OG image hardening, install rate-limit logging, and duplicate-company prevention

apps/cursor/src/actions/track-install.ts

@@ -4,7 +4,11 @@ import { revalidatePath } from "next/cache";
 import { z } from "zod";
 import { installGlobalLimit, installPerPluginLimit } from "@/lib/rate-limit";
 import { createClient as createAdminClient } from "@/utils/supabase/admin-client";
-import { ActionError, actionClient } from "./safe-action";
+import { actionClient } from "./safe-action";
+
+export type TrackInstallResult =
+  | { tracked: true }
+  | { tracked: false; rateLimited: true };
 
 export const trackInstallAction = actionClient
   .metadata({
@@ -23,7 +27,7 @@ export const trackInstallAction = actionClient
     ]);
 
     if (!global.success || !perPlugin.success) {
-      throw new ActionError("Rate limit exceeded. Please try again later.");
+      return { tracked: false, rateLimited: true } satisfies TrackInstallResult;
     }
 
     const admin = await createAdminClient();
@@ -34,4 +38,6 @@ export const trackInstallAction = actionClient
 
     revalidatePath("/");
     revalidatePath(`/plugins/${slug}`);
+
+    return { tracked: true } satisfies TrackInstallResult;
   });

apps/cursor/src/actions/upsert-company.ts

@@ -5,6 +5,10 @@ import { z } from "zod";
 import { createClient } from "@/utils/supabase/server";
 import { ActionError, authActionClient } from "./safe-action";
 
+// Postgres unique_violation. Raised when an insert/update collides with the
+// case-insensitive company name index (companies_name_key_unique).
+const UNIQUE_VIOLATION = "23505";
+
 export const upsertCompanyAction = authActionClient
   .metadata({
     actionName: "upsert-company",
@@ -27,7 +31,7 @@ export const upsertCompanyAction = authActionClient
     async ({
       parsedInput: {
         id,
-        name,
+        name: rawName,
         image,
         slug,
         location,
@@ -41,6 +45,9 @@ export const upsertCompanyAction = authActionClient
     }) => {
       const supabase = await createClient();
 
+      const name = rawName.trim();
+      const nameKey = name.toLowerCase();
+
       // Only treat the request as an edit when a row with the provided id
       // already exists. The form always generates a client-side nanoid for new
       // companies, so the presence of `id` alone does not imply an edit.
@@ -51,36 +58,84 @@ export const upsertCompanyAction = authActionClient
           .eq("id", id)
           .maybeSingle();
 
-        if (existing && existing.owner_id !== userId) {
-          throw new ActionError(
-            "You don't have permission to edit this company",
-          );
+        if (existing) {
+          if (existing.owner_id !== userId) {
+            throw new ActionError(
+              "You don't have permission to edit this company",
+            );
+          }
+
+          const { data, error } = await supabase
+            .from("companies")
+            .update({
+              name,
+              image,
+              location,
+              bio,
+              website,
+              social_x_link,
+              public: is_public,
+            })
+            .eq("id", id)
+            .select("id, slug")
+            .single();
+
+          if (error) {
+            if (error.code === UNIQUE_VIOLATION) {
+              throw new ActionError("A company with this name already exists.");
+            }
+            throw new ActionError(error.message);
+          }
+
+          if (shouldRedirect) {
+            redirect(`/c/${data?.slug}`);
+          }
+
+          return data;
         }
       }
 
+      // New company. Insert directly so the case-insensitive unique index can
+      // reject duplicates even under concurrent/double submissions. The slug is
+      // assigned by the `generate_company_slug` trigger.
       const { data, error } = await supabase
         .from("companies")
-        .upsert(
-          {
-            id: id ?? undefined,
-            name,
-            image,
-            location,
-            slug: slug ?? undefined,
-            bio,
-            website,
-            social_x_link,
-            public: is_public,
-            owner_id: userId,
-          },
-          {
-            onConflict: "id",
-          },
-        )
+        .insert({
+          id: id ?? undefined,
+          name,
+          image,
+          location,
+          slug: slug ?? undefined,
+          bio,
+          website,
+          social_x_link,
+          public: is_public,
+          owner_id: userId,
+        })
         .select("id, slug")
         .single();
 
