Fix critical auth, billing, and data-loss regressions

[cursor]

Summary

main is still at 1524f3f with prior critical-fix PRs (#88–#118) unmerged. This reapplies the validated fix set so production-bound code no longer ships with high-severity auth, billing, and data-loss bugs.

Bugs and impact

1. Milestone PATCH/DELETE IDOR — any authenticated user could toggle/delete another user's milestones by ID.
2. /api/code-completion unauthenticated + cross-tenant leak — paid AI usable without auth; repo_files fallback returned snippets across all tenants.
3. Scaffold / legacy analyze trusted body userId — callers could skip billing or charge another user.
4. /api/build-app false success / public repos / no charge — generation/push failures still emitted SSE done; repos created public; no credit charge/refund path.
5. Analysis rerun data loss — blueprints deleted before replacement succeeded.
6. Non-atomic credits — grant/deduct/refund race-prone; Stripe webhook missing idempotency key.
7. Pattern Analyzer / App Idea Chat — charged AI failures without refund.

Root cause

Auth checks stopped at "is signed in" without ownership scoping; several paid routes trusted client-supplied identity or reported success before durable writes completed; credit mutations were read-modify-write without row locks / idempotency.

Fix

Cherry-pick of validated commit from PR #118 (bb10a91) onto current main:

• Scope milestone mutations to (projectId, milestoneId, userId)
• Require auth and tenant-filter code-completion snippets
• Bind scaffold/analyze billing to session user
• Fail-closed build-app stream; private repos; charge/refund
• Safe blueprint replacement (delete only after success / except new IDs)
• Atomic credit ops + Stripe idempotency key
• Refund on pattern-analyzer / app-idea-chat failures

Validation

• node scripts/critical-regression-check.mjs — passed
• pnpm exec tsc --noEmit — passed
• Targeted ESLint on changed files — 0 errors (1 pre-existing unused-var warning in lib/queries.ts)

  

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
repo-app-architect	Ready	Preview	Aug 5, 2026 11:06am
repofuse	Ready	Preview, v0	Aug 5, 2026 11:06am
v0-repo-app-architect	Ready	Preview, v0	Aug 5, 2026 11:06am