Arnaud 3e71bd29a2 security: widen API-key auth to content/AI routes (v0.27.0) ...

Convert requireSession -> requireSessionOrApiKey across recipes,
collections, meal-plans, shopping-lists, pantry, feed, and ai/*
(52 routes) so API keys work end-to-end, not just for the handful of
endpoints that supported them before. Scope was explicitly confirmed
per-resource-family with the user before any file was touched.

Left session-cookie-only, deliberately: users/me*, ai-keys/*,
webhooks/*, conversations/*, notifications/*, push/subscribe, admin/*
— account/credential-adjacent surface that shouldn't widen without a
separate, explicit decision.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-07-14 11:20:26 +02:00

apps/web

security: widen API-key auth to content/AI routes (v0.27.0)

2026-07-14 11:20:26 +02:00

cron

feat: clear chat history manually, auto-expire old history after 90 days

2026-07-12 23:27:05 +02:00

packages/db

feat: Gravatar opt-in (off by default), configurable in Settings

2026-07-14 09:37:29 +02:00

traefik

chore: move docker/ compose files and infra to repo root

2026-07-11 20:25:38 +02:00

.dockerignore

chore: move docker/ compose files and infra to repo root

2026-07-11 20:25:38 +02:00

.env.example

feat: cooking history/gallery, unit conversion, nutrition diary, pantry scan, digest cron, nutrition-targeted meal plans

2026-07-10 08:06:28 +02:00

.gitignore

chore: init pnpm monorepo workspace

2026-07-01 08:08:29 +02:00

.npmrc

chore: init pnpm monorepo workspace

2026-07-01 08:08:29 +02:00

CHANGELOG.md

security: widen API-key auth to content/AI routes (v0.27.0)

2026-07-14 11:20:26 +02:00

CLAUDE.md

chore: move docker/ compose files and infra to repo root

2026-07-11 20:25:38 +02:00

compose.prod.yml

fix: photo thumbnails always used localhost:9000 in production

2026-07-12 13:53:15 +02:00

compose.yml

fix: MinIO CORS blocking browser uploads, changelog admin-only

2026-07-12 12:33:53 +02:00

DEPLOY.md

chore: move docker/ compose files and infra to repo root

2026-07-11 20:25:38 +02:00

Dockerfile

feat: clear chat history manually, auto-expire old history after 90 days

2026-07-12 23:27:05 +02:00

package.json

security: widen API-key auth to content/AI routes (v0.27.0)

2026-07-14 11:20:26 +02:00

pnpm-lock.yaml

feat: QR code on printed shopping lists

2026-07-13 22:50:38 +02:00

pnpm-workspace.yaml

chore: init pnpm monorepo workspace

2026-07-01 08:08:29 +02:00

tsconfig.base.json

chore: init pnpm monorepo workspace

2026-07-01 08:08:29 +02:00

S

Description

No description provided

12 MiB

Languages

TypeScript 99.2%

JavaScript 0.3%

CSS 0.2%

Dockerfile 0.2%