Merge test into main

[sweetmantech]

Batched promotion of test → main.

Included PRs

• feat(api): migrate POST /api/sandbox/upload to /api/sandboxes/staged-files #541 feat(api): migrate POST /api/sandbox/upload to /api/sandboxes/staged-files

🤖 Generated with Claude Code

---

Summary by cubic

Add POST /api/sandboxes/staged-file for Vercel Blob client-upload token handshakes and upload-completed callbacks, replacing /api/sandbox/upload. Includes CORS preflight and auth aligned with other API routes.

• New Features

  • New route with OPTIONS preflight using getCorsHeaders().
  • Handshake auth via validateAuthContext using Bearer Authorization for blob.generate-client-token; skips auth for blob.upload-completed.
  • Enforces 100MB max size and random filename suffix via @vercel/blob/client.handleUpload.
  • Generic 500 on unexpected errors with server-side logging; all responses include CORS headers.

• Migration

  • Point client handleUploadUrl to /api/sandboxes/staged-file.
  • Send a Bearer Authorization header on the handshake; no header is required for the upload-completed callback.

^{Written for commit 329c589. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
api	Ready	Preview	May 11, 2026 11:07pm

[coderabbitai]

Warning

Rate limit exceeded

@sweetmantech has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 45 minutes and 33 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: f8fdaa19-a476-43bb-815a-c7233fa6ee77

📥 Commits

Reviewing files that changed from the base of the PR and between 710f789 and 329c589.

⛔ Files ignored due to path filters (1)

• lib/sandbox/__tests__/postSandboxesUploadTokensHandler.test.ts is excluded by !**/*.test.*, !**/__tests__/** and included by lib/**

📒 Files selected for processing (2)

• app/api/sandboxes/staged-file/route.ts
• lib/sandbox/postSandboxesUploadTokensHandler.ts

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch test

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cubic-dev-ai]

4 issues found across 3 files

Confidence score: 2/5

• There is a high user-impact risk in app/api/sandboxes/staged-file/route.ts: the singular staged-file path appears inconsistent with the documented plural migration target (staged-files), which could break endpoint routing.
• lib/sandbox/postSandboxesUploadTokensHandler.ts currently treats malformed JSON as a 500 path, so client-side bad input is misclassified as server failure instead of returning a 400 before handleUpload, which can cause incorrect API behavior.
• The remaining issues are lower severity (standardized 500 message and test-file length), but combined with the routing and request-validation concerns, this is not yet a low-risk merge.
• Pay close attention to app/api/sandboxes/staged-file/route.ts and lib/sandbox/postSandboxesUploadTokensHandler.ts - route naming and JSON error handling are the main functional risks.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="lib/sandbox/postSandboxesUploadTokensHandler.ts">

<violation number="1" location="lib/sandbox/postSandboxesUploadTokensHandler.ts:14">
P2: Invalid/malformed request bodies are handled as 500s because JSON parsing isn’t validated separately. Return a 400 for bad JSON before calling `handleUpload`.</violation>

<violation number="2" location="lib/sandbox/postSandboxesUploadTokensHandler.ts:37">
P2: Use the standardized 500 error message `"Internal server error"` in API responses.

(Based on your team's feedback about standardizing 500 responses to avoid leaking internal details.) [FEEDBACK_USED]</violation>
</file>

<file name="app/api/sandboxes/staged-file/route.ts">

<violation number="1" location="app/api/sandboxes/staged-file/route.ts:21">
P1: Route path appears to be singular (`staged-file`) while the migration target is documented as plural (`staged-files`), which can break the intended endpoint.</violation>
</file>

<file name="lib/sandbox/__tests__/postSandboxesUploadTokensHandler.test.ts">

<violation number="1" location="lib/sandbox/__tests__/postSandboxesUploadTokensHandler.test.ts:1">
P3: Custom agent: **Enforce Clear Code Style and Maintainability Practices**

This new test file exceeds the repository’s 100-line maintainability limit.</violation>
</file>

Architecture diagram

sequenceDiagram
    participant Client as Client Browser
    participant Next as Next.js API Route
    participant Handler as postSandboxesUploadTokensHandler
    participant Auth as validateAuthContext
    participant Blob as @vercel/blob/client (handleUpload)
    participant BlobSvc as Vercel Blob Service

