Arnaud
7626f1b496
Security audit fixes (see SECURITY_AUDIT.md): - lib/tiers.ts: checkAndIncrementTierLimit's recipe/storage branches did a live count/sum check with no lock tying it to the later write, so two concurrent requests near the cap could both pass and both write past the limit. Added checkTierLimitInTransaction — holds a per-user Postgres advisory lock for the duration of the caller's transaction, so the check and the write are atomic together. Applied to every recipe/storage write path (recipes create/update, fork, rate, avatar, and 7 AI recipe-creation routes). - Adversarial re-verification of that fix caught a bigger gap in the same area: four AI routes (photo import, idea generation, batch-cook, translate-to-new-draft) had no recipe-limit check at all. Fixed. - Added missing per-user rate limits to 5 AI endpoints (adapt, drinks, pairings, translate, variations) that had none, unlike their siblings. - search page now checks for a session server-side, matching every other page under (app)/ — defense in depth; the underlying API was already public by design and proxy.ts already blocked unauthenticated requests. - admin/settings route now uses the shared requireAdmin instead of a local duplicate. - Documented two admin support-ticket endpoints missing from the OpenAPI spec; verified full route/OpenAPI parity otherwise. - Bumped drizzle-orm to fix a SQL-identifier-escaping CVE, and overrode two transitive deps (esbuild, postcss) with known CVEs. pnpm audit is clean. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
30 lines
679 B
JSON
30 lines
679 B
JSON
{
|
|
"name": "@epicure/db",
|
|
"version": "0.0.0",
|
|
"private": true,
|
|
"type": "module",
|
|
"main": "./src/index.ts",
|
|
"exports": {
|
|
".": "./src/index.ts",
|
|
"./schema": "./src/schema/index.ts"
|
|
},
|
|
"scripts": {
|
|
"generate": "drizzle-kit generate",
|
|
"migrate": "drizzle-kit migrate",
|
|
"studio": "drizzle-kit studio",
|
|
"seed": "tsx src/seed.ts",
|
|
"backfill-usernames": "tsx src/backfill-usernames.ts",
|
|
"typecheck": "tsc --noEmit"
|
|
},
|
|
"dependencies": {
|
|
"drizzle-orm": "^0.45.2",
|
|
"postgres": "^3.4.7"
|
|
},
|
|
"devDependencies": {
|
|
"@types/node": "^20.19.43",
|
|
"drizzle-kit": "^0.31.1",
|
|
"tsx": "^4.20.3",
|
|
"typescript": "^5.8.3"
|
|
}
|
|
}
|