       if (error) {
+        // A company with this name already exists. Reuse it instead of creating
+        // a duplicate so retries/double-clicks resolve to the same record.
+        if (error.code === UNIQUE_VIOLATION) {
+          const { data: existing } = await supabase
+            .from("companies")
+            .select("id, slug")
+            .eq("name_key", nameKey)
+            .maybeSingle();
+
+          if (existing) {
+            if (shouldRedirect) {
+              redirect(`/c/${existing.slug}`);
+            }
+
+            return existing;
+          }
+
+          throw new ActionError("A company with this name already exists.");
+        }
+
         throw new ActionError(error.message);
       }
 

apps/cursor/src/app/c/[slug]/opengraph-image.tsx

@@ -1,9 +1,15 @@
 import { getCompanyProfile } from "@/data/queries";
-import { createOGResponse, OG, OGLayout } from "@/lib/og";
+import {
+  createOGResponse,
+  OG,
+  OGLayout,
+  resolveOgImageUrl,
+} from "@/lib/og";
 
 export const alt = "Company Profile";
 export const size = { width: OG.width, height: OG.height };
 export const contentType = "image/png";
+export const revalidate = 86400;
 
 export default async function Image({
   params,
@@ -30,10 +36,12 @@ export default async function Image({
     );
   }
 
+  const logoUrl = resolveOgImageUrl(data.image);
+
   return createOGResponse(
     <OGLayout>
       <div style={{ display: "flex", alignItems: "center", gap: 40 }}>
-        {data.image && (
+        {logoUrl && (
           <div
             style={{
               display: "flex",
@@ -48,7 +56,7 @@ export default async function Image({
             }}
           >
             <img
-              src={data.image}
+              src={logoUrl}
               width={104}
               height={104}
               style={{ borderRadius: 14, objectFit: "contain" }}
@@ -66,6 +74,7 @@ export default async function Image({
         >
           <div
             style={{
+              display: "flex",
               fontSize: 52,
               fontWeight: 700,
               color: OG.text,
@@ -106,6 +115,7 @@ export default async function Image({
           {data.bio && (
             <div
               style={{
+                display: "flex",
                 fontSize: 22,
                 color: OG.textTertiary,
                 lineHeight: 1.4,

apps/cursor/src/app/companies/opengraph-image.tsx

@@ -3,6 +3,7 @@ import { createListingOG, OG } from "@/lib/og";
 export const alt = "Companies";
 export const size = { width: OG.width, height: OG.height };
 export const contentType = "image/png";
+export const revalidate = 86400;
 
 export default async function Image() {
   return createListingOG("Companies", "Companies using Cursor");

apps/cursor/src/app/login/opengraph-image.tsx

@@ -3,6 +3,7 @@ import { createListingOG, OG } from "@/lib/og";
 export const alt = "Sign In";
 export const size = { width: OG.width, height: OG.height };
 export const contentType = "image/png";
+export const revalidate = 86400;
 
 export default async function Image() {
   return createListingOG("Sign In", "Sign in to Cursor Directory");

apps/cursor/src/app/members/opengraph-image.tsx

@@ -3,6 +3,7 @@ import { createListingOG, OG } from "@/lib/og";
 export const alt = "Members";
 export const size = { width: OG.width, height: OG.height };
 export const contentType = "image/png";
+export const revalidate = 86400;
 
 export default async function Image() {
   return createListingOG(

apps/cursor/src/app/opengraph-image.tsx

@@ -1,8 +1,14 @@
-import { CursorIcon, createOGResponse, OG, OGLayout } from "@/lib/og";
+import {
+  CursorIcon,
+  createOGResponse,
+  OG,
+  OGLayout,
+} from "@/lib/og";
 
 export const alt = "Cursor Directory";
 export const size = { width: OG.width, height: OG.height };
 export const contentType = "image/png";
+export const revalidate = 86400;
 
