refactor: Code cleanup and deduplication

[PoshanP]

Summary

• Extract magic values to centralized constants (SWR intervals, panel dimensions, URL expiry)
• Create shared ChatMessage/ChatSession types to eliminate duplicate definitions
• Create reusable BaseModal component for collection modals, reducing boilerplate
• Consolidate useUserId hook pattern across data fetching hooks
• Remove unused code: cache.ts, QueryBuilder, validation helpers, context exports
• Fix duplicate CSS rules in globals.css
• Update RAG config to use centralized constants

Test plan

• Verify collection modals (create, edit, add to collection) work correctly
• Verify chat functionality with shared types
• Verify papers page loads with updated constants
• Run TypeScript compilation to confirm no type errors

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
thinkfolio	Ready	Preview, Comment	Jan 8, 2026 6:43pm

[PoshanP]

🔴 CRITICAL ISSUES

1. Security: Dangerous sanitizeInput Function Still in Production Use

Location: lib/validation/index.ts:1-18, used in app/api/papers/upload/route.ts:15-17

// This is fundamentally broken security:
const sqlPatterns = /(\b(SELECT|INSERT|UPDATE|DELETE|DROP|UNION|ALTER|CREATE)\b)/gi
let sanitized = input.replace(sqlPatterns, '')

Problems:

• Corrupts legitimate user data: A paper titled "Natural Language Processing for SELECT Query Optimization" becomes "Natural Language Processing for Query Optimization"
• Blacklist approach is bypassable: Unicode tricks, encoding, case variations can bypass this
• False sense of security: SQL injection should be prevented via parameterized queries (which Supabase already does!)
• Still actively used in the upload API for title sanitization

Recommendation: Remove this sanitization entirely. Supabase uses parameterized queries which prevent SQL injection. This code only corrupts user input.

---

2. Accessibility: BaseModal Lacks Critical WCAG Requirements

Location: frontend/components/collections/BaseModal.tsx

Missing:

• role="dialog" and aria-modal="true" attributes
• Focus trap: Users can Tab outside the modal to elements behind the backdrop
• Focus management: Focus doesn't move to modal on open or return on close
• Screen reader announcements: No aria-live or focus on title for announcements

This affects all three modal components using BaseModal.

---

🟠 SIGNIFICANT ISSUES

3. Type Safety Escape Hatches

Location: lib/db/index.ts:37

.insert(chunk as any) // Type safety bypassed

The batchInsert method uses as any which defeats TypeScript's purpose.

---

4. Inconsistent Type Definitions

• lib/types/chat.ts defines ChatMessage with session_id?: string (optional)
• But in actual usage, messages always have a session_id
• lib/types/index.ts still has Zod schemas (ChatMessageSchema) that duplicate these types
• Creates confusion about single source of truth

---

5. validateFileName Allows Non-PDF Extensions

Location: lib/validation/index.ts:34-35

const allowedExtensions = ['.pdf', '.jpg', '.jpeg', '.png', '.webp']

This is a PDF-only app per CLAUDE.md. Why allow image extensions?

---

🟡 CODE QUALITY CONCERNS

6. chat-new/page.tsx is 1014 Lines

This monolithic component handles:

• Session CRUD
• Message CRUD
• PDF viewing
• Responsive layouts
• URL parameters
• Processing status polling
• Summary generation
• Resize handling
• Keyboard navigation
• DOM manipulation (hiding navbar via useEffect)

Should be split into multiple components/hooks.