feat: misc — cooking mode, OpenAPI docs, email, storage, upload, homepage

Cooking mode step-by-step view. OpenAPI 3.1 spec auto-generated from Zod schemas.
Email lib (resend). Redis client. S3 storage helper. Photo upload endpoint.
Landing page. Short recipe URL redirect /r/[id]. API docs page.

apps/web/app/api/v1/ai-keys/[provider]/route.ts

@@ -0,0 +1,18 @@
+import { NextResponse } from "next/server";
+import { db, userAiKeys, eq, and } from "@epicure/db";
+import { requireSession } from "@/lib/api-auth";
+
+type Params = { params: Promise<{ provider: string }> };
+
+export async function DELETE(_req: Request, { params }: Params) {
+  const { session, response } = await requireSession();
+  if (response) return response;
+
+  const { provider } = await params;
+
+  await db.delete(userAiKeys).where(
+    and(eq(userAiKeys.userId, session!.user.id), eq(userAiKeys.provider, provider))
+  );
+
+  return NextResponse.json({ ok: true });
+}

apps/web/app/api/v1/ai-keys/route.ts

@@ -0,0 +1,56 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { db, userAiKeys, eq, and } from "@epicure/db";
+import { requireSession } from "@/lib/api-auth";
+import { encrypt } from "@/lib/encrypt";
+
+const VALID_PROVIDERS = ["openai", "anthropic", "openrouter", "ollama"] as const;
+
+const PostSchema = z.object({
+  provider: z.enum(VALID_PROVIDERS),
+  apiKey: z.string().min(1).max(500),
+});
+
+export async function GET() {
+  const { session, response } = await requireSession();
+  if (response) return response;
+
+  const keys = await db.query.userAiKeys.findMany({
+    where: eq(userAiKeys.userId, session!.user.id),
+    columns: { provider: true, createdAt: true },
+  });
+
+  return NextResponse.json({ keys });
+}
+
+export async function POST(req: Request) {
+  const { session, response } = await requireSession();
+  if (response) return response;
+
+  const body = PostSchema.safeParse(await req.json());
+  if (!body.success) return NextResponse.json({ error: body.error.flatten() }, { status: 400 });
+
+  const { provider, apiKey } = body.data;
+  const userId = session!.user.id;
+
+  const existing = await db.query.userAiKeys.findFirst({
+    where: and(eq(userAiKeys.userId, userId), eq(userAiKeys.provider, provider)),
+  });
+
+  const encryptedKey = encrypt(apiKey);
+
+  if (existing) {
+    await db.update(userAiKeys)
+      .set({ encryptedKey })
+      .where(and(eq(userAiKeys.userId, userId), eq(userAiKeys.provider, provider)));
+  } else {
+    await db.insert(userAiKeys).values({
+      id: crypto.randomUUID(),
+      userId,
+      provider,
+      encryptedKey,
+    });
+  }
+
+  return NextResponse.json({ ok: true });
+}

apps/web/app/api/v1/comments/[id]/route.ts

@@ -0,0 +1,39 @@
+import { NextRequest, NextResponse } from "next/server";
+import { z } from "zod";
+import { db, comments, eq, and } from "@epicure/db";
+import { requireSession } from "@/lib/api-auth";
+
+type Params = { params: Promise<{ id: string }> };
+
+export async function PUT(req: NextRequest, { params }: Params) {
+  const { session, response } = await requireSession();
+  if (response) return response;
+  const { id } = await params;
+
+  const comment = await db.query.comments.findFirst({ where: eq(comments.id, id) });
+  if (!comment || comment.userId !== session!.user.id) {
+    return NextResponse.json({ error: "Not found" }, { status: 404 });
+  }
+
+  const body = await req.json() as unknown;
+  const parsed = z.object({ content: z.string().min(1).max(5000) }).safeParse(body);
+  if (!parsed.success) return NextResponse.json({ error: "Validation error" }, { status: 400 });
+
+  await db.update(comments).set({ content: parsed.data.content, updatedAt: new Date() }).where(eq(comments.id, id));
+  return NextResponse.json({ updated: true });
+}
+
+export async function DELETE(_req: NextRequest, { params }: Params) {
+  const { session, response } = await requireSession();
+  if (response) return response;
+  const { id } = await params;
+
+  const comment = await db.query.comments.findFirst({ where: eq(comments.id, id) });
+  if (!comment) return NextResponse.json({ error: "Not found" }, { status: 404 });
+  if (comment.userId !== session!.user.id && session!.user.role === "user") {
+    return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+  }
+
+  await db.delete(comments).where(eq(comments.id, id));
+  return new NextResponse(null, { status: 204 });
+}

