fix: resolve TODO.md security/perf/test-coverage backlog

Fixes the 13-item codebase health scan backlog: wraps meal-plan generation in a transaction, adds missing userId/GIN indexes, fixes an IPv6-parsing gap in the webhook SSRF guard (and an identical duplicated bug in the AI URL-import path, now consolidated onto one implementation), paginates the collections list, dedupes the AI recipe Zod schemas, wires up Stripe tier sync, rate-limits AI key rotation, gets `pnpm typecheck` actually working, and adds test coverage for the previously-untested admin/webhooks routes. Two flagged issues (collection removeRecipeId IDOR, tier-limit race) turned out to already be fixed/non-issues on inspection — noted in TODO.md rather than silently dropped. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-02 12:12:42 +02:00
parent 2154512e54
commit d2faf98ac1
38 changed files with 7598 additions and 315 deletions
@@ -78,71 +78,73 @@ export async function POST(req: NextRequest) {

  const createdEntries: Array<{ id: string; day: string; mealType: string; recipeId: string; recipeTitle: string }> = [];

-  for (const entry of plan.entries) {
-    // Create draft recipe
-    const recipeId = crypto.randomUUID();
-    await db.insert(recipes).values({
-      id: recipeId,
-      authorId: userId,
-      title: entry.recipe.title,
-      description: entry.recipe.description,
-      baseServings: entry.servings,
-      visibility: "private",
-      aiGenerated: true,
-      difficulty: entry.recipe.difficulty ?? null,
-      prepMins: entry.recipe.prepMins ?? null,
-      cookMins: entry.recipe.cookMins ?? null,
-    });
+  await db.transaction(async (tx) => {
+    for (const entry of plan.entries) {
+      // Create draft recipe
+      const recipeId = crypto.randomUUID();
+      await tx.insert(recipes).values({
+        id: recipeId,
+        authorId: userId,
+        title: entry.recipe.title,
+        description: entry.recipe.description,
+        baseServings: entry.servings,
+        visibility: "private",
+        aiGenerated: true,
+        difficulty: entry.recipe.difficulty ?? null,
+        prepMins: entry.recipe.prepMins ?? null,
+        cookMins: entry.recipe.cookMins ?? null,
+      });

-    if (entry.recipe.ingredients.length > 0) {
-      await db.insert(recipeIngredients).values(
-        entry.recipe.ingredients.map((ing, i) => ({
-          id: crypto.randomUUID(),
-          recipeId,
-          rawName: ing.rawName,
-          quantity: ing.quantity != null ? String(ing.quantity) : null,
-          unit: ing.unit ?? null,
-          order: i,
-        }))
-      );
+      if (entry.recipe.ingredients.length > 0) {
+        await tx.insert(recipeIngredients).values(
+          entry.recipe.ingredients.map((ing, i) => ({
+            id: crypto.randomUUID(),
+            recipeId,
+            rawName: ing.rawName,
+            quantity: ing.quantity != null ? String(ing.quantity) : null,
+            unit: ing.unit ?? null,
+            order: i,
+          }))
+        );
+      }
+
+      if (entry.recipe.steps.length > 0) {
+        await tx.insert(recipeSteps).values(
+          entry.recipe.steps.map((step, i) => ({
+            id: crypto.randomUUID(),
+            recipeId,
+            instruction: step.instruction,
+            order: i,
+          }))
+        );
+      }
+
+      // Remove any existing entry for this day+mealType, then insert new
+      const existingEntry = await tx.query.mealPlanEntries.findFirst({
+        where: and(
+          eq(mealPlanEntries.mealPlanId, mealPlan!.id),
+          eq(mealPlanEntries.day, entry.day),
+          eq(mealPlanEntries.mealType, entry.mealType)
+        ),
+      });
+
+      if (existingEntry) {
+        await tx.delete(mealPlanEntries).where(eq(mealPlanEntries.id, existingEntry.id));
+      }
+
+      const entryId = crypto.randomUUID();
+      await tx.insert(mealPlanEntries).values({
+        id: entryId,
+        mealPlanId: mealPlan!.id,
+        day: entry.day,
+        mealType: entry.mealType,
+        recipeId,
+        servings: entry.servings,
+      });
+
+      createdEntries.push({ id: entryId, day: entry.day, mealType: entry.mealType, recipeId, recipeTitle: entry.recipe.title });
    }
-
-    if (entry.recipe.steps.length > 0) {
-      await db.insert(recipeSteps).values(
-        entry.recipe.steps.map((step, i) => ({
-          id: crypto.randomUUID(),
-          recipeId,
-          instruction: step.instruction,
-          order: i,
-        }))
-      );
-    }
-
-    // Remove any existing entry for this day+mealType, then insert new
-    const existingEntry = await db.query.mealPlanEntries.findFirst({
-      where: and(
-        eq(mealPlanEntries.mealPlanId, mealPlan!.id),
-        eq(mealPlanEntries.day, entry.day),
-        eq(mealPlanEntries.mealType, entry.mealType)
-      ),
-    });
-
-    if (existingEntry) {
-      await db.delete(mealPlanEntries).where(eq(mealPlanEntries.id, existingEntry.id));
-    }
-
-    const entryId = crypto.randomUUID();
-    await db.insert(mealPlanEntries).values({
-      id: entryId,
-      mealPlanId: mealPlan!.id,
-      day: entry.day,
-      mealType: entry.mealType,
-      recipeId,
-      servings: entry.servings,
-    });
-
-    createdEntries.push({ id: entryId, day: entry.day, mealType: entry.mealType, recipeId, recipeTitle: entry.recipe.title });
-  }
+  });

  return NextResponse.json({ weekStart: parsed.data.weekStart, entries: createdEntries });
 }