Scaffold API routes with OpenAPI documentation - #24
Merged
Merged
Conversation
Related to #4 - Install Zod for validation and @scalar/nuxt for OpenAPI docs - Create shared utilities for API routes: * Response formatter with standardized success/error format * Auth middleware (requireAuth, optionalAuth, role checking) * Input validation helpers with Zod schemas * Rate limiting stubs (placeholder for production implementation) * OpenAPI documentation helpers and common schemas - Configure Scalar module for API documentation at /api-docs - Scaffold authentication routes: * POST /api/auth/github/login - GitHub OAuth initiation (501) * GET /api/auth/github/callback - OAuth callback handler (501) * GET /api/auth/session - Current session info - Scaffold organization routes: * POST /api/orgs - Create organization (501) * GET /api/orgs/[slug] - Get organization (501) - Scaffold project routes: * POST /api/orgs/[slug]/projects - Create project (501) * GET /api/projects/[slug] - Get project (501) - Scaffold feedback routes: * POST /api/feedback - Create feedback (501) * GET /api/feedback - List with filters/pagination (501) * GET /api/feedback/[id] - Get single feedback (501) * POST /api/feedback/[id]/vote - Toggle vote (501) - Scaffold GitHub integration routes: * POST /api/github/webhook - Receive webhook events (501) * GET /api/github/issues - Search issues (501) * POST /api/github/issues - Create issue from feedback (501) - Create OpenAPI 3.0 specification endpoint at /api/openapi.json - All routes include comprehensive OpenAPI documentation - Protected routes return 401 when unauthenticated - Unimplemented routes return 501 with consistent error format https://claude.ai/code/session_01VHP8WHUaGX3Wvqz7dRpUM3
- Add .github/workflows/ci.yml: four parallel jobs (lint, typecheck, test, build) on push to main and PRs targeting main, Node 20 LTS with yarn cache. Build step runs `npx nuxt build` directly to skip the postbuild hook that requires a live database. - Wire ESLint (flat config via @nuxt/eslint-config), Prettier, and Vitest as devDependencies; add lint, format:check, typecheck, and test scripts to package.json. - eslint.config.mjs: excludes shadcn-vue generated components/ui/, downgrades no-explicit-any to warn (drizzle ORM patterns). - Add vitest.config.ts and a first unit test (tests/utils.test.ts) covering the cn() helper. - Run Prettier over the entire repo so format:check is green from day one; fix the handful of lint errors that surfaced (dead imports, unused-var prefixes). - Add CI status badge to README. https://claude.ai/code/session_0143PEXicpSS8sXgc83Ljr9U
Resolved conflicts in NavUser, TeamSwitcher, auth.ts, and email.ts by taking the CI branch's cleaner Options API approach with consistent formatting from prettier/eslint. https://claude.ai/code/session_01Fy84J7B89N5ry8MyFzdDnR
Brings in scaffolded API routes for feedback, projects, organizations, GitHub integration, OpenAPI documentation, and server utilities (auth middleware, rate limiting, validation, response helpers). https://claude.ai/code/session_01Fy84J7B89N5ry8MyFzdDnR
Schema:
- Add customDomain field to project table with unique index
API Routes (implemented, replacing 501 stubs):
- POST /api/orgs/:slug/projects - Create project with default categories
- GET /api/orgs/:slug/projects - List org projects with feedback counts
- GET /api/projects/:slug - Get project details with categories
- GET /api/feedback - List feedback with filtering, sorting, pagination
- POST /api/feedback - Create feedback (supports anonymous submissions)
- POST /api/feedback/:id/vote - Toggle vote on feedback
Public API (new, no auth required):
- GET /api/public/:orgSlug/:projectSlug - Project info, stats, categories
- GET /api/public/:orgSlug/:projectSlug/feedback - Public feedback listing
- POST /api/public/:orgSlug/:projectSlug/feedback - Submit feedback publicly
Frontend:
- /products - Dashboard page for managing products per organization
- /p/:orgSlug/:projectSlug - Public feedback page (no layout/sidebar)
- Products link added to sidebar navigation
- /products added to protected routes in auth middleware
Infrastructure:
- hasOrganizationRole() now queries the member table
- Each product gets a public URL: /p/{org-slug}/{product-slug}
- Custom domains stored for future DNS-based routing
https://claude.ai/code/session_01Fy84J7B89N5ry8MyFzdDnR
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c03bdcd1a6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const [membership] = await db | ||
| .select() | ||
| .from(member) | ||
| .where(eq(member.organizationId, org.id)) |
There was a problem hiding this comment.
The authorization check only verifies that the organization has at least one member row, not that the current session user belongs to it. As written, any authenticated user can pass this guard for most organizations and read their project list/feedback counts. Add a member.userId === session.user.id condition to this query so access is scoped to the caller.
Useful? React with 👍 / 👎.
| projects = await db | ||
| .select() | ||
| .from(project) | ||
| .where(eq(project.slug, slug)) |
There was a problem hiding this comment.
When orgSlug is supplied, the code resolves the organization but then queries projects by slug only, so the org constraint is never applied. If multiple organizations use the same project slug, this endpoint can return the wrong tenant's project data despite the caller specifying an org, which breaks disambiguation and can leak cross-org data. Include project.organizationId = org.id in this branch's where clause.
Useful? React with 👍 / 👎.
- Implemented team creation and membership functionality. - Updated project schema to include team association. - Added endpoints for managing projects within teams. - Enhanced session management to support active team context. - Migrated existing data to accommodate new team structure. - Updated OpenAPI documentation to reflect new team and project relationships.
…onfigurations feat: enhance database connection handling in run-playwright-if-available script test: improve team-primary workspace spec with API interactions and session management
…ty in settings and sidebar components
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related to #4
https://claude.ai/code/session_01VHP8WHUaGX3Wvqz7dRpUM3