Fix critical auth and build failure regressions

[cursor]

Bug and impact

• /api/code-completion was unauthenticated and queried global repo_files, allowing cross-tenant snippet leakage and unauthenticated AI usage.
• Project milestone PATCH/DELETE accepted any milestone id from any signed-in user, enabling cross-user milestone tampering/deletion.
• Build This App converted generation and GitHub/GitLab push failures into successful SSE done events, leaving users with broken/incomplete repos while reporting success. GitHub repos were also created public by default.

Root cause

• Recent routes missed auth/owner predicates on DB reads and mutations.
• Build streaming swallowed generation/push errors and incremented success counters regardless of outcome.

Fix

• Require authenticated user.id for code completion and scope DB snippets through repositories.user_id.
• Scope milestone update/delete SQL by milestone id, route project id, and authenticated owner; return 404 when scoped mutation affects no row.
• Throw on push failures, stop on generation/empty-content failures, emit terminal SSE error without done, and create GitHub repos private by default.

Validation

• pnpm exec eslint app/api/code-completion/route.ts 'app/api/projects/[id]/milestones/[milestoneId]/route.ts' lib/queries.ts app/api/build-app/route.ts && pnpm exec tsc --noEmit passed (only known pre-existing lib/queries.ts warning).
• Temporary mocked route harness passed: unauth code-completion returned 401 without AI/DB work; snippet SQL included owner join/predicate; milestone SQL included project+owner predicates; build-app push/generation failures emitted error and no done, with private GitHub repo creation.

  

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
repo-app-architect	Ready	Preview, Comment	Jun 24, 2026 11:11am
repofuse	Ready	Preview, Comment, Open in v0	Jun 24, 2026 11:11am
v0-repo-app-architect	Ready	Preview, Comment, Open in v0	Jun 24, 2026 11:11am