Closes P0 #5 (CORS) from PARTIAL → RESOLVED. fix-auth-bypass
Brief 4 (commit 297afca) cleaned login + register; this brief
sweeps the remaining 24 pages/api/** handlers that carried the
identical scaffolded wildcard-CORS + redundant-OPTIONS pattern,
plus adds a blocking forbidden-cors-headers CI job to lock in
the cleanup against future regression.
Per architect Decision 1 — Option B (sweep all 24 in one PR)
chosen over Option A (narrow verify.js-only + queue separate
sweep). Pattern-drift audit (14 of 24 files spot-checked across
parent + architect) found zero drift; mechanical safety
confirmed.
Per Decision 2 — OPTIONS handler deleted entirely (matches
Brief 4 precedent). Same-origin Vercel deployment doesn't
preflight; method check at top of handler returns 405 if any
client ever sends OPTIONS again.
Per Decision 3 — verify.js's overly-permissive Allow-Methods:
'GET, POST, PUT, DELETE, OPTIONS' is moot (deleted under D2);
the handler's existing `if (req.method !== 'GET') return 405`
guard at line 17 (now line ~5) is the remaining gate.
Per Decision 4 — no new per-route tests this convoy. None of
the 24 routes have vitest coverage today; adding handler-level
tests is the queued fill-vitest-handler-coverage convoy.
Per Decision 5 — new `forbidden-cors-headers` CI job added,
modeled verbatim on `forbidden-endpoints`. Blocking (no
`|| true`, no `continue-on-error`). Greps pages/api/ for any
`Access-Control-Allow-(Origin|Methods|Headers)` reappearance
and exits 1 on hit.
Verification:
- npm run lint: 128 problems (baseline match)
- npm run test:run: 21/21 vitest pass (no regression)
- git grep -nE "Access-Control-Allow-..." -- 'pages/api/**':
zero matches
- git grep -nE "OPTIONS" -- 'pages/api/**': zero matches
(post-sweep)
- new forbidden-cors-headers grep exits 0 against swept tree
No code paths in lib/**, components/**, scripts/**, or test/**
touched. No package.json / lockfile churn. No workflow YAML
beyond the single ci.yml job addition. No AGENTS.md edits
(doc-writer pass at convoy close).
Co-authored-by: Cursor <cursoragent@cursor.com>
📤 Avatar Upload API (/api/user/avatar):
- File upload with multipart form data parsing
- Comprehensive validation (file type, size limits)
- Support for JPEG, PNG, GIF, WebP images up to 5MB
- Automatic cleanup of old avatars before new uploads
- Vercel Blob integration with public access
- Database tracking in user_avatars table
- Error handling for upload failures
🎨 Avatar Generation API (/api/user/avatar/generate):
- Custom avatar generation using DiceBear API
- Fire-themed color scheme (matching app branding)
- Personalized based on user initials/username/email
- SVG format for crisp display at any size
- Automatic fallback if generation fails
- Same cleanup and storage workflow as uploads
🗑️ Account Deletion API (/api/user/delete):
- Complete user data cleanup including Vercel Blob files
- Cascading deletion respecting foreign key constraints
- Admin account protection (prevents self-deletion)
- Comprehensive cleanup order:
* User avatars from Vercel Blob storage
* Deck cards, decks, collection cards, collections
* User cards, avatar records, settings
* Finally the user account itself
- Detailed logging for audit trail
- Graceful error handling with specific error messages
🔧 Technical Features:
- Custom multipart form data parser for file uploads
- Vercel Blob put/del operations with error handling
- Unique filename generation with timestamps
- Database transaction-like cleanup for deletions
- File type validation and size limits
- Proper CORS headers for all endpoints
🎯 Integration Ready:
- Works seamlessly with existing profile page UI
- Supports both upload and generate avatar buttons
- Returns avatar URLs for immediate display
- Database consistency with user profile system
- Production-ready error handling and validation
The avatar system is now fully functional with Vercel Blob! 📸✨
