Fix critical auth, billing, and data-loss regressions

[cursor]

Bug and impact

Several high-severity regressions remain on main (still at 1524f3f; prior fix PRs #88–#119 are open/unmerged):

1. Milestone IDOR — Authenticated users can PATCH/DELETE any milestone by ID (no project/user ownership check).
2. Code completion cross-tenant leak / unauth paid AI — /api/code-completion has no auth and reads repo_files without user_id filter.
3. Scaffold / legacy analyze billing spoof — Routes trust body userId for credit checks/deductions.
4. Build-app false success / no charge — Public GitHub repos, SSE done on generation/push failure, missing charge/refund paths.
5. Analysis rerun data loss — deleteBlueprintsByAnalysis runs before replacement succeeds.
6. Non-atomic credits — Read-modify-write grant/deduct/refund races; missing Stripe idempotency keys.
7. Paid AI charged on failure — Pattern Analyzer / App Idea Chat deduct without refunding failures.

Root cause

Authz and billing checks were incomplete on newer project/build/scaffold paths, and credit mutations were non-atomic. Analysis replacement deleted old blueprints before the new run completed.

Fix

Minimal, previously validated fix (cherry-pick of dffa26f / PR #119 onto current main):

• Scope milestone mutations to project + owning user
• Require auth and tenant filter for code completion
• Bill only the authenticated user for scaffold/legacy analyze
• Fail closed on build generation/push errors; charge/refund correctly
• Replace blueprints safely after successful generation
• Atomic credit updates + Stripe idempotency
• Refund failed Pattern Analyzer / App Idea Chat charges

Validation

• node scripts/critical-regression-check.mjs passed
• pnpm exec tsc --noEmit passed
• Targeted ESLint on touched files: 0 errors (1 pre-existing unused-var warning in lib/queries.ts)
• git diff --check HEAD~1..HEAD passed

  

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
repo-app-architect	Ready	Preview	Aug 7, 2026 11:04am
repofuse	Ready	Preview, v0	Aug 7, 2026 11:04am
v0-repo-app-architect	Ready	Preview, v0	Aug 7, 2026 11:04am