 export default async function Image() {
   return createOGResponse(
@@ -20,6 +26,7 @@ export default async function Image() {
         <CursorIcon size={80} />
         <div
           style={{
+            display: "flex",
             fontSize: 56,
             fontWeight: 700,
             color: OG.text,
@@ -31,6 +38,7 @@ export default async function Image() {
         </div>
         <div
           style={{
+            display: "flex",
             fontSize: 26,
             color: OG.textSecondary,
             lineHeight: 1.4,

apps/cursor/src/app/plugins/[slug]/opengraph-image.tsx

@@ -1,15 +1,17 @@
 import { getPluginBySlug } from "@/data/queries";
 import {
-  CursorIcon,
   createOGResponse,
   formatCount,
   OG,
   OGLayout,
+  resolveOgImageUrl,
 } from "@/lib/og";
 
 export const alt = "Plugin";
 export const size = { width: OG.width, height: OG.height };
 export const contentType = "image/png";
+// Must be a literal — Next.js segment config does not accept imported values.
+export const revalidate = 86400;
 
 export default async function Image({
   params,
@@ -36,6 +38,8 @@ export default async function Image({
     );
   }
 
+  const logoUrl = resolveOgImageUrl(data.logo);
+
   const components = data.plugin_components ?? [];
   const typeCounts: Record<string, number> = {};
   for (const c of components) {
@@ -62,16 +66,17 @@ export default async function Image({
               padding: 6,
             }}
           >
-            {data.logo ? (
+            {logoUrl ? (
               <img
-                src={data.logo}
+                src={logoUrl}
                 width={60}
                 height={60}
                 style={{ borderRadius: 10, objectFit: "contain" }}
               />
             ) : (
               <span
                 style={{
+                  display: "flex",
                   fontSize: 32,
                   fontWeight: 700,
                   color: OG.textSecondary,
@@ -90,6 +95,7 @@ export default async function Image({
           >
             <div
               style={{
+                display: "flex",
                 fontSize: 48,
                 fontWeight: 700,
                 color: OG.text,
@@ -100,7 +106,13 @@ export default async function Image({
               {data.name}
             </div>
             {data.author_name && (
-              <div style={{ fontSize: 22, color: OG.textSecondary }}>
+              <div
+                style={{
+                  display: "flex",
+                  fontSize: 22,
+                  color: OG.textSecondary,
+                }}
+              >
                 by {data.author_name}
               </div>
             )}
@@ -110,6 +122,7 @@ export default async function Image({
         {data.description && (
           <div
             style={{
+              display: "flex",
               fontSize: 24,
               color: OG.textSecondary,
               lineHeight: 1.4,
@@ -146,13 +159,15 @@ export default async function Image({
               <polyline points="7 10 12 15 17 10" />
               <line x1="12" y1="15" x2="12" y2="3" />
             </svg>
-            <span style={{ fontWeight: 700 }}>
+            <span style={{ display: "flex", fontWeight: 700 }}>
               {formatCount(data.install_count)}
             </span>
           </div>
 
           {componentSummary && (
-            <div style={{ fontSize: 20, color: OG.textTertiary }}>
+            <div
+              style={{ display: "flex", fontSize: 20, color: OG.textTertiary }}
+            >
               {componentSummary}
             </div>
           )}
@@ -164,6 +179,7 @@ export default async function Image({
               <div
                 key={kw}
                 style={{
+                  display: "flex",
                   fontSize: 16,
                   color: OG.textSecondary,
                   padding: "6px 14px",

apps/cursor/src/app/plugins/new/opengraph-image.tsx

@@ -3,6 +3,7 @@ import { createListingOG, OG } from "@/lib/og";
 export const alt = "Submit a Plugin";
 export const size = { width: OG.width, height: OG.height };
 export const contentType = "image/png";
+export const revalidate = 86400;
 
 export default async function Image() {
   return createListingOG(

apps/cursor/src/app/plugins/opengraph-image.tsx

@@ -3,6 +3,7 @@ import { createListingOG, OG } from "@/lib/og";
 export const alt = "Plugins";
 export const size = { width: OG.width, height: OG.height };
 export const contentType = "image/png";
+export const revalidate = 86400;
 
 export default async function Image() {
   return createListingOG(