Test

[sweetmantech]

Summary by cubic

Allow Recoup admins to access any chat across accounts by ID. validateChatAccess now grants access to the room owner first, and only checks checkIsAdmin if ownership fails, keeping the common path fast.

• New Features
  • Admin bypass via checkIsAdmin applies to all endpoints using validateChatAccess (read and write).
  • No account override params; access is resolved from roomId, and admin access returns the room’s owner accountId.
  • Tests added for admin access and to ensure the owner path skips the admin check; updated test mocks for the new dependency.

^{Written for commit 8b6a3bb. Summary will update on new commits.}

Summary by CodeRabbit

• Bug Fixes
  • Improved chat access handling so room owners continue to have access, and admins can now open chats they don’t own.
  • Standardized denied-access responses with a consistent “Access denied to this chat” message.
  • Simplified access checks to reduce unexpected denial cases when ownership data is unavailable.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
api	Building	Preview	Jun 23, 2026 2:15pm

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: ca66b2f8-066b-445b-a966-5d8729d0d1d0

📥 Commits

Reviewing files that changed from the base of the PR and between 34298fc and 8b6a3bb.

⛔ Files ignored due to path filters (2)

• lib/chats/__tests__/getChatArtistHandler.test.ts is excluded by !**/*.test.*, !**/__tests__/** and included by lib/**
• lib/chats/__tests__/validateChatAccess.test.ts is excluded by !**/*.test.*, !**/__tests__/** and included by lib/**

📒 Files selected for processing (1)

• lib/chats/validateChatAccess.ts

---

📝 Walkthrough

Walkthrough

Updates chat authorization so room owners still pass directly, non-owner admins gain an explicit fallback access path, and all other denied requests now return a single fixed 403 message.

Changes

Chat access authorization

Layer / File(s)	Summary
Owner and admin access flow lib/chats/validateChatAccess.ts	Imports checkIsAdmin, updates the function comment to describe owner-first and admin-fallback access, and rewrites the non-owner branch to allow admins or return a fixed "Access denied to this chat" 403 response.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• recoupable/api#694: Also updates lib/chats/validateChatAccess.ts authorization behavior and ownership/account handling.

Poem

A chat room door got a cleaner key,
First the owner checks, as it should be.
If not, an admin may step through,
Else “access denied” comes plain and true.
Small guards in line, neat as can be.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch test

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cubic-dev-ai]

No issues found across 3 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

Architecture diagram

sequenceDiagram
    participant Client as Client (Next.js)
    participant API as Chat API Handler
    participant V as validateChatAccess
    participant Auth as validateAuthContext
    participant DB as Supabase (selectRoom)
    participant BGP as buildGetChatsParams
    participant Admin as checkIsAdmin

    Note over Client,Admin: Chat Access Validation Flow

    Client->>API: Request (roomId, auth token)
    API->>V: validateChatAccess(request, roomId)

    V->>Auth: Validate auth context
    Auth-->>V: { accountId }

    V->>V: Validate roomId UUID format
    alt Invalid UUID
        V-->>API: 400 Bad Request
        API-->>Client: Error response
    end

    V->>DB: selectRoom(roomId)
    DB-->>V: { id, account_id, ... }

    alt Room not found
        V-->>API: 404 Not Found
        API-->>Client: Error response
    end

    V->>BGP: buildGetChatsParams({ account_id })
    BGP-->>V: { params, error }

    alt Owner check succeeds (common fast path)
        Note over V: room.account_id is in params.account_ids
        V-->>API: { roomId, room, accountId }
        API-->>Client: Access granted (owner)
    else Owner check fails
        Note over V: Room owned by different account
        V->>Admin: checkIsAdmin(accountId)
        alt Admin check succeeds
            Admin-->>V: true (is admin)
            Note over V: Admin accesses room owner's accountId
            V-->>API: { roomId, room, accountId: room.account_id }
            API-->>Client: Access granted (admin bypass)
        else Admin check fails
            Admin-->>V: false (not admin)
            V-->>API: 403 Access Denied
            API-->>Client: "Access denied to this chat"
        end
    end

Loading

<sub>Requires human review: Authorization change granting Recoup admins access to any chat. High impact on access control; requires human review.

Re-trigger cubic</sub>