feat(services): migrate page authoring (PR 7/N)

[mxkaske]

Summary

Stacked on #2108. Seventh domain. Migrates the 13 authoring procedures of pageRouter and the 5 page-CRUD methods of the Connect status-page handler onto @openstatus/services/page. The public viewer domain (statusPage.ts) and the remaining 13 Connect methods (components / groups / subscribers / viewer) still warrant dedicated follow-ups.

What lands

Services (packages/services/src/page/)

• createPage / newPage — full vs minimal create. Both enforce the status-pages plan cap; createPage also re-applies the per-access-type plan gates (password-protection / email-domain / ip-restriction / no-index).
• deletePage — FK cascade takes care of components / groups / reports / subscribers. tRPC wrapper swallows NotFoundError for idempotency.
• listPages — returns pages with their statusReports (batched; scoped to workspace).
• getPage — returns page + maintenances / pageComponents / pageComponentGroups (matches the old zod shape exactly).
• getSlugAvailable — pure check against subdomainSafeList + DB.
• updatePageGeneral — re-checks slug uniqueness only when the slug actually changes.
• updatePageCustomDomain — persists the DB change and returns the previous domain so the Vercel-diff logic at the transport layer can avoid a separate read.
• updatePagePasswordProtection — same gates as create.
• updatePageAppearance, updatePageLinks, updatePageLocales (plan-gated on i18n), updatePageConfiguration.
• Every mutation emits an audit row.

tRPC (packages/api/src/router/page.ts)

All 13 procedures are thin wrappers. The updateCustomDomain procedure orchestrates:

1. getPage (via service) reads the current domain.
2. addDomainToVercel / removeDomainFromVercel — transport-layer external calls, stay at tRPC (same philosophy as testHttp / testTcp / testDns for monitor).
3. updatePageCustomDomain (via service) persists the change.

Connect (apps/server/src/routes/rpc/services/status-page/index.ts)

Page CRUD methods — createStatusPage / getStatusPage / listStatusPages / updateStatusPage / deleteStatusPage — now call into the services. The other 13 methods (components / groups / subscribers / viewer) still read the DB directly; they're separate domains for follow-up PRs.

• updateStatusPage loads the existing page via getPage, then orchestrates per-section updates (updatePageGeneral, updatePageLinks, updatePageAppearance, updatePageCustomDomain, updatePageLocales, updatePagePasswordProtection) inside a single transaction (withTransaction + shared ctx.db = tx), so partial failures can't leave the page half-updated.
• Granular errors preserved at handler: statusPageNotFoundError (catches NotFoundError → rethrows with page-id metadata) and slugAlreadyExistsError (pre-check before the service call — AlreadyExists + metadata instead of the service's generic ConflictError → InvalidArgument).
• Proto-specific format validations (https icon URL, custom-domain regex, IPv4 CIDR, email-domain shape) and the i18n PermissionDenied path stay at the handler — they don't exist in the zod insert schema and the error codes would change if deferred to the service.
• listStatusPages fetches via the service and paginates in-memory; status-page quota is bounded per workspace so the enrichment overhead is negligible for this migration.
• serviceToConverterPage bridges the shape mismatch between the service's parsed Page (arrays for authEmailDomains / allowedIpRanges) and the converter's raw-DB shape (comma-joined strings, still used by the 13 unmigrated methods).

Enforcement

• Biome scope adds packages/api/src/router/page.ts. Router imports the drizzle insert schema via the services re-export (CreatePageInput) so the db-import ban applies cleanly.
• Connect status-page/index.ts is not added to the Biome scope yet — the file still imports from @openstatus/db for the 13 legacy methods, so the override would light up the whole file. Will land in the follow-up that migrates the remaining methods.
• Subpath export @openstatus/services/page.
• Added @openstatus/locales to the services deps (used by UpdatePageLocalesInput).

Tests

__tests__/page.test.ts:

• newPage happy / reserved slug / duplicate slug
• createPage monitor attachment + cross-workspace monitor → ForbiddenError
• updatePageGeneral rename, duplicate-slug ConflictError, cross-workspace NotFoundError
• updatePageLocales plan-gate LimitExceededError on free plan (no i18n)
• list / get / getSlugAvailable workspace isolation + reserved handling
• delete cross-workspace NotFoundError

Deliberately out of scope

• packages/api/src/router/statusPage.ts — ~1280 lines of public viewer endpoints (get, getLight, getMaintenance, getUptime, getReport, getMonitors, subscribe, unsubscribe, verifyPassword, …). They're publicProcedures that don't run through an authenticated ServiceContext; either a dedicated public-ctx surface in services or a separate subscription service is needed. Follow-up PR.
• Remaining 13 methods in Connect status-page/index.ts — components / groups / subscribers / viewer. Same pattern as the Connect monitor deferral; follow-up with its own scope.

