arnaudne/Epicure
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

feat: public shopping list links can allow editing

Browse Source 
Owner opts in per-list via a new "Allow editing" toggle next to the
existing public-link switch. Anonymous writes are scoped to that one
list only — the link id is the sole credential, enforced in
getShoppingListAccess and the item routes (no session required there
now), with an IP rate limit on genuinely anonymous requests. Turning
off the public link also revokes editing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Arnaud
2026-07-13 12:53:52 +02:00
parent b1f4bba6dd
commit 2beb23b360
21 changed files with 5174 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/web/app/api/v1/shopping-lists/[id]/items/[itemId]/route.ts
+6 -8
View File
@@ -1,7 +1,7 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { db, shoppingListItems, eq, and } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { getOptionalSession } from "@/lib/api-auth";
import { getShoppingListAccess, canWriteShoppingList } from "@/lib/shopping-list-access";
import { notifyShoppingListMembers } from "@/lib/shopping-list-notify";
@@ -17,11 +17,10 @@ const UpdateItemSchema = z.object({
});
export async function PUT(req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
if (response) return response;
const { id, itemId } = await params;
const session = await getOptionalSession();
const access = await getShoppingListAccess(id, session!.user.id);
const access = await getShoppingListAccess(id, session?.user.id ?? null);
if (!access) return NextResponse.json({ error: "Not found" }, { status: 404 });
if (!canWriteShoppingList(access.role)) return NextResponse.json({ error: "Forbidden" }, { status: 403 });
@@ -54,7 +53,7 @@ export async function PUT(req: NextRequest, { params }: Params) {
columns: { rawName: true },
});
if (item) {
void notifyShoppingListMembers(id, session!.user.id, session!.user.name, {
void notifyShoppingListMembers(id, session?.user.id ?? "", session?.user.name ?? null, {
type: "checked",
itemName: item.rawName,
listName: access.list.name,
@@ -66,11 +65,10 @@ export async function PUT(req: NextRequest, { params }: Params) {
}
export async function DELETE(_req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
if (response) return response;
const { id, itemId } = await params;
const session = await getOptionalSession();
const access = await getShoppingListAccess(id, session!.user.id);
const access = await getShoppingListAccess(id, session?.user.id ?? null);
if (!access) return NextResponse.json({ error: "Not found" }, { status: 404 });
if (!canWriteShoppingList(access.role)) return NextResponse.json({ error: "Forbidden" }, { status: 403 });
apps/web/app/api/v1/shopping-lists/[id]/items/route.ts
+11 -12
View File
@@ -1,7 +1,7 @@
import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { db, shoppingListItems, eq, and } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { getOptionalSession } from "@/lib/api-auth";
import { getShoppingListAccess, canWriteShoppingList } from "@/lib/shopping-list-access";
import { guessAisle } from "@/lib/grocery-categories";
import { notifyShoppingListMembers } from "@/lib/shopping-list-notify";
@@ -9,13 +9,14 @@ import { notifyShoppingListMembers } from "@/lib/shopping-list-notify";
// Polled by the list view (components/meal-plan/shopping-list-view.tsx) so
// collaborators see each other's checked/added/reordered items without a
// manual refresh — no push/websocket infra in this app, so a short poll on
// the same shape the page's initial server-render already uses.
// the same shape the page's initial server-render already uses. No
// requireSession here: a public-editable list's own visitors (no account)
// need this too — getShoppingListAccess resolves that from the link itself.
export async function GET(_req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
if (response) return response;
const { id } = await params;
const session = await getOptionalSession();
const access = await getShoppingListAccess(id, session!.user.id);
const access = await getShoppingListAccess(id, session?.user.id ?? null);
if (!access) return NextResponse.json({ error: "Not found" }, { status: 404 });
const items = await db.query.shoppingListItems.findMany({
@@ -59,11 +60,10 @@ const BulkUpdateSchema = z.object({
type Params = { params: Promise<{ id: string }> };
export async function POST(req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
if (response) return response;
const { id } = await params;
const session = await getOptionalSession();
const access = await getShoppingListAccess(id, session!.user.id);
const access = await getShoppingListAccess(id, session?.user.id ?? null);
if (!access) return NextResponse.json({ error: "Not found" }, { status: 404 });
if (!canWriteShoppingList(access.role)) return NextResponse.json({ error: "Forbidden" }, { status: 403 });
@@ -84,7 +84,7 @@ export async function POST(req: NextRequest, { params }: Params) {
}))
);
void notifyShoppingListMembers(id, session!.user.id, session!.user.name, {
void notifyShoppingListMembers(id, session?.user.id ?? "", session?.user.name ?? null, {
type: "itemsAdded",
count: parsed.data.items.length,
listName: access.list.name,
@@ -94,11 +94,10 @@ export async function POST(req: NextRequest, { params }: Params) {
}
export async function PATCH(req: NextRequest, { params }: Params) {
const { session, response } = await requireSession();
if (response) return response;
const { id } = await params;
const session = await getOptionalSession();
const access = await getShoppingListAccess(id, session!.user.id);
const access = await getShoppingListAccess(id, session?.user.id ?? null);
if (!access) return NextResponse.json({ error: "Not found" }, { status: 404 });
if (!canWriteShoppingList(access.role)) return NextResponse.json({ error: "Forbidden" }, { status: 403 });
apps/web/app/api/v1/shopping-lists/[id]/route.ts
+12 -1
View File
@@ -27,6 +27,7 @@ const PatchSchema = z.object({
completed: z.boolean().optional(),
name: z.string().min(1).max(100).optional(),
isPublic: z.boolean().optional(),
publicEditable: z.boolean().optional(),
});
export async function PATCH(req: NextRequest, { params }: Params) {
@@ -48,7 +49,17 @@ export async function PATCH(req: NextRequest, { params }: Params) {
if (body.data.isPublic !== undefined) {
if (access.role !== "owner") return NextResponse.json({ error: "Forbidden" }, { status: 403 });
await db.update(shoppingLists).set({ isPublic: body.data.isPublic }).where(eq(shoppingLists.id, id));
// Turning the public link off also revokes public editing — otherwise
// re-enabling the link later would silently restore write access without
// the owner having re-opted into it.
await db.update(shoppingLists)
.set({ isPublic: body.data.isPublic, ...(body.data.isPublic ? {} : { publicEditable: false }) })
.where(eq(shoppingLists.id, id));
}
if (body.data.publicEditable !== undefined) {
if (access.role !== "owner") return NextResponse.json({ error: "Forbidden" }, { status: 403 });
await db.update(shoppingLists).set({ publicEditable: body.data.publicEditable }).where(eq(shoppingLists.id, id));
}
if (body.data.completed) {