serfowiandClaude Opus 5
66dd4ac942
Stands up packages/api so the swipe path stops trusting its caller, and puts the auth library behind an interface we own. - packages/api: tRPC v11 with a Session type WE define, not one re-exported from an auth library. Swapping providers means rewriting one SessionResolver, not touching a router. - Procedure layers: public / protected / client / pro / verifiedPro / admin. Admin routes 404 rather than 403 so they cannot be probed. - deck router replaces the untrusted server action. Ownership is checked on every operation and returns NOT_FOUND, never FORBIDDEN, so job ids cannot be enumerated. 23 tests, mostly authorization. - packages/storage: presigned direct-to-R2 uploads. The server picks the key, so a caller can only write under their own user id. 14 tests. Three defects found and fixed: - The lazy db Proxy failed drizzle's is(db, PgDatabase) because it did not trap getPrototypeOf. Auth adapters dispatch on exactly that check, so this would have failed at runtime inside third-party code. Fixed and pinned with a regression test. - The open-request cap was a read-then-write race: concurrent swipes could both read 4 and both insert. Now one transaction with the job row locked. The cap is checked before the tombstone is written, so a rejected swipe leaves no trace and the card stays on the deck. - superjson was configured in two of the three required places. Without the QueryClient dehydrate/hydrate pair, RSC-prefetched data arrives as a raw envelope with no type error to warn you. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
19 lines
526 B
TypeScript
19 lines
526 B
TypeScript
import { router } from './trpc';
|
|
import { deckRouter } from './routers/deck';
|
|
import { jobRouter } from './routers/job';
|
|
import { proRouter } from './routers/pro';
|
|
import { uploadRouter } from './routers/upload';
|
|
|
|
/**
|
|
* The API surface. A future React Native app imports `AppRouter` from this
|
|
* package and gets the entire typed contract with no duplication.
|
|
*/
|
|
export const appRouter = router({
|
|
job: jobRouter,
|
|
deck: deckRouter,
|
|
pro: proRouter,
|
|
upload: uploadRouter,
|
|
});
|
|
|
|
export type AppRouter = typeof appRouter;
|