refactor(sandbox): extract validateSandboxReconnectRequest + fix preview build

Two changes bundled:
1) SRP per review feedback (sweetmantech) — extract the auth +
sessionId-from-query + session lookup + ownership check pre-flight
from `getSandboxReconnectHandler` into its own
`validateSandboxReconnectRequest.ts`. Mirrors the
`validateCreateSandboxBody` pattern: returns either a 4xx
NextResponse describing the first failure, or `{ row, auth }` for
the handler to consume.
2) Type fix for `next build` — `connectSandbox(row.sandbox_state as
SandboxState)` failed to compile against `Json` (union includes
primitives + arrays); cast through `unknown` first. The
`hasRuntimeSandboxState` gate above ensures the runtime shape is
safe at the call site, so the double cast is justified — comment
added explaining why.
The vitest pass alone wasn't enough to catch the type error — `next
build` runs a separate `tsc` step that the test runner skips. Caught
by the Vercel preview build failing on the previous commit.
TDD red -> green:
- 5 unit tests for the new validator covering auth fail (passes
through), missing sessionId (400), session not found (404),
ownership mismatch (403), and happy-path return shape ({row, auth})
- Existing handler tests pass unchanged — the module-level mocks for
validateAuthContext / selectSessions still intercept the calls now
that they're behind the new validator
- Suite: 2529 -> 2534, pnpm lint:check clean
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: sweetmantech

lib/sandbox/__tests__/validateSandboxReconnectRequest.test.ts

@@ -0,0 +1,81 @@
+import{describe,it,expect,vi,beforeEach}from"vitest";
+import{NextRequest,NextResponse}from"next/server";
+
+import{validateSandboxReconnectRequest}from"@/lib/sandbox/validateSandboxReconnectRequest";
+import{validateAuthContext}from"@/lib/auth/validateAuthContext";
+import{selectSessions}from"@/lib/supabase/sessions/selectSessions";
+
+vi.mock("@/lib/networking/getCorsHeaders",()=>({
+getCorsHeaders: ()=>({"Access-Control-Allow-Origin": "*"}),
+}));
+vi.mock("@/lib/auth/validateAuthContext",()=>({
+validateAuthContext: vi.fn(),
+}));
+vi.mock("@/lib/supabase/sessions/selectSessions",()=>({
+selectSessions: vi.fn(),
+}));
+
+constACCOUNT_ID="acc-1";
+constbaseRow={id: "sess-1",account_id: ACCOUNT_ID}asnever;
+
+functionmakeReq(query="?sessionId=sess-1"): NextRequest{
+returnnewNextRequest(`http://localhost/api/sandbox/reconnect${query}`,{method: "GET"});
+}
+
+describe("validateSandboxReconnectRequest",()=>{
+beforeEach(()=>{
+vi.clearAllMocks();
+vi.mocked(validateAuthContext).mockResolvedValue({
+accountId: ACCOUNT_ID,
+orgId: null,
+authToken: "k",
+});
+});
+
+it("returns the auth response unchanged when auth fails",async()=>{
+constfail=NextResponse.json({status: "error",error: "Unauthorized"},{status: 401});
+vi.mocked(validateAuthContext).mockResolvedValueOnce(fail);
+
+constresult=awaitvalidateSandboxReconnectRequest(makeReq());
+
+expect(result).toBe(fail);
+});
+
+it("returns 400 when sessionId is missing from the query",async()=>{
+constresult=awaitvalidateSandboxReconnectRequest(makeReq(""));
+
+expect(result).toBeInstanceOf(NextResponse);
+expect((resultasNextResponse).status).toBe(400);
+});
+
+it("returns 404 when no session exists with the given id",async()=>{
+vi.mocked(selectSessions).mockResolvedValue([]);
+
+constresult=awaitvalidateSandboxReconnectRequest(makeReq());
+
+expect(result).toBeInstanceOf(NextResponse);
+expect((resultasNextResponse).status).toBe(404);
+});
+
+it("returns 403 when the session is not owned by the authenticated account",async()=>{
+vi.mocked(selectSessions).mockResolvedValue([
+{ ...baseRow,account_id: "someone-else"}asnever,
+]);
+
+constresult=awaitvalidateSandboxReconnectRequest(makeReq());
+
+expect(result).toBeInstanceOf(NextResponse);
+expect((resultasNextResponse).status).toBe(403);
+});
+
+it("returns the validated row + auth on the happy path",async()=>{
+vi.mocked(selectSessions).mockResolvedValue([baseRow]);
+
+constresult=awaitvalidateSandboxReconnectRequest(makeReq());
+
+expect(result).not.toBeInstanceOf(NextResponse);
+if(resultinstanceofNextResponse)return;
+expect(result.row.id).toBe("sess-1");
+expect(result.auth.accountId).toBe(ACCOUNT_ID);
+});
+});

lib/sandbox/getSandboxReconnectHandler.ts

@@ -1,11 +1,10 @@
 import{NextRequest,NextResponse}from"next/server";
 import{getCorsHeaders}from"@/lib/networking/getCorsHeaders";
-import{validateAuthContext}from"@/lib/auth/validateAuthContext";
 import{buildLifecycle}from"@/lib/sandbox/buildLifecycle";
 import{connectSandbox}from"@/lib/sandbox/factory";
 import{hasRuntimeSandboxState}from"@/lib/sandbox/hasRuntimeSandboxState";
 import{noSandboxResponse}from"@/lib/sandbox/noSandboxResponse";
-import{selectSessions}from"@/lib/supabase/sessions/selectSessions";
+import{validateSandboxReconnectRequest}from"@/lib/sandbox/validateSandboxReconnectRequest";
 import{updateSession}from"@/lib/supabase/sessions/updateSession";
 importtype{SandboxState}from"@/lib/sandbox/factory";
 
