Fix milestone ownership and scaffold credit charging

[cursor]

Bug and impact

• Authenticated users could PATCH or DELETE project milestones by milestone ID alone, allowing cross-tenant milestone tampering if a UUID leaked.
• Scaffold generation trusted an optional client-supplied userId, allowing free scaffolds when omitted and credit drain against another user when spoofed.
• Shared credit deduction used a stale read-modify-write update, so concurrent paid actions could under-charge.

Root cause

• Milestone write helpers only filtered on project_milestones.id and the route ignored the project/user scope for destructive operations.
• Scaffold billing checked/deducted userId from the request body after AI generation and treated deduction failure as a successful zero-credit scaffold.
• Credit deduction updated balances from a previously read balance rather than a conditional atomic update.

Fix

• Scope milestone PATCH/DELETE through route project ID and authenticated user.id, returning 404 outside that scope.
• Charge scaffold generation to the authenticated user before AI work, ignore body userId, return 402 on failed deduction, and refund if generation/parsing fails.
• Make deductCredits and refundCredits update balances with SQL arithmetic/conditional updates.

Validation

• pnpm exec tsc --noEmit passed.
• pnpm exec eslint app/api/generate-scaffold/route.ts app/api/projects/[id]/milestones/[milestoneId]/route.ts lib/queries.ts lib/credits.ts passed with one pre-existing warning in lib/queries.ts.
• Temporary mocked Vitest harness passed 5 route scenarios: milestone PATCH scope, milestone DELETE 404 out-of-scope, scaffold charges authenticated user not body userId, insufficient credits skip AI, and AI failure refunds credits.

  

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
repo-app-architect	Ready	Preview, Comment	Jun 18, 2026 11:07am
repofuse	Ready	Preview, Comment, Open in v0	Jun 18, 2026 11:07am
v0-repo-app-architect	Ready	Preview, Comment, Open in v0	Jun 18, 2026 11:07am