fix(api): stop a swallowed query error from mis-numbering compositions - #43
Merged
Merged
Conversation
POST /api/compositions computed nextVersion from `{ data: existing } =
await supabase...single()` without checking `error`. `.single()` throws
on zero rows — the normal case for a project's first composition — so
a real query failure (RLS misconfig, DB outage) left `data` null just
like "no composition yet," silently defaulting nextVersion to 1 instead
of surfacing the failure and risking a colliding/duplicate version.
Switched to `.maybeSingle()` with an explicit error check, matching the
project's convention for "zero rows is valid" (ownsProject/ownsFigure,
the surfaces/compositions GET handlers from #40). Added a structural
test that walks every API route for a `data` destructure from a
supabase query missing its `error`, so a call site can't drop back to
this pattern.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
github-actions
Bot
deleted the
fix/composition-version-swallowed-error
branch
September 4, 2026 04:14
3 tasks
github-actions Bot
pushed a commit
that referenced
this pull request
Sep 5, 2026
) Upsert deleted the existing surface before inserting the new one but never checked the delete's result. If the delete silently failed (RLS misconfig, transient DB error), the insert left two rows for one project, and every later GET for that surface would 500 since it relies on .maybeSingle() expecting at most one row. Same unchecked-error family as PR #36/#37/#39/#40/#43. Co-authored-by: Mao Nakamoto <maonakamoto@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
POST /api/compositionslooked up the latest existing version withconst { data: existing } = await supabase...single(), never checkingerror..single()throws when zero rows match — the normal case for a project's first composition — so a genuine query failure (RLS misconfig, transient DB outage) leftdatanull exactly like "no composition yet." Both paths silently computednextVersion = 1, risking an inserted row that collides with or duplicates an existing version instead of surfacing the failure..maybeSingle()with an explicit error check, matching this codebase's established convention for "zero rows is a valid outcome" (ownsProject/ownsFigure, and the/api/surfacesand/api/compositionsGET handlers fixed in fix(api): stop surfacing DB errors as "no surface/composition yet" #40).src/app/api/query-error-checked.test.ts, a structural test that walks every API route for adatadestructure bound to an awaitedsupabasequery and fails if the same destructure doesn't also binderror— verified it fails against the pre-fix code and passes after.Same bug family as #36, #37, #39, #40 (a Supabase query result silently treated as "nothing here" instead of surfacing a real failure) — this closes the one call site those passes missed.
Test plan
npm run verify— lint clean (0 errors, 8 pre-existing warnings), tsc clean, 96/96 tests pass