Test plan

• Service integration tests (seeded turso)
• Dashboard authoring flows: /status-pages/create, /status-pages/[id]/settings (general / custom domain / appearance / links / locales / password), /onboarding page creation
• page.create from onboarding still attaches monitors as components
• Connect StatusPageService.* CRUD smoke (buf studio or equivalent): create → get → list → update (each section) → delete

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openstatus-dashboard	Ready	Preview, Comment	Apr 24, 2026 7:01am
openstatus-status-page	Ready	Preview, Comment	Apr 24, 2026 7:01am
openstatus-web	Ready	Preview, Comment	Apr 24, 2026 7:01am

[cubic-dev-ai]

4 issues found across 12 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="packages/services/src/page/schemas.ts">

<violation number="1" location="packages/services/src/page/schemas.ts:91">
P2: `allowedIpRanges` accepts arbitrary strings; restore CIDR validation in the service schema to prevent persisting invalid IP restriction rules.</violation>
</file>

<file name="packages/services/src/page/update.ts">

<violation number="1" location="packages/services/src/page/update.ts:130">
P2: `authEmailDomains` cannot be cleared because null input is converted to `undefined` and skipped in the DB update.</violation>
</file>

<file name="packages/services/src/page/create.ts">

<violation number="1" location="packages/services/src/page/create.ts:24">
P1: `createPage` skips `assertSlugAvailable`, so full-form creates can bypass reserved/duplicate slug validation before insert.</violation>

<violation number="2" location="packages/services/src/page/create.ts:28">
P1: `createPage` does not pass `allowIndex` into `assertAccessTypeAllowed`, bypassing the `no-index` plan gate on create.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

1 issue found across 1 file (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/server/src/routes/rpc/services/status-page/index.ts">

<violation number="1" location="apps/server/src/routes/rpc/services/status-page/index.ts:517">
P1: Stale `authEmailDomains` not cleared when switching access type. Setting `nextAuthEmailDomains = undefined` doesn't clear the DB column because the service's `.set({ authEmailDomains: undefined?.join(",") })` evaluates to `undefined`, which Drizzle ignores. The corresponding `allowedIpRanges` line in the service has `?? null` but `authEmailDomains` does not — the service line `authEmailDomains: input.authEmailDomains?.join(",")` in `packages/services/src/page/update.ts` needs a matching `?? null` fallback to clear the column.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[mxkaske]

@claude review

[claude]

Claude finished @mxkaske's task in 4m 19s —— View job

---

Review

• Gather context and read changed files
• Review services layer (packages/services/src/page/)
• Review tRPC router changes (packages/api/src/router/page.ts)
• Review Connect handler (apps/server/src/routes/rpc/services/status-page/index.ts)
• Review tests (packages/services/src/page/__tests__/page.test.ts)
• Check cubic-dev-ai issues and their fixes
• Post final review

---

cubic-dev-ai issues

All 5 issues flagged across both review cycles are addressed in 312af7c:

Issue	Status
createPage skips assertSlugAvailable	✅ Fixed
createPage skips allowIndex in assertAccessTypeAllowed	✅ Fixed
allowedIpRanges accepts arbitrary strings in schema	✅ Fixed (CIDR pipeline added)
authEmailDomains can't be cleared (undefined → Drizzle skip)	✅ Fixed (?? null at update.ts:134)
Connect nextAuthEmailDomains = undefined doesn't clear DB	✅ Fixed (same ?? null in service handles this)

---

Observations

P2: updateCustomDomain in tRPC does a wasteful getPage read (page.ts:222)

getPage is called solely to obtain current.customDomain, but it fires 3 parallel DB queries (maintenances + pageComponents + pageComponentGroups). The service's updatePageCustomDomain already reads the page internally (getPageInWorkspace), so the tRPC path makes 4 DB round-trips when 1–2 suffice. The service was designed to return existingDomain to help with this — but that return value can't be used here because the Vercel calls need the old domain before the update (so DB and Vercel stay in sync if Vercel throws). The simplest fix is to add a thin getCustomDomain(id) helper in the service, or simply inline getPageInWorkspace at the transport layer for this one field. Not a functional bug, but a measurable overhead on every custom-domain update.

