Fix critical auth, billing, and data-loss regressions

[cursor]

Bug and impact

Several high-severity regressions remain on main (including after #85). Concrete triggers:

1. Milestone IDOR — Any authenticated user can PATCH/DELETE another user's milestone by ID (toggleMilestone/deleteMilestone are not scoped to project/user).
2. Code-completion data leak — /api/code-completion has no auth and queries repo_files without user_id, exposing other users' AI summaries/paths.
3. Scaffold / legacy analyze billing bypass — Routes trust body userId for credit checks/deductions, so a caller can charge another user or skip charging themselves.
4. Build-app incorrect success / unpaid builds / public repos — Failed file pushes were warned and ignored; builds were not charged; GitHub repos were created public by default.
5. Analysis rerun data loss — deleteBlueprintsByAnalysis runs before replacement succeeds, so a failed rerun permanently wipes blueprints.
6. Non-atomic credits — Read-modify-write balance updates race and can overdraw / lose accounting fidelity; renewals lack idempotency.

Root cause

Ownership and auth checks were incomplete on newer project/completion/billing paths; destructive analysis cleanup ran too early; credit mutations were not conditional/atomic.

Fix

Minimal, previously validated fix (cherry-pick of e66c756 / PR #121 onto current main after #85):

• Scope milestone mutations to the caller's project
• Require auth + user-scoped file lookup for code completion
• Bill the authenticated user only for scaffold/analyze/build
• Charge build-app with refund-on-failure; private repos; fail hard on push errors
• Defer blueprint deletion until replacement succeeds
• Atomic credit deduct/grant/renew with optional idempotency keys + migration
• Add scripts/critical-regression-check.mjs

Validation

• node scripts/critical-regression-check.mjs passed
• pnpm exec tsc --noEmit passed
• Targeted ESLint on touched files: 0 errors (1 pre-existing unused allowed warning in lib/queries.ts)

Supersedes open duplicates #88–#121 for the same unmerged fix set on updated main (5e3ab19).

  

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
repo-app-architect	Ready	Preview	Aug 9, 2026 11:02am
repofuse	Ready	Preview, v0	Aug 9, 2026 11:02am
v0-repo-app-architect	Ready	Preview, v0	Aug 9, 2026 11:02am