feat: add "cooked it" photo reviews

Users can rate a recipe with review text and an optional photo. Adds
ratings.photo_key column, a reviews list endpoint, and a review-purpose
presign path (reviewer isn't the recipe owner, so the upload
authorization differs from cover-photo uploads).

Also fixes CSP connect-src/img-src to allow the storage origin —
direct-to-S3/MinIO presigned uploads and stored images were silently
blocked by Content-Security-Policy in the browser.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/(app)/recipes/[id]/page.tsx

@@ -26,6 +26,7 @@ import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from "@/comp
 import { ServingScaler } from "@/components/recipe/serving-scaler";
 import { FavoriteButton } from "@/components/social/favorite-button";
 import { RatingStars } from "@/components/social/rating-stars";
+import { CookedItReview } from "@/components/social/cooked-it-review";
 import { CommentsSection } from "@/components/social/comments-section";
 import { getPublicUrl } from "@/lib/storage";
 import { cn } from "@/lib/utils";
@@ -386,7 +387,16 @@ export default async function RecipePage({ params }: Params) {
         <>
           <Separator />
           <div className="space-y-4">
-            <RatingStars recipeId={id} initialScore={myScore} />
+            {isOwner ? (
+              <RatingStars recipeId={id} initialScore={myScore} readonly />
+            ) : (
+              <CookedItReview
+                recipeId={id}
+                initialScore={myScore}
+                initialText={myRating?.reviewText ?? ""}
+                initialPhotoKey={myRating?.photoKey ?? null}
+              />
+            )}
           </div>
           <Separator />
           <CommentsSection recipeId={id} currentUserId={session.user.id} />

apps/web/app/api/v1/recipes/[id]/rate/route.ts

@@ -7,6 +7,7 @@ import { createNotification } from "@/lib/notifications";
 const Schema = z.object({
   score: z.number().int().min(1).max(5),
   reviewText: z.string().max(2000).optional(),
+  photoKey: z.string().max(500).optional(),
 });
 
 type Params = { params: Promise<{ id: string }> };
@@ -34,7 +35,12 @@ export async function POST(req: NextRequest, { params }: Params) {
 
   if (existing) {
     await db.update(ratings)
-      .set({ score: parsed.data.score, reviewText: parsed.data.reviewText, updatedAt: new Date() })
+      .set({
+        score: parsed.data.score,
+        reviewText: parsed.data.reviewText,
+        photoKey: parsed.data.photoKey,
+        updatedAt: new Date(),
+      })
       .where(eq(ratings.id, existing.id));
     return NextResponse.json({ updated: true });
   }
@@ -45,6 +51,7 @@ export async function POST(req: NextRequest, { params }: Params) {
     userId: session!.user.id,
     score: parsed.data.score,
     reviewText: parsed.data.reviewText,
+    photoKey: parsed.data.photoKey,
   });
   void createNotification({ userId: recipe.authorId, type: "rating", actorId: session!.user.id, recipeId: id });
   return NextResponse.json({ created: true }, { status: 201 });

apps/web/app/api/v1/recipes/[id]/reviews/route.ts

@@ -0,0 +1,42 @@
+import { NextRequest, NextResponse } from "next/server";
+import { db, recipes, ratings, eq, and, or, inArray, desc } from "@epicure/db";
+import { requireSession } from "@/lib/api-auth";
+
+type Params = { params: Promise<{ id: string }> };
+
+export async function GET(_req: NextRequest, { params }: Params) {
+  const { session, response } = await requireSession();
+  if (response) return response;
+  const { id } = await params;
+
+  const recipe = await db.query.recipes.findFirst({
+    where: and(
+      eq(recipes.id, id),
+      or(eq(recipes.authorId, session!.user.id), inArray(recipes.visibility, ["public", "unlisted"]))
+    ),
+    columns: { id: true },
+  });
+  if (!recipe) return NextResponse.json({ error: "Not found" }, { status: 404 });
+
+  const rows = await db.query.ratings.findMany({
+    where: eq(ratings.recipeId, id),
+    orderBy: desc(ratings.createdAt),
+    limit: 50,
+    with: {
+      user: { columns: { id: true, name: true, username: true, avatarUrl: true } },
+    },
+  });
+
+  const reviews = rows
+    .filter((r) => r.reviewText || r.photoKey)
+    .map((r) => ({
+      id: r.id,
+      score: r.score,
+      reviewText: r.reviewText,
+      photoKey: r.photoKey,
+      createdAt: r.createdAt,
+      user: r.user,
+    }));
+
+  return NextResponse.json({ data: reviews });
+}

apps/web/app/api/v1/upload/presign/route.ts

@@ -12,6 +12,7 @@ const Schema = z.object({
     message: "Content type must be jpeg, png, webp, or avif",
   }),
   recipeId: z.string().uuid(),
+  purpose: z.enum(["recipe", "review"]).default("recipe"),
 });
 
 export async function POST(req: NextRequest) {
@@ -24,15 +25,22 @@ export async function POST(req: NextRequest) {
     return NextResponse.json({ error: "Validation error", issues: parsed.error.issues }, { status: 400 });
   }
 
-  const owned = await db.query.recipes.findFirst({
-    where: and(eq(recipes.id, parsed.data.recipeId), eq(recipes.authorId, session!.user.id)),
-    columns: { id: true },
+  const { recipeId, contentType, purpose } = parsed.data;
+  const recipe = await db.query.recipes.findFirst({
+    where: purpose === "recipe"
+      ? and(eq(recipes.id, recipeId), eq(recipes.authorId, session!.user.id))
+      : eq(recipes.id, recipeId),
+    columns: { id: true, visibility: true, authorId: true },
   });
-  if (!owned) return NextResponse.json({ error: "Not found" }, { status: 404 });
+  if (!recipe) return NextResponse.json({ error: "Not found" }, { status: 404 });
+  if (purpose === "review" && recipe.visibility === "private" && recipe.authorId !== session!.user.id) {
+    return NextResponse.json({ error: "Not found" }, { status: 404 });
+  }
 
-  const ext = parsed.data.contentType.split("/")[1] ?? "jpg";
-  const key = `recipes/${parsed.data.recipeId}/photos/${session!.user.id}-${crypto.randomUUID()}.${ext}`;
-  const url = await createPresignedUploadUrl(key, parsed.data.contentType);
+  const ext = contentType.split("/")[1] ?? "jpg";
+  const folder = purpose === "review" ? "reviews" : "photos";
+  const key = `recipes/${recipeId}/${folder}/${session!.user.id}-${crypto.randomUUID()}.${ext}`;
+  const url = await createPresignedUploadUrl(key, contentType);
 
   return NextResponse.json({ url, key });
 }