Closes P0 #5 (CORS) from PARTIAL → RESOLVED. fix-auth-bypass
Brief 4 (commit 297afca) cleaned login + register; this brief
sweeps the remaining 24 pages/api/** handlers that carried the
identical scaffolded wildcard-CORS + redundant-OPTIONS pattern,
plus adds a blocking forbidden-cors-headers CI job to lock in
the cleanup against future regression.
Per architect Decision 1 — Option B (sweep all 24 in one PR)
chosen over Option A (narrow verify.js-only + queue separate
sweep). Pattern-drift audit (14 of 24 files spot-checked across
parent + architect) found zero drift; mechanical safety
confirmed.
Per Decision 2 — OPTIONS handler deleted entirely (matches
Brief 4 precedent). Same-origin Vercel deployment doesn't
preflight; method check at top of handler returns 405 if any
client ever sends OPTIONS again.
Per Decision 3 — verify.js's overly-permissive Allow-Methods:
'GET, POST, PUT, DELETE, OPTIONS' is moot (deleted under D2);
the handler's existing `if (req.method !== 'GET') return 405`
guard at line 17 (now line ~5) is the remaining gate.
Per Decision 4 — no new per-route tests this convoy. None of
the 24 routes have vitest coverage today; adding handler-level
tests is the queued fill-vitest-handler-coverage convoy.
Per Decision 5 — new `forbidden-cors-headers` CI job added,
modeled verbatim on `forbidden-endpoints`. Blocking (no
`|| true`, no `continue-on-error`). Greps pages/api/ for any
`Access-Control-Allow-(Origin|Methods|Headers)` reappearance
and exits 1 on hit.
Verification:
- npm run lint: 128 problems (baseline match)
- npm run test:run: 21/21 vitest pass (no regression)
- git grep -nE "Access-Control-Allow-..." -- 'pages/api/**':
zero matches
- git grep -nE "OPTIONS" -- 'pages/api/**': zero matches
(post-sweep)
- new forbidden-cors-headers grep exits 0 against swept tree
No code paths in lib/**, components/**, scripts/**, or test/**
touched. No package.json / lockfile churn. No workflow YAML
beyond the single ci.yml job addition. No AGENTS.md edits
(doc-writer pass at convoy close).
Co-authored-by: Cursor <cursoragent@cursor.com>
✨ New Feature - Automatic System Collection:
- Every user gets an undeletable 'All My Cards' collection on registration
- Contains all cards marked as owned by the user
- Cannot be deleted, renamed, or made public
- Special 🔒 System indicator in the UI
🗃️ Database Changes:
- Added is_system_collection column to collections table
- Migration script created 'All My Cards' for all existing users (5 users)
- Automatic creation in registration API for new users
🛡️ API Protections:
- DELETE: System collections cannot be deleted
- PUT: System collections cannot be renamed or made public
- Added isSystemCollection field to API responses
🎨 Frontend Updates:
- System collections show 🔒 System badge
- Edit/Delete buttons hidden for system collections
- Special visual indicator for protected collections
🎯 Implementation Details:
- Unique slug generation (all-my-cards, all-my-cards-2, etc.)
- Proper permissions setup for each collection
- Error handling for edge cases
- Non-blocking registration if collection creation fails
Ready for users to have their automatic 'All My Cards' collection! 🚀
🎯 Vanity URLs for Collections:
- Added slug-based URLs like /collection/modern-masters-2021
- Backwards compatible with numeric IDs
- SEO-friendly and memorable URLs
🛠️ Slug System:
- Created lib/slug-utils.js with slug generation and validation
- generateSlug() converts names to URL-friendly format
- generateUniqueSlug() handles duplicates with numeric suffixes
- isValidSlug() validates format (lowercase, hyphens, no special chars)
📊 Database Schema:
- Added slug column to collections table with unique constraint
- Migration script adds slugs to existing collections
- Database constraints ensure slug format and uniqueness
- Performance index on slug column
🔌 API Updates:
- Updated collections API to generate slugs for new collections
- New [identifier].js endpoint handles both slugs and IDs
- Thumbnails API supports both slug and ID lookups
- Smart identifier detection (slug vs numeric ID)
🎨 Frontend Integration:
- Collections page uses slugs for navigation
- Fallback to ID if slug not available (backwards compatibility)
- Updated all collection links to use slugs
- Sample collections created with proper slugs
✨ URL Examples:
- /collection/modern-masters-2021 (new slug format)
- /collection/123 (old ID format still works)
- Automatic redirect potential for future
The collection URLs are now beautiful and shareable! 🚀
