-limit";
import { dispatchWebhook } from "@/lib/webhooks";
import { sendPushNotification } from "@/lib/push";
import { createNotification } from "@/lib/notifications";
const Schema = z.object({
content: z.string().min(1).max(5000),
@@ -44,6 +46,9 @@ export async function POST(req: NextRequest, { params }: Params) {
if (response) return response;
const { id } = await params;
const limited = await applyRateLimit(`rl:comment:${session!.user.id}`, 20, 60);
if (limited) return limited;
const recipe = await db.query.recipes.findFirst({ where: eq(recipes.id, id) });
if (!recipe || (recipe.visibility === "private" && recipe.authorId !== session!.user.id)) {
return NextResponse.json({ error: "Not found" }, { status: 404 });
@@ -53,8 +58,9 @@ export async function POST(req: NextRequest, { params }: Params) {
const parsed = Schema.safeParse(body);
if (!parsed.success) return NextResponse.json({ error: "Validation error" }, { status: 400 });
let parent: { id: string; userId: string } | undefined;
if (parsed.data.parentId) {
const parent = await db.query.comments.findFirst({
parent = await db.query.comments.findFirst({
where: and(eq(comments.id, parsed.data.parentId), eq(comments.recipeId, id)),
});
if (!parent) return NextResponse.json({ error: "Parent comment not found" }, { status: 404 });
@@ -78,5 +84,13 @@ export async function POST(req: NextRequest, { params }: Params) {
url: `/recipes/${id}`,
});
}
if (parent && parent.userId !== session!.user.id) {
void createNotification({ userId: parent.userId, type: "reply", actorId: session!.user.id, recipeId: id, commentId });
}
if (recipe.authorId !== parent?.userId) {
void createNotification({ userId: recipe.authorId, type: "comment", actorId: session!.user.id, recipeId: id, commentId });
}
return NextResponse.json({ id: commentId }, { status: 201 });
}
apps/web/app/api/v1/recipes/[id]/rate/route.ts
+2
View File
@@ -2,6 +2,7 @@ import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { db, recipes, ratings, eq, and } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { createNotification } from "@/lib/notifications";
const Schema = z.object({
score: z.number().int().min(1).max(5),
@@ -45,5 +46,6 @@ export async function POST(req: NextRequest, { params }: Params) {
score: parsed.data.score,
reviewText: parsed.data.reviewText,
});
void createNotification({ userId: recipe.authorId, type: "rating", actorId: session!.user.id, recipeId: id });
return NextResponse.json({ created: true }, { status: 201 });
}
apps/web/app/api/v1/users/[username]/follow/route.ts
+8
View File
@@ -1,12 +1,18 @@
import { NextRequest, NextResponse } from "next/server";
import { db, users, userFollows, eq, and } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { applyRateLimit } from "@/lib/rate-limit";
import { createNotification } from "@/lib/notifications";
type Params = { params: Promise<{ username: string }> };
export async function POST(_req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
if (response) return response;
const limited = await applyRateLimit(`rl:follow:${session!.user.id}`, 30, 60);
if (limited) return limited;
const { username } = await params;
const target = await db.query.users.findFirst({ where: eq(users.username, username) });
@@ -17,6 +23,8 @@ export async function POST(_req: NextRequest, { params }: Params) {
.values({ followerId: session!.user.id, followingId: target.id })
.onConflictDoNothing();
void createNotification({ userId: target.id, type: "follow", actorId: session!.user.id });
return NextResponse.json({ following: true });
}