Arnaud
7626f1b496
Security audit fixes (see SECURITY_AUDIT.md): - lib/tiers.ts: checkAndIncrementTierLimit's recipe/storage branches did a live count/sum check with no lock tying it to the later write, so two concurrent requests near the cap could both pass and both write past the limit. Added checkTierLimitInTransaction — holds a per-user Postgres advisory lock for the duration of the caller's transaction, so the check and the write are atomic together. Applied to every recipe/storage write path (recipes create/update, fork, rate, avatar, and 7 AI recipe-creation routes). - Adversarial re-verification of that fix caught a bigger gap in the same area: four AI routes (photo import, idea generation, batch-cook, translate-to-new-draft) had no recipe-limit check at all. Fixed. - Added missing per-user rate limits to 5 AI endpoints (adapt, drinks, pairings, translate, variations) that had none, unlike their siblings. - search page now checks for a session server-side, matching every other page under (app)/ — defense in depth; the underlying API was already public by design and proxy.ts already blocked unauthenticated requests. - admin/settings route now uses the shared requireAdmin instead of a local duplicate. - Documented two admin support-ticket endpoints missing from the OpenAPI spec; verified full route/OpenAPI parity otherwise. - Bumped drizzle-orm to fix a SQL-identifier-escaping CVE, and overrode two transitive deps (esbuild, postcss) with known CVEs. pnpm audit is clean. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
24 lines
632 B
JSON
24 lines
632 B
JSON
{
|
|
"name": "epicure",
|
|
"version": "0.60.0",
|
|
"private": true,
|
|
"scripts": {
|
|
"dev": "pnpm --filter web dev",
|
|
"build": "pnpm --filter web build",
|
|
"lint": "pnpm -r lint",
|
|
"typecheck": "pnpm -r typecheck",
|
|
"db:generate": "pnpm --filter @epicure/db generate",
|
|
"db:migrate": "pnpm --filter @epicure/db migrate",
|
|
"db:seed": "pnpm --filter @epicure/db seed",
|
|
"db:backfill-usernames": "pnpm --filter @epicure/db backfill-usernames",
|
|
"db:studio": "pnpm --filter @epicure/db studio"
|
|
},
|
|
"devDependencies": {
|
|
"typescript": "^5.8.3"
|
|
},
|
|
"engines": {
|
|
"node": ">=22",
|
|
"pnpm": ">=11"
|
|
}
|
|
}
|