Promote test to main

[sweetmantech]

Promotes test to main.

Included since last promotion

• feat(api): migrate GET /api/accounts/{id}/catalogs #464 — feat: migrate GET /api/accounts/{id}/catalogs (squash 46a8e06)
• feat: migrate POST /api/social/scrape to /api/socials/{id}/scrape with auth #459 — feat: migrate POST /api/social/scrape to /api/socials/{id}/scrape with auth (squash 770a9f3)

Both migrations move endpoints behind the new account-scoped auth check (checkAccountAccess) and follow the hardened validate<X>Request + <X>Handler pattern.

Verification

• feat(api): migrate GET /api/accounts/{id}/catalogs #464 preview verified: feat(api): migrate GET /api/accounts/{id}/catalogs #464 (comment) — all five cases (401/400/404/403/200) passing.
• feat: migrate POST /api/social/scrape to /api/socials/{id}/scrape with auth #459 merged to test earlier via PR release: feat(socials) — promote POST /api/socials/{id}/scrape to main (#459) #467.

🤖 Generated with Claude Code

---

Summary by cubic

Promotes test to main, migrating catalogs and social scrape APIs to account-scoped routes with stricter auth, validation, and consistent responses.

• New Features

  • Added GET /api/accounts/{id}/catalogs with CORS, UUID validation, validateAuthContext + canAccessAccount, and Supabase-backed results via selectAccountCatalogs. Response matches the legacy { status, catalogs }.
  • Migrated social scrape to POST /api/socials/{id}/scrape behind account-scoped auth.

• Bug Fixes

  • Fixed access check to compare the caller’s account ID to the target path ID (no auth override), preventing false-positive access.
  • Masked internal errors on 500 responses from catalogs handler to avoid leaking exception details.

^{Written for commit 46a8e06. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
api	Ready	Preview	Apr 23, 2026 7:52pm

[coderabbitai]

Warning

Rate limit exceeded

@sweetmantech has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 56 minutes and 16 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 56 minutes and 16 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 7bdd94b6-7717-451c-b077-509c68f69069

📥 Commits

Reviewing files that changed from the base of the PR and between c2bde22 and 46a8e06.

⛔ Files ignored due to path filters (3)

• lib/catalog/__tests__/getCatalogsHandler.test.ts is excluded by !**/*.test.*, !**/__tests__/** and included by lib/**
• lib/catalog/__tests__/validateGetCatalogsRequest.test.ts is excluded by !**/*.test.*, !**/__tests__/** and included by lib/**
• lib/evals/getCatalogSongsCountExpected.ts is excluded by !**/evals/** and included by lib/**

📒 Files selected for processing (7)

• app/api/accounts/[id]/catalogs/route.ts
• lib/catalog/getCatalogs.ts
• lib/catalog/getCatalogsHandler.ts
• lib/catalog/validateGetCatalogsQuery.ts
• lib/catalog/validateGetCatalogsRequest.ts
• lib/mcp/tools/catalogs/registerGetCatalogsTool.ts
• lib/supabase/account_catalogs/selectAccountCatalogs.ts

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch test

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cubic-dev-ai]

3 issues found across 10 files

Confidence score: 3/5

• There is a concrete user-impact risk in lib/catalog/validateGetCatalogsRequest.ts: using canAccessAccount instead of the broader account-scoped checkAccountAccess pattern may incorrectly deny valid artist/workspace catalog access.
• app/api/accounts/[id]/catalogs/route.ts is flagged for export structure (OPTIONS and GET top-level exports), which introduces moderate integration/maintainability uncertainty even if behavior may still work.
• The test-size issue in lib/catalog/__tests__/validateGetCatalogsRequest.test.ts is lower severity and mainly maintainability-focused, so it does not by itself make this unmergeable.
• Pay close attention to lib/catalog/validateGetCatalogsRequest.ts and app/api/accounts/[id]/catalogs/route.ts - access-control correctness and route-module contract are the main risk areas.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="lib/catalog/__tests__/validateGetCatalogsRequest.test.ts">
<violation number="1" location="lib/catalog/__tests__/validateGetCatalogsRequest.test.ts:1">
P2: Custom agent: **Enforce Clear Code Style and Maintainability Practices**
Test file exceeds the repository’s 100-line limit.</violation>
</file>
<file name="app/api/accounts/[id]/catalogs/route.ts">
<violation number="1" location="app/api/accounts/[id]/catalogs/route.ts:10">
P2: Custom agent: **Module should export a single primary function whose name matches the filename**
Module exports multiple top-level functions (`OPTIONS` and `GET`) instead of a single primary export matching the filename.</violation>
</file>
<file name="lib/catalog/validateGetCatalogsRequest.ts">
<violation number="1" location="lib/catalog/validateGetCatalogsRequest.ts:55">
P1: This authorization check uses `canAccessAccount`, which is narrower than the account-scoped `checkAccountAccess` pattern and can incorrectly deny valid artist/workspace access.</violation>
</file>

