fix: resolve TODO.md security/perf/test-coverage backlog

Fixes the 13-item codebase health scan backlog: wraps meal-plan
generation in a transaction, adds missing userId/GIN indexes, fixes
an IPv6-parsing gap in the webhook SSRF guard (and an identical
duplicated bug in the AI URL-import path, now consolidated onto one
implementation), paginates the collections list, dedupes the AI
recipe Zod schemas, wires up Stripe tier sync, rate-limits AI key
rotation, gets `pnpm typecheck` actually working, and adds test
coverage for the previously-untested admin/webhooks routes.

Two flagged issues (collection removeRecipeId IDOR, tier-limit race)
turned out to already be fixed/non-issues on inspection — noted in
TODO.md rather than silently dropped.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

packages/db/package.json

@@ -12,13 +12,15 @@
     "generate": "drizzle-kit generate",
     "migrate": "drizzle-kit migrate",
     "studio": "drizzle-kit studio",
-    "seed": "tsx src/seed.ts"
+    "seed": "tsx src/seed.ts",
+    "typecheck": "tsc --noEmit"
   },
   "dependencies": {
     "drizzle-orm": "^0.44.7",
     "postgres": "^3.4.7"
   },
   "devDependencies": {
+    "@types/node": "^20.19.43",
     "drizzle-kit": "^0.31.1",
     "tsx": "^4.20.3",
     "typescript": "^5.8.3"

packages/db/src/migrations/0012_sloppy_tigra.sql

@@ -0,0 +1,6 @@
+CREATE INDEX "recipes_dietary_tags_gin" ON "recipes" USING gin ("dietary_tags");--> statement-breakpoint
+CREATE INDEX "collection_members_user_idx" ON "collection_members" USING btree ("user_id");--> statement-breakpoint
+CREATE INDEX "collections_user_idx" ON "collections" USING btree ("user_id");--> statement-breakpoint
+CREATE INDEX "cooking_history_user_idx" ON "cooking_history" USING btree ("user_id");--> statement-breakpoint
+CREATE INDEX "favorites_user_idx" ON "favorites" USING btree ("user_id");--> statement-breakpoint
+CREATE INDEX "ratings_user_idx" ON "ratings" USING btree ("user_id");

packages/db/src/migrations/0013_damp_richard_fisk.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "users" ADD COLUMN "stripe_customer_id" text;--> statement-breakpoint
+ALTER TABLE "users" ADD CONSTRAINT "users_stripe_customer_id_unique" UNIQUE("stripe_customer_id");

packages/db/src/schema/recipes.ts

@@ -49,6 +49,7 @@ export const recipes = pgTable("recipes", {
 }, (t) => [
   index("recipes_author_idx").on(t.authorId),
   index("recipes_visibility_idx").on(t.visibility),
+  index("recipes_dietary_tags_gin").using("gin", t.dietaryTags),
 ]);
 
 export const ingredients = pgTable("ingredients", {

packages/db/src/schema/social.ts

@@ -25,13 +25,17 @@ export const ratings = pgTable("ratings", {
   reviewText: text("review_text"),
   createdAt: timestamp("created_at").notNull().defaultNow(),
   updatedAt: timestamp("updated_at").notNull().defaultNow(),
-});
+}, (t) => [
+  index("ratings_user_idx").on(t.userId),
+]);
 
 export const favorites = pgTable("favorites", {
   userId: text("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
   recipeId: text("recipe_id").notNull().references(() => recipes.id, { onDelete: "cascade" }),
   createdAt: timestamp("created_at").notNull().defaultNow(),
-});
+}, (t) => [
+  index("favorites_user_idx").on(t.userId),
+]);
 
 export const comments = pgTable("comments", {
   id: text("id").primaryKey(),
@@ -53,7 +57,9 @@ export const collections = pgTable("collections", {
   isPublic: boolean("is_public").notNull().default(false),
   createdAt: timestamp("created_at").notNull().defaultNow(),
   updatedAt: timestamp("updated_at").notNull().defaultNow(),
-});
+}, (t) => [
+  index("collections_user_idx").on(t.userId),
+]);
 
 export const collectionRecipes = pgTable("collection_recipes", {
   collectionId: text("collection_id").notNull().references(() => collections.id, { onDelete: "cascade" }),
@@ -68,7 +74,9 @@ export const cookingHistory = pgTable("cooking_history", {
   cookedAt: timestamp("cooked_at").notNull().defaultNow(),
   servings: integer("servings"),
   notes: text("notes"),
-});
+}, (t) => [
+  index("cooking_history_user_idx").on(t.userId),
+]);
 
 export const feedItems = pgTable("feed_items", {
   id: text("id").primaryKey(),
@@ -104,7 +112,9 @@ export const collectionMembers = pgTable("collection_members", {
   userId: text("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
   role: collectionMemberRoleEnum("role").notNull().default("viewer"),
   createdAt: timestamp("created_at").notNull().defaultNow(),
-});
+}, (t) => [
+  index("collection_members_user_idx").on(t.userId),
+]);
 
 export const commentReactionTypeEnum = pgEnum("comment_reaction_type", ["like", "love", "laugh", "wow", "sad", "fire"]);
 

packages/db/src/schema/users.ts

@@ -23,6 +23,7 @@ export const users = pgTable("users", {
   username: text("username").unique(),
   role: userRoleEnum("role").notNull().default("user"),
   tier: tierEnum("tier").notNull().default("free"),
+  stripeCustomerId: text("stripe_customer_id").unique(),
   unitPref: unitPrefEnum("unit_pref").notNull().default("metric"),
   locale: text("locale").notNull().default("en"),
   createdAt: timestamp("created_at").notNull().defaultNow(),

packages/db/tsconfig.json

@@ -2,7 +2,8 @@
   "extends": "../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "./dist",
-    "rootDir": "./src"
+    "rootDir": "./src",
+    "types": ["node"]
   },
   "include": ["src"]
 }