Fix critical auth, billing, and data-loss regressions

[cursor]

Bug and impact

Several high-severity regressions remain on main (prior critical-fix PRs were never merged):

1. Milestone IDOR — Authenticated users can PATCH/DELETE any milestone by id (no project/owner scope).
2. Code-completion cross-tenant leak / unpaid AI — Unauthenticated callers can use AI completion and pull repo_files snippets across all tenants.
3. Scaffold / legacy analysis billing spoof — Client-supplied userId controls credit checks/deductions; UI often omits it so work runs free, or another user's balance can be charged.
4. Build This App false success + public repos + no charge — Generation/push failures still emit done; GitHub repos are created private: false; no credit charge/refund.
5. Analysis rerun data loss — Old blueprints are deleted before replacements are saved; a failed rerun wipes prior results.
6. Non-atomic credits / duplicate Stripe grants — Read-modify-write balances race under concurrency; webhook grants lack idempotency keys.
7. Pattern Analyzer / App Idea Chat credit loss — Credits deducted before work with no refund on AI/parse failures.

Root cause

Ownership and billing checks were incomplete or client-trusted on paid/mutating routes; analysis replacement and credit mutations were not fail-closed/atomic.

Fix

• Scope milestone mutations through project_id + projects.user_id.
• Require auth and user-scoped snippet fallback for code-completion.
• Bill authenticated user.id (precharge + refund on failure) for scaffold, legacy analyze, build-app, pattern analyzer, and app-idea chat.
• Create GitHub build repos private; fail SSE with error (no done) on generation/push failure; dedupe paths.
• Insert replacement blueprints first, then delete old ones except new IDs; reserve/release free-tier analysis usage.
• Atomic SQL deduct/refund/grant/renewal with idempotency_key support + migration.
• Added scripts/critical-regression-check.mjs source invariants.

Validation

• node scripts/critical-regression-check.mjs passed
• pnpm exec tsc --noEmit passed
• Targeted ESLint on changed runtime files: 0 errors (1 pre-existing unused warning in lib/queries.ts)
• git diff --check HEAD~1..HEAD passed

  

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
repo-app-architect	Ready	Preview	Aug 2, 2026 11:05am
repofuse	Ready	Preview, v0	Aug 2, 2026 11:05am
v0-repo-app-architect	Ready	Preview, v0	Aug 2, 2026 11:05am