@@ -31,42 +30,21 @@ interface ReconnectBody {
  * `GET /api/sandbox/status` agree with the probe.
  */
 exportasyncfunctiongetSandboxReconnectHandler(request: NextRequest): Promise<NextResponse>{
-constauth=awaitvalidateAuthContext(request);
-if(authinstanceofNextResponse){
-returnauth;
-}
-
-constsessionId=request.nextUrl.searchParams.get("sessionId");
-if(!sessionId){
-returnNextResponse.json(
-{status: "error",error: "Missing sessionId"},
-{status: 400,headers: getCorsHeaders()},
-);
-}
-
-constrows=awaitselectSessions({id: sessionId});
-constrow=rows[0];
-
-if(!row){
-returnNextResponse.json(
-{status: "error",error: "Session not found"},
-{status: 404,headers: getCorsHeaders()},
-);
-}
-
-if(row.account_id!==auth.accountId){
-returnNextResponse.json(
-{status: "error",error: "Forbidden"},
-{status: 403,headers: getCorsHeaders()},
-);
+constvalidated=awaitvalidateSandboxReconnectRequest(request);
+if(validatedinstanceofNextResponse){
+returnvalidated;
 }
+const{ row }=validated;
 
 if(!hasRuntimeSandboxState(row.sandbox_state)){
 returnnoSandboxResponse(row);
 }
 
 try{
-constsandbox=awaitconnectSandbox(row.sandbox_stateasSandboxState);
+// Safe cast: hasRuntimeSandboxState above narrowed sandbox_state to an
+// object with a non-empty `sandboxName` — but the Json type is wider, so
+// TS needs the unknown bridge to accept the conversion.
+constsandbox=awaitconnectSandbox(row.sandbox_stateasunknownasSandboxState);
 awaitsandbox.exec("pwd",sandbox.workingDirectory,PROBE_TIMEOUT_MS);
 
 constbody: ReconnectBody={
@@ -78,9 +56,9 @@ export async function getSandboxReconnectHandler(request: NextRequest): Promise<
 returnNextResponse.json(body,{status: 200,headers: getCorsHeaders()});
 }catch(error){
 constmessage=errorinstanceofError ? error.message : String(error);
-console.warn(`[getSandboxReconnectHandler] probe failed for ${sessionId}: ${message}`);
+console.warn(`[getSandboxReconnectHandler] probe failed for ${row.id}: ${message}`);
 
-awaitupdateSession(sessionId,{
+awaitupdateSession(row.id,{
 sandbox_state: null,
 lifecycle_state: "hibernated",
 sandbox_expires_at: null,

lib/sandbox/validateSandboxReconnectRequest.ts

@@ -0,0 +1,60 @@
+import{NextRequest,NextResponse}from"next/server";
+import{getCorsHeaders}from"@/lib/networking/getCorsHeaders";
+import{validateAuthContext}from"@/lib/auth/validateAuthContext";
+importtype{AuthContext}from"@/lib/auth/validateAuthContext";
+import{selectSessions}from"@/lib/supabase/sessions/selectSessions";
+importtype{Tables}from"@/types/database.types";
+
+exportinterfaceValidatedSandboxReconnectRequest{
+row: Tables<"sessions">;
+auth: AuthContext;
+}
+
+/**
+ * Validates a `GET /api/sandbox/reconnect` request end-to-end:
+ * 1. Authenticates the caller via Privy Bearer / x-api-key
+ * 2. Requires a `sessionId` query parameter
+ * 3. Looks up the session row
+ * 4. Enforces ownership (the authed account must match `account_id`)
+ *
+ * Returns either a 4xx NextResponse describing the first failure, or
+ * the validated `{ row, auth }` ready for the handler to consume.
+ *
+ * @param request - The incoming GET request.
+ * @returns A NextResponse on validation failure, or the validated row + auth.
+ */
+exportasyncfunctionvalidateSandboxReconnectRequest(
+request: NextRequest,
+): Promise<NextResponse|ValidatedSandboxReconnectRequest>{
+constauth=awaitvalidateAuthContext(request);
+if(authinstanceofNextResponse){
+returnauth;
+}
+
+constsessionId=request.nextUrl.searchParams.get("sessionId");
+if(!sessionId){
+returnNextResponse.json(
+{status: "error",error: "Missing sessionId"},
+{status: 400,headers: getCorsHeaders()},
+);
+}
+
+constrows=awaitselectSessions({id: sessionId});
+constrow=rows[0];
+
+if(!row){
+returnNextResponse.json(
+{status: "error",error: "Session not found"},
+{status: 404,headers: getCorsHeaders()},
+);
+}
+
+if(row.account_id!==auth.accountId){
+returnNextResponse.json(
+{status: "error",error: "Forbidden"},
+{status: 403,headers: getCorsHeaders()},
+);
+}
+
+return{ row, auth };
+}