Address code review feedback: authorization, error handling, and cleanup optimization

[Copilot]

Implements fixes for security, reliability, and performance issues identified in code review feedback.

Authorization & Security

• Add authorization checks to update.procedure.ts to prevent unauthorized group modifications
• Fix hardcoded URL in tRPC procedures—now derives host/protocol from request headers
• Validate user existence before passkey auth session creation (return 404 vs creating incomplete records)

Error Handling

• Wrap all fetch calls in try-catch with proper loading state cleanup
• Add error logging for debugging network/application failures
• Improve user-facing error messages

Code Quality

• Extract session retrieval into reusable getSessionFromHeaders() helper
• Remove duplicate credentialId index (unique constraint already provides indexing)
• Remove unnecessary open dependency from useMemo
• Add SSR guard for localStorage access

Cleanup Optimization

• Fix race condition in passkey deletion using transaction:

await prisma.$transaction(async (tx) => {
  await tx.passkey.delete({ where: { id: passkeyId } })
  const remaining = await tx.passkey.count({ where: { anonymousUserId } })
  if (remaining === 0) {
    await tx.anonymousUser.update({ 
      where: { id: anonymousUserId },
      data: { passkeysEnabled: false }
    })
  }
})

• Add batch cleanup for temporary users (replaces individual deletes with deleteMany)

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
my-spliit-instance	Ready	Preview, Comment	Feb 4, 2026 10:43pm

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• checkpoint.prisma.io
  • Triggering command: /usr/local/bin/node /usr/local/bin/node /home/REDACTED/work/spliit/spliit/node_modules/prisma/build/child {"product":"prisma","version":"6.18.0","cli_install_type":"local","information":"","local_timestamp":"2026-02-04T22:34:48Z","project_hash":"fe730ba0","cli_path":"/home/REDACTED/work/spliit/spliit/node_modules/.bin/prisma","cli_path_hash":"86e8da49","endpoin (dns block)
  • Triggering command: /usr/local/bin/node /usr/local/bin/node /home/REDACTED/work/spliit/spliit/node_modules/prisma/build/child {"product":"prisma","version":"6.18.0","cli_install_type":"local","information":"","local_timestamp":"2026-02-04T22:34:50Z","project_hash":"fe730ba0","cli_path":"/home/REDACTED/work/spliit/spliit/node_modules/.bin/prisma","cli_path_hash":"86e8da49","endpoin (dns block)
  • Triggering command: /usr/local/bin/node /usr/local/bin/node /home/REDACTED/work/spliit/spliit/node_modules/prisma/build/child {"product":"prisma","version":"6.18.0","cli_install_type":"local","information":"","local_timestamp":"2026-02-04T22:35:51Z","project_hash":"fe730ba0","cli_path":"/home/REDACTED/work/spliit/spliit/node_modules/.bin/prisma","cli_path_hash":"86e8da49","endpoin (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Copilot]

Pull request overview

This PR implements security hardening, error handling improvements, and performance optimizations based on code review feedback. The changes focus on authorization enforcement, proper error handling with loading state cleanup, and optimizations for database operations.

Changes:

• Added authorization checks to group update and delete procedures to verify user ownership before allowing modifications
• Extracted session retrieval logic into reusable getSessionFromHeaders() helper with proper URL derivation from request headers
• Wrapped all fetch calls in try-catch-finally blocks with consistent error logging and user-friendly error messages
• Fixed race conditions in passkey deletion using database transactions and optimized temporary user cleanup with batch operations

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/trpc/routers/groups/update.procedure.ts	Adds session-based authorization to verify user has associated with group before allowing updates
src/trpc/routers/groups/delete.procedure.ts	Refactors to use new getSessionFromHeaders() helper for cleaner session retrieval
src/lib/session.ts	Adds getSessionFromHeaders() helper, fixes hardcoded localhost URL, implements batch cleanup for temporary users
src/components/anonymous-auth-menu.tsx	Wraps fetch calls in try-catch-finally for proper error handling and loading state cleanup, removes unnecessary open dependency from useMemo
src/app/groups/recent-group-list.tsx	Adds SSR guard for localStorage access to prevent hydration errors
src/app/api/anonymous-users/passkey/delete/route.ts	Wraps passkey deletion and passkeysEnabled update in transaction to prevent race conditions
src/app/api/anonymous-users/passkey/auth-options/route.ts	Validates user existence before creating auth session instead of creating incomplete user records
prisma/schema.prisma	Removes redundant credentialId index (unique constraint already provides indexing)

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Authorization checks have been added to update and delete group procedures, but similar mutating operations like creating groups and creating/updating/deleting expenses lack authorization checks. This creates an inconsistency in security enforcement across the API surface.

Consider adding similar authorization checks to:

• createGroupProcedure in src/trpc/routers/groups/create.procedure.ts
• createGroupExpenseProcedure in src/trpc/routers/groups/expenses/create.procedure.ts
• updateGroupExpenseProcedure in src/trpc/routers/groups/expenses/update.procedure.ts
• deleteGroupExpenseProcedure in src/trpc/routers/groups/expenses/delete.procedure.ts

These procedures should verify that the user has access to the group before allowing mutations.