feat: push+email notifications, recipe notes, fork/clone, pantry-aware lists, GDPR export

Five S-sized items from HANDOFF.md's new-features backlog, all wiring up previously-orphaned infra: - createNotification now sends web push + email for every notification type (follow/comment/reply/reaction/rating/mention), not just comments - Personal recipe notes: private per-user notes on any viewable recipe (recipeNotes table had zero API/UI before this) - Recipe fork/clone: deep-copies a viewable recipe into your own library as a private draft, linked via recipeVariations, respects tier quota - Pantry-aware shopping lists: meal-plan-generated lists now subtract on-hand pantry quantities (ingredientId match, falling back to normalized name match) and flag partial/ambiguous matches instead of guessing - GDPR data export: downloadable JSON of a user's own content and activity across every relevant table, secrets/internal tables excluded New migrations 0025 (unique index for recipe-notes upsert) and 0026 (shopping_list_items.in_pantry) generated, left unapplied like 0023/0024. Verified with typecheck, lint, and a full local `docker build`. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-10 07:50:58 +02:00
parent d035378520
commit 45b886e398
23 changed files with 9813 additions and 23 deletions
@@ -0,0 +1,94 @@
+import { NextRequest, NextResponse } from "next/server";
+import { db, recipes, recipeIngredients, recipeSteps, recipeVariations } from "@epicure/db";
+import { eq, and, or, inArray } from "@epicure/db";
+import { requireSessionOrApiKey } from "@/lib/api-auth";
+import { checkAndIncrementTierLimit, TierLimitError } from "@/lib/tiers";
+
+type Params = { params: Promise<{ id: string }> };
+
+export async function POST(req: NextRequest, { params }: Params) {
+  const { session, response } = await requireSessionOrApiKey(req, { rateLimit: { limit: 20, windowSeconds: 60 } });
+  if (response) return response;
+  const { id } = await params;
+
+  const source = await db.query.recipes.findFirst({
+    where: and(
+      eq(recipes.id, id),
+      or(eq(recipes.authorId, session!.user.id), inArray(recipes.visibility, ["public", "unlisted"]))
+    ),
+    with: {
+      ingredients: { orderBy: (t, { asc }) => asc(t.order) },
+      steps: { orderBy: (t, { asc }) => asc(t.order) },
+    },
+  });
+  if (!source) return NextResponse.json({ error: "Not found" }, { status: 404 });
+
+  try {
+    await checkAndIncrementTierLimit(session!.user.id, session!.user.tier as "free" | "pro", "recipe");
+  } catch (err) {
+    if (err instanceof TierLimitError) {
+      return NextResponse.json({ error: "Recipe limit reached for your tier" }, { status: 403 });
+    }
+    throw err;
+  }
+
+  const newId = crypto.randomUUID();
+  const now = new Date();
+
+  await db.transaction(async (tx) => {
+    await tx.insert(recipes).values({
+      id: newId,
+      authorId: session!.user.id,
+      title: source.title,
+      description: source.description,
+      baseServings: source.baseServings,
+      visibility: "private",
+      difficulty: source.difficulty,
+      prepMins: source.prepMins,
+      cookMins: source.cookMins,
+      tags: source.tags,
+      dietaryTags: source.dietaryTags ?? {},
+      aiGenerated: false,
+      language: source.language,
+      createdAt: now,
+      updatedAt: now,
+    });
+
+    if (source.ingredients.length > 0) {
+      await tx.insert(recipeIngredients).values(
+        source.ingredients.map((ing) => ({
+          id: crypto.randomUUID(),
+          recipeId: newId,
+          rawName: ing.rawName,
+          quantity: ing.quantity,
+          unit: ing.unit,
+          note: ing.note,
+          order: ing.order,
+        }))
+      );
+    }
+
+    if (source.steps.length > 0) {
+      await tx.insert(recipeSteps).values(
+        source.steps.map((step) => ({
+          id: crypto.randomUUID(),
+          recipeId: newId,
+          instruction: step.instruction,
+          timerSeconds: step.timerSeconds,
+          order: step.order,
+        }))
+      );
+    }
+
+    await tx.insert(recipeVariations).values({
+      id: crypto.randomUUID(),
+      parentRecipeId: source.id,
+      childRecipeId: newId,
+      description: null,
+      aiGenerated: false,
+      createdAt: now,
+    });
+  });
+
+  return NextResponse.json({ id: newId }, { status: 201 });
+}