Enhance backend stability, security, and type safety

[badmike]

This pull request introduces several improvements across the backend and CI pipeline, mainly focused on enhancing database transaction safety, error reporting, and frontend testing. The most significant change is the consistent use of per-model database connections for all content-related transactions, improving support for multi-database setups. Additionally, the CI pipeline now includes frontend linting and testing, and error reporting is enhanced with integration to PostHog.

Database Transaction Handling

• All content-related actions now use the model’s own database connection for transactions (e.g., $content->getConnection()->transaction(...) instead of the global DB::transaction). This ensures correct transaction handling in multi-database environments and improves reliability. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14]

CI/CD and Frontend Testing

• The CI workflow (.github/workflows/tests.yml) now includes a frontend job that runs linting, type-checking, and frontend tests using Bun, ensuring frontend code quality in addition to backend tests. [1] [2]

Error Reporting and Logging

• Integrated PostHog exception reporting by adding App\Services\PostHog\ExceptionReporter to the global exception handler, so unexpected errors are now reported to PostHog for observability. [1] [2]
• Improved asset storage error logging by logging the full exception object instead of just the message, and returning a generic error message to the client.

API and Defaults

• The CreateToken action now defaults new tokens to published-content read-only access unless explicit abilities are granted, improving security defaults.
• The content API now eager-loads related block models for i18n relationships, reducing N+1 query issues.

Configuration

• Added PostHog API key and host configuration to .env.example for analytics integration.## Summary

Linked issue

How was this tested?

AI assistance

Checklist

• Commits follow the Gitmoji format
• ./vendor/bin/pint run on changed PHP files
• bun run lint and bun run format run on changed TS/Vue files
• Tests pass locally (and new behavior is covered where it makes sense)
• AI usage is disclosed above (or not applicable)
• I understand and can explain the code I'm submitting

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​types/​qrcode@​1.5.6
	npm/​@​vitest/​coverage-v8@​4.1.10
	npm/​vitest@​4.1.10
	npm/​jsdom@​30.0.1
	npm/​@​vue/​test-utils@​2.4.11

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm data-urls is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → npm/jsdom@30.0.1 → npm/data-urls@7.0.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/data-urls@7.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm happy-dom is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → npm/vitest@4.1.10 → npm/happy-dom@20.11.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/happy-dom@20.11.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm js-beautify is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → npm/@vue/test-utils@2.4.11 → npm/js-beautify@1.15.4 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/js-beautify@1.15.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm jsdom is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package.json → npm/jsdom@30.0.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/jsdom@30.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report