    Note over Client,BlobSvc: NEW: Staged-file upload flow

    Client->>Next: OPTIONS /api/sandboxes/staged-file
    Next-->>Client: 200 CORS preflight (getCorsHeaders)

    alt Handshake (blob.generate-client-token)
        Client->>Next: POST /api/sandboxes/staged-file<br/>{type:"blob.generate-client-token", ...}<br/>Authorization: Bearer <token>
        Next->>Handler: postSandboxesUploadTokensHandler(request)
        Handler->>Handler: Parse body as HandleUploadBody
        Handler->>Auth: validateAuthContext(request)
        alt Auth succeeds
            Auth-->>Handler: { accountId, orgId, authToken }
            Handler->>Blob: handleUpload({ body, request,<br/>onBeforeGenerateToken,<br/>onUploadCompleted })
            Blob->>BlobSvc: Generate client upload token
            Note over Blob: onBeforeGenerateToken returns<br/>constraints: 100MB max, random suffix
            BlobSvc-->>Blob: clientToken
            Blob-->>Handler: {type:"blob.generate-client-token", clientToken}
            Handler->>Handler: NextResponse.json + getCorsHeaders()
            Handler-->>Next: 200 JSON with clientToken
            Next-->>Client: 200 + CORS headers
        else Auth fails
            Auth-->>Handler: NextResponse (401)
            Handler-->>Next: 401 Unauthorized
            Next-->>Client: 401 + CORS headers
        end
    else Upload completed callback (blob.upload-completed)
        Client->>Next: POST /api/sandboxes/staged-file<br/>{type:"blob.upload-completed", ...}
        Next->>Handler: postSandboxesUploadTokensHandler(request)
        Handler->>Handler: body.type !== "blob.generate-client-token"
        Note over Handler: Auth SKIPPED — callback is signature-verified<br/>by handleUpload() internally
        Handler->>Blob: handleUpload({ body, request,<br/>onBeforeGenerateToken,<br/>onUploadCompleted })
        Blob-->>Handler: {type:"blob.upload-completed"}
        Handler->>Handler: NextResponse.json + getCorsHeaders()
        Handler-->>Next: 200 + CORS headers
        Next-->>Client: 200 + CORS headers
    end

    Note over Handler,BlobSvc: ERROR HANDLING
    alt handleUpload throws
        Handler->>Handler: console.error(...)
        Handler->>Handler: NextResponse.json({status:"error",<br/>error:"Failed to issue upload token"}, 500)
        Handler-->>Next: 500 + CORS headers
        Next-->>Client: 500 + CORS headers
    end

Loading

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P1: Route path appears to be singular (staged-file) while the migration target is documented as plural (staged-files), which can break the intended endpoint.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At app/api/sandboxes/staged-file/route.ts, line 21:

<comment>Route path appears to be singular (`staged-file`) while the migration target is documented as plural (`staged-files`), which can break the intended endpoint.</comment>

<file context>
@@ -0,0 +1,23 @@
+ * @param request - The request object.
+ * @returns A NextResponse with the handshake result or error.
+ */
+export async function POST(request: NextRequest): Promise<Response> {
+  return postSandboxesUploadTokensHandler(request);
+}
</file context>

[cubic-dev-ai]

P2: Use the standardized 500 error message "Internal server error" in API responses.

(Based on your team's feedback about standardizing 500 responses to avoid leaking internal details.)

View Feedback

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At lib/sandbox/postSandboxesUploadTokensHandler.ts, line 37:

<comment>Use the standardized 500 error message `"Internal server error"` in API responses.

(Based on your team's feedback about standardizing 500 responses to avoid leaking internal details.) </comment>

<file context>
@@ -0,0 +1,41 @@
+  } catch (error) {
+    console.error("[postSandboxesUploadTokensHandler] handleUpload failed:", error);
+    return NextResponse.json(
+      { status: "error", error: "Failed to issue upload token" },
+      { status: 500, headers: getCorsHeaders() },
+    );
</file context>

Suggested change

	{ status: "error", error: "Failed to issue upload token" },
	{ status: "error", error: "Internal server error" },

[cubic-dev-ai]

P2: Invalid/malformed request bodies are handled as 500s because JSON parsing isn’t validated separately. Return a 400 for bad JSON before calling handleUpload.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At lib/sandbox/postSandboxesUploadTokensHandler.ts, line 14:

<comment>Invalid/malformed request bodies are handled as 500s because JSON parsing isn’t validated separately. Return a 400 for bad JSON before calling `handleUpload`.</comment>

<file context>
@@ -0,0 +1,41 @@
+  request: NextRequest,
+): Promise<NextResponse> {
+  try {
+    const body = (await request.json()) as HandleUploadBody;
+
+    if (body.type === "blob.generate-client-token") {
</file context>

[cubic-dev-ai]

P3: Custom agent: Enforce Clear Code Style and Maintainability Practices

This new test file exceeds the repository’s 100-line maintainability limit.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At lib/sandbox/__tests__/postSandboxesUploadTokensHandler.test.ts, line 1:

<comment>This new test file exceeds the repository’s 100-line maintainability limit.</comment>

<file context>
@@ -0,0 +1,124 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { NextResponse } from "next/server";
+import type { NextRequest } from "next/server";
</file context>