refactor: Senior Engineer Code Quality Overhaul

.claude/settings.local.json

@@ -2,7 +2,13 @@
   "permissions": {
     "allow": [
       "Bash(php artisan make:model:*)",
-      "Bash(gh issue create:*)"
+      "Bash(gh issue create:*)",
+      "Bash(find:*)",
+      "Bash(git checkout:*)",
+      "Bash(php artisan make:policy:*)",
+      "Bash(/usr/local/bin/php:*)",
+      "Bash(/opt/homebrew/bin/php:*)",
+      "Bash(git add:*)"
     ]
   },
   "enabledMcpjsonServers": [

.github/workflows/tests.yml

@@ -10,6 +10,9 @@ on:
       - develop
       - master
 
+env:
+  MIN_COVERAGE: 70
+
 jobs:
   ci:
     runs-on: ubuntu-latest
@@ -46,5 +49,20 @@ jobs:
       - name: Build Assets
         run: npm run build
 
-      - name: Tests
-        run: php artisan test
+      - name: Run Tests with Coverage
+        run: php artisan test --coverage --min=${{ env.MIN_COVERAGE }}
+
+      - name: Generate Coverage Report
+        if: always()
+        run: |
+          php artisan test --coverage-clover=coverage.xml || true
+
+      - name: Upload Coverage to Codecov
+        if: always()
+        uses: codecov/codecov-action@v4
+        with:
+          files: ./coverage.xml
+          fail_ci_if_error: false
+          verbose: true
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

app/Http/Controllers/ArtifactController.php

@@ -7,19 +7,22 @@
 use App\Models\Artifact;
 use App\Models\Chat;
 use App\Services\SvgSanitizer;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Http\Response;
 use Illuminate\View\View;
 
 class ArtifactController extends Controller
 {
+    use AuthorizesRequests;
+
     /**
      * Get all artifacts for a chat.
      */
     public function index(Request $request, Chat $chat): JsonResponse
     {
-        abort_unless($chat->user_id === $request->user()->id, 403);
+        $this->authorize('view', $chat);
 
         $artifacts = Artifact::query()
             ->whereIn('message_id', $chat->messages()->pluck('id'))
@@ -36,7 +39,7 @@ public function show(Request $request, Artifact $artifact): JsonResponse
     {
         $chat = $artifact->message?->chat;
         abort_if($chat === null, 404);
-        abort_unless($chat->user_id === $request->user()?->id, 403);
+        $this->authorize('view', $chat);
 
         return response()->json($artifact);
     }
@@ -48,7 +51,7 @@ public function render(Request $request, Artifact $artifact): Response
     {
         $chat = $artifact->message?->chat;
         abort_if($chat === null, 404);
-        abort_unless($chat->user_id === $request->user()?->id, 403);
+        $this->authorize('view', $chat);
 
         $view = $this->getRendererView($artifact);
         $html = $view->render();

app/Http/Controllers/ChatController.php

@@ -7,13 +7,16 @@
 use App\Http\Requests\StoreChatRequest;
 use App\Http\Requests\UpdateChatRequest;
 use App\Models\Chat;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Inertia\Inertia;
 use Inertia\Response;
 
 class ChatController extends Controller
 {
+    use AuthorizesRequests;
+
     public function index(Request $request): Response
     {
         $chats = $request->user()->chats()->with('aiModel')->orderByDesc('updated_at')->get();
@@ -36,7 +39,7 @@ public function store(StoreChatRequest $request): RedirectResponse
 
     public function show(Request $request, Chat $chat): Response
     {
-        abort_unless($chat->user_id === $request->user()->id, 403);
+        $this->authorize('view', $chat);
 
         $chats = $request->user()->chats()->with('aiModel')->orderByDesc('updated_at')->get();
 
@@ -56,7 +59,7 @@ public function update(UpdateChatRequest $request, Chat $chat): RedirectResponse
 
     public function destroy(Request $request, Chat $chat): RedirectResponse
     {
-        abort_unless($chat->user_id === $request->user()->id, 403);
+        $this->authorize('delete', $chat);
 
         $chat->delete();
 

app/Http/Controllers/ChatStreamController.php

@@ -8,18 +8,21 @@
 use App\Models\AiModel;
 use App\Models\Chat;
 use App\Services\ChatStreamService;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\Response;
 use Symfony\Component\HttpFoundation\StreamedResponse;
 
 class ChatStreamController extends Controller
 {
+    use AuthorizesRequests;
+
     public function __construct(
         private readonly ChatStreamService $streamService
     ) {}
 
     public function __invoke(ChatStreamRequest $request, Chat $chat): StreamedResponse
     {
-        abort_unless($chat->user_id === $request->user()->id, 403);
+        $this->authorize('stream', $chat);
 
