Fix critical auth, billing, and data-loss regressions

[cursor]

Bug and impact

Several high-severity regressions remain on main (prior fix PRs #88–#122 still unmerged):

1. Milestone IDOR — Authenticated users can PATCH/DELETE any milestone by ID (no project/user ownership check).
2. Code-completion data leak — /api/code-completion has no auth and reads repo_files without user_id scoping.
3. Scaffold credit theft — /api/generate-scaffold trusts body userId for balance checks and deduction, so credits can be charged to another user.
4. Build-app unsafe success — Creates public GitHub repos, treats push failures as success, and does not charge credits.
5. Analysis data loss — /api/analyses/[id]/run deletes existing blueprints before replacement succeeds.
6. Non-atomic credits — deductCredits uses read-modify-write without balance guards or idempotency keys (race can overdraft / double-charge).

Root cause

Ownership and billing checks were incomplete or client-trusted on critical write paths; analysis reruns delete durable blueprint rows before a successful regeneration; credit updates are not atomic.

Fix

Cherry-pick of the validated fix set (same as PR #122 / 3412ffa) onto current main (5e3ab19):

• Scope milestone mutations to the owning project/user
• Require auth and user-scoped file reads for code completion
• Charge the authenticated user only for scaffold/build/analyze paths
• Make build-app fail closed on push errors; create private repos; deduct credits
• Defer blueprint deletion until replacement content is ready
• Atomic credit deductions + idempotency migration/helpers
• scripts/critical-regression-check.mjs locks invariants

Validation

• node scripts/critical-regression-check.mjs passed
• pnpm exec tsc --noEmit passed
• Targeted ESLint on changed files: 0 errors (1 pre-existing unused allowed warning in lib/queries.ts)

  

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
repo-app-architect	Ready	Preview	Aug 10, 2026 11:02am
repofuse	Ready	Preview, v0	Aug 10, 2026 11:02am
v0-repo-app-architect	Ready	Preview, v0	Aug 10, 2026 11:02am