Architecture diagram

sequenceDiagram
participant Client
participant API as Catalogs API Route
participant Validator as Request Validator
participant Auth as Auth Context
participant DB as Supabase DB
Note over Client, DB: GET /api/accounts/{id}/catalogs Flow
Client->>API: GET /api/accounts/{id}/catalogs
API->>Validator: NEW: validateGetCatalogsRequest(request, id)
Validator->>Validator: Validate ID is UUID
alt Invalid UUID
Validator-->>API: 400 Bad Request
API-->>Client: 400 Error
end
Validator->>Auth: validateAuthContext(request)
Auth-->>Validator: authResult (caller accountId)
alt Auth failed
Auth-->>API: 401 Unauthorized
API-->>Client: 401 Error
end
Validator->>DB: selectAccounts(targetId)
DB-->>Validator: Account record
alt Account not found
Validator-->>API: 404 Not Found
API-->>Client: 404 Error
end
Validator->>Validator: NEW: canAccessAccount(callerId, targetId)
alt Access Denied
Validator-->>API: 403 Forbidden
API-->>Client: 403 Error
end
Validator-->>API: Validated accountId
API->>DB: CHANGED: selectAccountCatalogs(accountId)
Note right of DB: Query filtered by account_id<br/>Ordered by created_at desc
alt Success
DB-->>API: Catalog list
API-->>Client: 200 OK (status, catalogs)
else DB Error
DB-->>API: Exception
API->>API: Mask internal details
API-->>Client: 500 Internal Server error
end
Note over Client, DB: POST /api/socials/{id}/scrape (similar auth pattern)

Loading

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P1: This authorization check uses canAccessAccount, which is narrower than the account-scoped checkAccountAccess pattern and can incorrectly deny valid artist/workspace access.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At lib/catalog/validateGetCatalogsRequest.ts, line 55:
<comment>This authorization check uses `canAccessAccount`, which is narrower than the account-scoped `checkAccountAccess` pattern and can incorrectly deny valid artist/workspace access.</comment>
<file context>
@@ -0,0 +1,67 @@
+ );
+ }
+
+ const hasAccess = await canAccessAccount({
+ currentAccountId: authResult.accountId,
+ targetAccountId: accountId,
</file context>

[cubic-dev-ai]

P2: Custom agent: Enforce Clear Code Style and Maintainability Practices

Test file exceeds the repository’s 100-line limit.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At lib/catalog/__tests__/validateGetCatalogsRequest.test.ts, line 1:
<comment>Test file exceeds the repository’s 100-line limit.</comment>
<file context>
@@ -0,0 +1,129 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { NextRequest, NextResponse } from "next/server";
+
</file context>

[cubic-dev-ai]

P2: Custom agent: Module should export a single primary function whose name matches the filename

Module exports multiple top-level functions (OPTIONS and GET) instead of a single primary export matching the filename.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At app/api/accounts/[id]/catalogs/route.ts, line 10:
<comment>Module exports multiple top-level functions (`OPTIONS` and `GET`) instead of a single primary export matching the filename.</comment>
<file context>
@@ -0,0 +1,29 @@
+ *
+ * @returns A NextResponse with CORS headers.
+ */
+export async function OPTIONS() {
+ return new NextResponse(null, {
+ status: 200,
</file context>