         $userMessage = $request->string('message')->trim()->value();
 

app/Http/Requests/ChatStreamRequest.php

@@ -14,6 +14,11 @@ public function authorize(): bool
     }
 
     /**
+     * Get the validation rules that apply to the request.
+     *
+     * Note: ai_model_id is nullable here because existing chats have a default model.
+     * The controller falls back to the chat's ai_model_id when not provided.
+     *
      * @return array<string, mixed>
      */
     public function rules(): array

app/Http/Requests/StoreAgentRequest.php

@@ -8,7 +8,7 @@ class StoreAgentRequest extends FormRequest
 {
     public function authorize(): bool
     {
-        return true;
+        return auth()->check();
     }
 
     /**

app/Jobs/GenerateChatTitle.php

@@ -21,6 +21,8 @@ public function __construct(
 
     public function handle(): void
     {
+        $this->chat->loadMissing('aiModel');
+
         $messages = $this->chat->messages()
             ->orderByDesc('created_at')
             ->limit(6)

app/Models/Agent.php

@@ -6,6 +6,9 @@
 
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\BelongsToMany;
+use Illuminate\Database\Eloquent\Relations\HasMany;
 
 class Agent extends Model
 {
@@ -26,4 +29,48 @@ class Agent extends Model
         'capabilities',
         'is_active',
     ];
+
+    /**
+     * @return array<string, string>
+     */
+    protected function casts(): array
+    {
+        return [
+            'tools' => 'array',
+            'capabilities' => 'array',
+            'is_active' => 'boolean',
+        ];
+    }
+
+    /**
+     * @return BelongsTo<User, $this>
+     */
+    public function user(): BelongsTo
+    {
+        return $this->belongsTo(User::class);
+    }
+
+    /**
+     * @return BelongsTo<AiModel, $this>
+     */
+    public function defaultModel(): BelongsTo
+    {
+        return $this->belongsTo(AiModel::class, 'default_model_id');
+    }
+
+    /**
+     * @return BelongsToMany<AiModel, $this>
+     */
+    public function models(): BelongsToMany
+    {
+        return $this->belongsToMany(AiModel::class, 'agent_model');
+    }
+
+    /**
+     * @return HasMany<Chat, $this>
+     */
+    public function chats(): HasMany
+    {
+        return $this->hasMany(Chat::class);
+    }
 }

app/Models/AiModel.php

@@ -63,6 +63,17 @@ public function scopeEnabled(Builder $query): Builder
         return $query->where('enabled', true);
     }
 
+    /**
+     * Scope to get models that are both enabled and available.
+     *
+     * @param  Builder<AiModel>  $query
+     * @return Builder<AiModel>
+     */
+    public function scopeAvailable(Builder $query): Builder
+    {
+        return $query->where('enabled', true)->where('is_available', true);
+    }
+
     /**
      * @param  Builder<AiModel>  $query
      * @return Builder<AiModel>

app/Models/Chat.php

@@ -24,6 +24,7 @@ class Chat extends Model
         'user_id',
         'title',
         'ai_model_id',
+        'agent_id',
     ];
 
     /**
@@ -49,4 +50,12 @@ public function aiModel(): BelongsTo
     {
         return $this->belongsTo(AiModel::class);
     }
+
+    /**
+     * @return BelongsTo<Agent, $this>
+     */
+    public function agent(): BelongsTo
+    {
+        return $this->belongsTo(Agent::class);
+    }
 }

app/Models/User.php

@@ -21,6 +21,14 @@ public function chats(): \Illuminate\Database\Eloquent\Relations\HasMany
         return $this->hasMany(Chat::class);
     }
 
+    /**
+     * @return \Illuminate\Database\Eloquent\Relations\HasMany<Agent, $this>
+     */
+    public function agents(): \Illuminate\Database\Eloquent\Relations\HasMany
+    {
+        return $this->hasMany(Agent::class);
+    }
+
     /**
      * @return \Illuminate\Database\Eloquent\Relations\HasMany<UserApiCredential, $this>
      */

app/Policies/AgentPolicy.php

@@ -0,0 +1,51 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Policies;
+
+use App\Models\Agent;
+use App\Models\User;
+
+class AgentPolicy
+{
+    /**
+     * Determine whether the user can view any models.
+     */
+    public function viewAny(User $user): bool
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can view the model.
+     */
+    public function view(User $user, Agent $agent): bool
+    {
+        return $user->id === $agent->user_id;
+    }
+
+    /**
+     * Determine whether the user can create models.
+     */
+    public function create(User $user): bool
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can update the model.
+     */
+    public function update(User $user, Agent $agent): bool
+    {
+        return $user->id === $agent->user_id;
+    }
+
+    /**
+     * Determine whether the user can delete the model.
+     */
+    public function delete(User $user, Agent $agent): bool
+    {
+        return $user->id === $agent->user_id;
+    }
+}