apps/web/app/api/v1/feed/route.ts

@@ -0,0 +1,51 @@
+import { NextRequest, NextResponse } from "next/server";
+import { db, recipes, users, userFollows, eq } from "@epicure/db";
+import { requireSession } from "@/lib/api-auth";
+import { desc, inArray } from "@epicure/db";
+
+export async function GET(req: NextRequest) {
+  const { session, response } = await requireSession();
+  if (response) return response;
+
+  const { searchParams } = new URL(req.url);
+  const limit = Math.min(parseInt(searchParams.get("limit") ?? "20"), 50);
+  const offset = parseInt(searchParams.get("offset") ?? "0");
+
+  // Get IDs of users the current user follows
+  const followedRows = await db
+    .select({ followingId: userFollows.followingId })
+    .from(userFollows)
+    .where(eq(userFollows.followerId, session!.user.id));
+
+  const followedIds = followedRows.map((r) => r.followingId);
+
+  if (followedIds.length === 0) {
+    return NextResponse.json({ data: [], limit, offset, message: "Follow some users to see their recipes here." });
+  }
+
+  const feedRecipes = await db
+    .select({
+      id: recipes.id,
+      title: recipes.title,
+      description: recipes.description,
+      baseServings: recipes.baseServings,
+      prepMins: recipes.prepMins,
+      cookMins: recipes.cookMins,
+      difficulty: recipes.difficulty,
+      visibility: recipes.visibility,
+      createdAt: recipes.createdAt,
+      updatedAt: recipes.updatedAt,
+      authorId: recipes.authorId,
+      authorName: users.name,
+      authorUsername: users.username,
+      authorAvatarUrl: users.avatarUrl,
+    })
+    .from(recipes)
+    .innerJoin(users, eq(recipes.authorId, users.id))
+    .where((t) => inArray(t.authorId, followedIds))
+    .orderBy(desc(recipes.createdAt))
+    .limit(limit)
+    .offset(offset);
+
+  return NextResponse.json({ data: feedRecipes, limit, offset });
+}

apps/web/app/api/v1/feed/trending/route.ts

@@ -0,0 +1,42 @@
+import { NextRequest, NextResponse } from "next/server";
+import { db, recipes, users, favorites, eq, desc, sql, and, gte } from "@epicure/db";
+
+export async function GET(req: NextRequest) {
+  const { searchParams } = new URL(req.url);
+  const limit = Math.min(parseInt(searchParams.get("limit") ?? "20"), 50);
+
+  const sevenDaysAgo = new Date(Date.now() - 7 * 24 * 60 * 60 * 1000);
+
+  const trending = await db
+    .select({
+      id: recipes.id,
+      title: recipes.title,
+      description: recipes.description,
+      baseServings: recipes.baseServings,
+      prepMins: recipes.prepMins,
+      cookMins: recipes.cookMins,
+      difficulty: recipes.difficulty,
+      visibility: recipes.visibility,
+      aiGenerated: recipes.aiGenerated,
+      createdAt: recipes.createdAt,
+      authorId: recipes.authorId,
+      authorName: users.name,
+      authorUsername: users.username,
+      authorAvatarUrl: users.avatarUrl,
+      favoriteCount: sql<number>`cast(count(${favorites.recipeId}) as int)`,
+    })
+    .from(recipes)
+    .innerJoin(users, eq(recipes.authorId, users.id))
+    .leftJoin(
+      favorites,
+      and(eq(favorites.recipeId, recipes.id), gte(favorites.createdAt, sevenDaysAgo))
+    )
+    .where(eq(recipes.visibility, "public"))
+    .groupBy(recipes.id, users.id)
+    .orderBy(desc(sql`count(${favorites.recipeId})`), desc(recipes.createdAt))
+    .limit(limit);
+
+  return NextResponse.json({
+    data: trending.map((r) => ({ ...r, createdAt: r.createdAt.toISOString() })),
+  });
+}

apps/web/app/api/v1/openapi.json/route.ts

@@ -0,0 +1,8 @@
+import { generateOpenApiSpec } from "@/lib/openapi";
+
+export async function GET() {
+  const spec = generateOpenApiSpec();
+  return Response.json(spec, {
+    headers: { "Access-Control-Allow-Origin": "*" },
+  });
+}

apps/web/app/api/v1/upload/presign/route.ts

@@ -0,0 +1,31 @@
+import { NextRequest, NextResponse } from "next/server";
+import { z } from "zod";
+import { requireSession } from "@/lib/api-auth";
+import { createPresignedUploadUrl } from "@/lib/storage";
+
+const ALLOWED_TYPES = ["image/jpeg", "image/png", "image/webp", "image/avif"] as const;
+type AllowedType = (typeof ALLOWED_TYPES)[number];
+
+const Schema = z.object({
+  contentType: z.string().refine((t): t is AllowedType => (ALLOWED_TYPES as readonly string[]).includes(t), {
+    message: "Content type must be jpeg, png, webp, or avif",
+  }),
+  recipeId: z.string().uuid(),
+});
+
+export async function POST(req: NextRequest) {
+  const { session, response } = await requireSession();
+  if (response) return response;
+
+  const body = await req.json() as unknown;
+  const parsed = Schema.safeParse(body);
+  if (!parsed.success) {
+    return NextResponse.json({ error: "Validation error", issues: parsed.error.issues }, { status: 400 });
+  }
+
+  const ext = parsed.data.contentType.split("/")[1] ?? "jpg";
+  const key = `recipes/${parsed.data.recipeId}/photos/${session!.user.id}-${crypto.randomUUID()}.${ext}`;
+  const url = await createPresignedUploadUrl(key, parsed.data.contentType);
+
+  return NextResponse.json({ url, key });
+}