Update features and dependencies

apps/web/app/api/v1/webhooks/[id]/route.ts

@@ -2,6 +2,7 @@ import { NextRequest, NextResponse } from "next/server";
 import { z } from "zod";
 import { db, webhooks, eq, and } from "@epicure/db";
 import { requireSession } from "@/lib/api-auth";
+import { validateWebhookUrl } from "@/lib/validate-webhook-url";
 
 const VALID_EVENTS = ["recipe.created", "recipe.updated", "recipe.published", "recipe.deleted"] as const;
 
@@ -66,10 +67,9 @@ export async function PATCH(
   }
 
   if (parsed.data.url) {
-    try {
-      new URL(parsed.data.url);
-    } catch {
-      return NextResponse.json({ error: "Invalid URL" }, { status: 400 });
+    const ssrfError = await validateWebhookUrl(parsed.data.url);
+    if (ssrfError) {
+      return NextResponse.json({ error: ssrfError }, { status: 400 });
     }
   }
 

apps/web/app/api/v1/webhooks/route.ts

@@ -3,6 +3,7 @@ import crypto from "node:crypto";
 import { z } from "zod";
 import { db, webhooks, eq } from "@epicure/db";
 import { requireSession } from "@/lib/api-auth";
+import { validateWebhookUrl } from "@/lib/validate-webhook-url";
 
 const VALID_EVENTS = ["recipe.created", "recipe.updated", "recipe.published", "recipe.deleted"] as const;
 
@@ -49,11 +50,10 @@ export async function POST(req: NextRequest) {
     );
   }
 
-  // Validate URL format
-  try {
-    new URL(parsed.data.url);
-  } catch {
-    return NextResponse.json({ error: "Invalid URL" }, { status: 400 });
+  // Validate URL — enforce https/http only and block SSRF targets
+  const ssrfError = await validateWebhookUrl(parsed.data.url);
+  if (ssrfError) {
+    return NextResponse.json({ error: ssrfError }, { status: 400 });
   }
 
   const secret = crypto.randomBytes(32).toString("hex");