Fix critical build and credit correctness bugs

[cursor]

Bug and impact

• /api/generate-scaffold and legacy /api/analyses/[id]/analyze trusted client-supplied userId, allowing cross-user credit drain or free scaffold generation.
• deductCredits used read-check-write, allowing concurrent requests to overspend the same balance.
• /api/build-app swallowed AI generation and push failures, streaming done for broken or empty repos.
• Vercel OAuth persisted tokens to a non-existent users table, and fresh schema creation failed on duplicate subscriptions.plan.

Root cause

Recent routes mixed authenticated user state with request-body IDs, credit deduction was not atomic, build errors were logged but not propagated to SSE clients, and schema/auth table names drifted from user_auth.

Fix

• Tie scaffold and legacy analysis credit checks/deductions to getCurrentUser().id.
• Make deductCredits a conditional atomic SQL update plus transaction insert.
• Return build SSE error on generation failures, token-limit truncation, empty AI output, or non-2xx GitHub/GitLab pushes.
• Write Vercel OAuth tokens to user_auth and remove the duplicate schema column.

Validation

• pnpm exec tsc --noEmit
• pnpm exec eslint app/api/build-app/route.ts app/api/generate-scaffold/route.ts app/api/analyses/[id]/analyze/route.ts lib/credits.ts lib/ai-gateway.ts app/api/auth/vercel/callback/route.ts app/api/auth/vercel/disconnect/route.ts

  

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
repo-app-architect	Ready	Preview, Comment	Jun 13, 2026 11:10am
repofuse	Ready	Preview, Comment, Open in v0	Jun 13, 2026 11:10am
v0-repo-app-architect	Ready	Preview, Comment, Open in v0	Jun 13, 2026 11:10am