perf: cut D1 rows-read on admin and metadata paths

[Zach Dunn (zachdunn)]

In plain terms

D1 bills primarily on rows read. Admin and account dashboards were doing more work than needed: N org-summary round-trips, counting by loading every member id, over-reading metadata multi-filters, and (on the account shell) reloading the full workspace list just to show one workspace's role and usage.

This keeps the same UI behavior while reading fewer rows and making fewer AUTH/API round-trips.

What it does

Query / index optimizations

• Admin workspaces list: one AUTH call to GET /internal/orgs/summaries (three aggregate D1 queries) instead of N×3 per workspace
• Org summary counts: COUNT(*) instead of selecting every member/invite id
• Metadata search: multi-filter AND via index-friendly INTERSECT
• Staging reaper: batch hydrate with getMetadataForKeys per workspace
• Indexes (new migrations):
  • API: file_metadata (meta_key, meta_value), partial auth_tokens (minting_user_id)
  • Auth: invitation (organization_id, status)

New / extended endpoints (dashboard batching)

• GET /internal/memberships?userId=&slug= — optional single-org membership + organizationName on rows
• Membership authz — memberWorkspaceOr404 uses a slug-scoped lookup (one join), not the full list + N org fetches
• GET /me/workspaces/:name/summary — membership + public URL + usage (workspace rail)
• GET /me/workspaces/:name/people — members + invites + role (people tab)

Existing list/members/usage endpoints remain for other callers.

What it is not

• No user-facing CLI package / changeset release
• Not a redesign of multi-workspace orgs (still 1:1 slug === workspace)

How to try it

After deploy + D1 migrations for api + auth:

1. /admin workspaces list still shows member/invite counts
2. Workspace rail still shows role + usage (now via /summary)
3. People tab still lists teammates/invites (now via /people)
4. Multi-filter metadata search returns the same matches

Test plan

• Auth internal-routes tests
• API me + admin-ui + file-metadata + staging-reaper tests
• Web api-client tests
• Apply D1 migrations on staging/prod for new indexes

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (2)

• coderabbit:review
• review

🚫 Excluded labels (none allowed) (1)

• wip

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 6ccb1d11-14e4-45fd-a9b5-1bc7f2a6e924

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch perf/d1-dashboard-query-rows-read

---

_{Comment @coderabbitai help to get the list of available commands.}

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	uploads-api	ed4b731	Commit Preview URL Branch Preview URL	Jul 21 2026, 05:25 PM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	uploads-auth	ed4b731	Commit Preview URL Branch Preview URL	Jul 21 2026, 05:25 PM

[Zach Dunn (zachdunn)]

Follow-up: dashboard endpoint batching

Also landed on this PR:

• GET /internal/memberships?userId=&slug= — optional single-org membership (one join) + organizationName on every row
• Membership authz — memberWorkspaceOr404 no longer rebuilds the full workspace list / N org lookups
• GET /me/workspaces/:name/summary — rail uses this instead of full list + usage
• GET /me/workspaces/:name/people — people tab uses this instead of list + members + invites

Existing list/members/usage endpoints remain for other callers.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	uploads-web	ed4b731	Commit Preview URL Branch Preview URL	Jul 21 2026, 05:25 PM