Put images behind the session and make routes private by default

The /minio-images rewrite proxied straight onto the MinIO bucket with no
authentication, and the bucket carries an anonymous read policy. Verified
from the public internet: GET /minio-images?list-type=2 returned a full
ListBucketResult naming all 33 objects, and any key then fetched 200. Every
menu scan, drink photo and bar photo was enumerable and downloadable by
anyone. Replaced with a route handler that requires a session and streams
via the existing getImage(). The URL shape is unchanged, so stored
imageUrls, uploadImage/getImageUrl and every <img> keep working.

Nothing uses next/image and it must stay that way here: the optimizer
fetches server-side without the session cookie.

Route protection was an allowlist that had to be updated by hand for each
new page, and had already been missed for /bar, /bartender and /recommend,
which rendered to logged-out visitors. /recipes was in the middleware
matcher but not the authorized() list, so it fell through too. Inverted
both to a denylist so new pages are private by default. /api stays out of
the matcher because authorized() answers with an HTML redirect and API
clients need the JSON 401 those routes already return.

Also fixes a cross-user write: POST /api/recipes took sourceDrinkId from
the client with no ownership check, and the drink detail page loaded its
recipes relation unfiltered, so one user could attach an arbitrary recipe
to another user's drink where it rendered permanently and the owner could
not delete it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/app/(app)/drinks/[id]/page.tsx

@@ -48,6 +48,9 @@ export default async function DrinkDetailPage({
         orderBy: { createdAt: "desc" },
       },
       recipes: {
+        // Defence in depth: the POST route now verifies drink ownership, but this
+        // relation would otherwise render any user's recipe on this drink's page.
+        where: { userId: session.user.id },
         orderBy: { createdAt: "desc" },
       },
     },

src/app/api/recipes/route.ts

@@ -72,6 +72,19 @@ export async function POST(request: Request) {
       )
     }
 
+    // sourceDrinkId comes from the client and is a foreign key onto Drink. Without
+    // this check a user could attach a recipe to someone else's drink, where it
+    // would render on their drink page and they could not delete it.
+    if (parsed.data.sourceDrinkId) {
+      const ownsDrink = await prisma.drink.findFirst({
+        where: { id: parsed.data.sourceDrinkId, userId: session.user.id },
+        select: { id: true },
+      })
+      if (!ownsDrink) {
+        return NextResponse.json({ error: "Drink not found" }, { status: 404 })
+      }
+    }
+
     const recipe = await prisma.recipe.create({
       data: {
         userId: session.user.id,

src/app/minio-images/[...key]/route.ts

@@ -0,0 +1,56 @@
+import { auth } from "@/lib/auth"
+import { getImage } from "@/lib/s3"
+
+/**
+ * Serves images out of object storage behind the session.
+ *
+ * This replaces a Next.js rewrite that proxied straight onto the MinIO bucket with
+ * no authentication. Combined with the bucket's anonymous read policy that made
+ * every image in the system enumerable and downloadable from the public internet -
+ * `GET /minio-images?list-type=2` returned a full ListBucketResult.
+ *
+ * The URL shape is deliberately unchanged, so everything that already stores or
+ * renders `/minio-images/...` keeps working: uploadImage/getImageUrl in lib/s3.ts,
+ * imageUrlSchema in lib/validators.ts, and every <img> in the app.
+ *
+ * Note the app renders images with plain <img>, not next/image. That matters: the
+ * image optimizer fetches server-side without the session cookie, so switching to
+ * next/image would 401 every image here.
+ */
+export const dynamic = "force-dynamic"
+
+export async function GET(
+  _request: Request,
+  { params }: { params: { key: string[] } }
+) {
+  const session = await auth()
+  if (!session?.user?.id) {
+    return new Response(null, { status: 401 })
+  }
+
+  const key = params.key.join("/")
+  if (key.includes("..")) {
+    return new Response(null, { status: 400 })
+  }
+
+  try {
+    const object = await getImage(key)
+    if (!object.Body) return new Response(null, { status: 404 })
+
+    return new Response(object.Body as unknown as ReadableStream, {
+      headers: {
+        "Content-Type": object.ContentType ?? "application/octet-stream",
+        ...(object.ContentLength
+          ? { "Content-Length": String(object.ContentLength) }
+          : {}),
+        // Keys embed a random UUID, so an object never changes under a given key.
+        // `private` keeps it out of any shared cache now that it is session-gated.
+        "Cache-Control": "private, max-age=31536000, immutable",
+      },
+    })
+  } catch {
+    // Missing key, or storage unavailable - do not distinguish, to avoid
+    // confirming whether a given key exists.
+    return new Response(null, { status: 404 })
+  }
+}