fix: restore /games public access and add missing company.write.linked capability

[BAWES]

Summary

• Add /games to middleware publicPaths so the ping pong game is accessible without authentication
• Add company.write.linked to Capability union type (fixes type errors from PR [STU-106] Add company contacts and stores management pages #25 where this capability was referenced in company/actions.ts but never defined)
• Add company.write.linked to company role's capabilities array
• Add as Route casts for /company/contacts and /company/stores navigation items

Why

These 4 fixes were applied during the STU-96 ping pong game deployment but were repeatedly reverted by lint-staged/husky pre-commit hooks. Without them:

• The game at /games/ping-pong returns HTTP 307 (redirects to login)
• npx tsc --noEmit fails with 4 company.write.linked type errors
• Navigation build fails for /company/contacts and /company/stores routes

Test plan

• npx tsc --noEmit passes with zero errors
• Deploy preview: verify /games/ping-pong loads without auth
• Verify /company/contacts and /company/stores nav links work

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Games section is now publicly accessible without requiring authentication.
  • Company role users have expanded permissions to manage linked items.

• Improvements

  • Enhanced navigation type safety for company user interface.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
studenthub-next	Ready	Preview, Comment	May 21, 2026 11:50am

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: bff37384-b721-4544-9766-53ad0a98ca3c

📥 Commits

Reviewing files that changed from the base of the PR and between 3580da0 and 15e3ea2.

📒 Files selected for processing (4)

• src/middleware.ts
• src/modules/auth/capabilities.ts
• src/modules/auth/types.ts
• src/modules/workspace/navigation.ts

---

Walkthrough

Four coordinated changes extend the auth system with a new company capability (company.write.linked), expose the /games route for public access via middleware, and apply type-safe Route casts to company navigation items.

Changes

Auth capability and public route configuration

Layer / File(s)	Summary
Auth capability definition and company role assignment src/modules/auth/types.ts, src/modules/auth/capabilities.ts	Capability type union extends to include "company.write.linked". The company role in roleCapabilities is assigned this capability.
Public games route and navigation type safety src/middleware.ts, src/modules/workspace/navigation.ts	Middleware adds "/games" to publicPaths so games routes bypass authentication. Company nav items' href fields are explicitly cast to as Route type.

Possibly related PRs

• BAWES/studenthub-codex#11: The main PR's middleware now explicitly treats "/games" as public (so /games/* routes like the new ping-pong page aren't blocked), directly aligning with the retrieved PR adding /games/ping-pong.

---

🎯 1 (Trivial) | ⏱️ ~3 minutes

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/STU-146-fix-reverts

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}