Update features and dependencies

apps/web/app/api/v1/recipes/[id]/comments/[commentId]/reactions/route.ts

@@ -30,7 +30,8 @@ export async function GET(req: NextRequest, { params }: Params) {
     counts[row.type] = row.cnt;
   }
 
-  // Check for session to return user's reactions
+  // Optional auth — GET reactions is public; session present means also return user's own reactions
+  // response intentionally ignored: unauthenticated callers get counts only with empty userReactions
   const { session } = await requireSession();
   let userReactions: string[] = [];
 

apps/web/app/api/v1/recipes/[id]/cooked/route.ts

@@ -6,7 +6,7 @@ import { requireSession } from "@/lib/api-auth";
 type Params = { params: Promise<{ id: string }> };
 
 const Schema = z.object({
-  servings: z.number().int().min(1).optional(),
+  servings: z.number().int().min(1).max(1000).optional(),
   notes: z.string().max(2000).optional(),
   deductFromPantry: z.boolean().default(true),
 });

apps/web/app/api/v1/recipes/[id]/nutrition/route.ts

@@ -56,7 +56,7 @@ export async function POST(_req: NextRequest, { params }: Params) {
     })),
   });
 
-  await db.update(recipes).set({ nutritionData: result }).where(eq(recipes.id, id));
+  await db.update(recipes).set({ nutritionData: result }).where(and(eq(recipes.id, id), eq(recipes.authorId, session!.user.id)));
 
   return NextResponse.json({ nutrition: result });
 }

apps/web/app/api/v1/recipes/[id]/route.ts

@@ -4,15 +4,17 @@ import { eq, and, max } from "@epicure/db";
 import { z } from "zod";
 import { requireSessionOrApiKey } from "@/lib/api-auth";
 import { dispatchWebhook } from "@/lib/webhooks";
+import { parseQuantity } from "@/lib/parse-quantity";
 
 const UpdateRecipeSchema = z.object({
   title: z.string().min(1).max(200).optional(),
-  description: z.string().optional(),
+  description: z.string().max(2000).optional(),
   baseServings: z.number().int().min(1).max(100).optional(),
   visibility: z.enum(["private", "unlisted", "public"]).optional(),
   difficulty: z.enum(["easy", "medium", "hard"]).nullable().optional(),
-  prepMins: z.number().int().min(0).nullable().optional(),
-  cookMins: z.number().int().min(0).nullable().optional(),
+  prepMins: z.number().int().min(0).max(1440).nullable().optional(),
+  cookMins: z.number().int().min(0).max(1440).nullable().optional(),
+  tags: z.array(z.string().min(1).max(50)).max(20).optional(),
   dietaryTags: z.object({
     vegan: z.boolean().optional(),
     vegetarian: z.boolean().optional(),
@@ -23,17 +25,17 @@ const UpdateRecipeSchema = z.object({
     kosher: z.boolean().optional(),
   }).optional(),
   ingredients: z.array(z.object({
-    rawName: z.string().min(1),
-    quantity: z.string().optional(),
-    unit: z.string().optional(),
-    note: z.string().optional(),
+    rawName: z.string().min(1).max(200),
+    quantity: z.union([z.number(), z.string().max(50)]).optional().transform(parseQuantity),
+    unit: z.string().max(50).optional(),
+    note: z.string().max(500).optional(),
     order: z.number().int().default(0),
-  })).optional(),
+  })).max(100).optional(),
   steps: z.array(z.object({
-    instruction: z.string().min(1),
-    timerSeconds: z.number().int().optional(),
+    instruction: z.string().min(1).max(2000),
+    timerSeconds: z.number().int().min(0).max(86400).optional(),
     order: z.number().int(),
-  })).optional(),
+  })).max(100).optional(),
 });
 
 type Params = { params: Promise<{ id: string }> };
@@ -119,6 +121,7 @@ export async function PUT(req: NextRequest, { params }: Params) {
     if (data.difficulty !== undefined) updates.difficulty = data.difficulty ?? undefined;
     if (data.prepMins !== undefined) updates.prepMins = data.prepMins ?? undefined;
     if (data.cookMins !== undefined) updates.cookMins = data.cookMins ?? undefined;
+    if (data.tags !== undefined) updates.tags = data.tags;
     if (data.dietaryTags !== undefined) updates.dietaryTags = data.dietaryTags;
 
     await tx.update(recipes).set(updates).where(eq(recipes.id, id));