P2: Slug-uniqueness TOCTOU in updateStatusPage (index.ts:492-498)

The handler pre-checks slug with getPageBySlug to surface slugAlreadyExistsError (Code.AlreadyExists + metadata). Then updatePageGeneral re-validates internally via assertSlugAvailable. In the race where two concurrent callers both clear the pre-check simultaneously, the loser of the DB race gets the service's ConflictError, which toConnectError maps to Code.InvalidArgument — not Code.AlreadyExists. Extremely low probability, but callers that key on the gRPC code for retry/UX logic would see an inconsistent code. The handler could catch ConflictError from updatePageGeneral and rethrow as slugAlreadyExistsError to eliminate the gap. Fix this →

P2: Connect API writes customDomain to DB without syncing Vercel

Both createStatusPage and updateStatusPage accept and persist customDomain — but neither calls the Vercel add/remove API. Confirmed this predates this PR (the old direct-DB handler had the same gap), so it's not a regression. Still worth calling out: Connect clients setting a custom domain via gRPC will get a DB row that says the domain is set, but routing won't actually work until a tRPC/dashboard round-trip happens. Worth a comment in the handler and/or a follow-up issue so it doesn't go unnoticed.

P3: Deprecated passwordProtected boolean not updated in updatePagePasswordProtection (update.ts:127-140)

The column is marked @deprecated in the schema, and the v1 REST read path already derives it from accessType (via normalizePasswordProtected in apps/server/src/routes/v1/pages/schema.ts:131), so in practice nothing breaks. Just confirming this was a deliberate omission rather than an oversight.

P3: void ConflictError workaround (create.ts:142)

ConflictError is imported in create.ts but never directly referenced there (it's used in internal.ts). The void ConflictError; trick silences the TS "unused import" warning. Better to just remove the import — if the tsconfig complains about something else, that's a separate issue to address at the tsconfig level rather than with a runtime no-op.

P3: Double cast as unknown as Page (create.ts:90, create.ts:137)

return row as unknown as Page indicates the drizzle inferred type and the Page type aren't structurally aligned — a double cast is needed to suppress TS. The Page type is presumably correct at runtime, but this is a sign the type alias is either looser or stricter than what drizzle returns. If there's a mismatch (e.g. allowedIpRanges as string in drizzle vs string[] in Page), callers relying on the typed shape could hit surprises.

---

Test coverage gaps

The test file covers: newPage, createPage, updatePageGeneral, updatePageLocales, list/get/getSlugAvailable, deletePage. The following service functions have zero integration tests:

• updatePagePasswordProtection — most complex update function; CIDR validation, authEmailDomains clearing, plan gating
• updatePageCustomDomain — returns existingDomain; worth verifying the round-trip
• updatePageAppearance — config merge logic
• updatePageLinks — simple but untested
• updatePageConfiguration — config merge logic

Not blocking for this migration PR, but worth tracking. The access-type clearing fix in particular (authEmailDomains: ... ?? null) would benefit from a regression test. Fix this →

---

What's well done

• Layering is clean: services have zero external-API calls; Vercel, analytics, and external integrations stay at the transport layer.
• Transaction wrapping in updateStatusPage is the right call — per-section service calls each re-use the outer tx via ctx.db, so partial failures on multi-section updates are properly rolled back.
• authEmailDomains / allowedIpRanges clearing with ?? null is correct and the comment in update.ts:130-133 explains the intent well.
• assertSlugAvailable case-insensitive comparison (sql\lower(${page.slug}) = ${slug}``) correctly handles slug collisions across mixed-case existing data.
• CIDR pipeline in UpdatePagePasswordProtectionInput (bare IP → /32 append → z.cidrv4()) is clean and reusable.
• serviceToConverterPage bridge is a pragmatic shim that keeps the 13 still-on-DB methods working without touching their converters.

[cubic-dev-ai]

5 issues found across 80 files (changes from recent commits).

Note: This PR contains a large number of files. cubic only reviews up to 75 files per PR, so some files may not have been reviewed. cubic prioritises the most important files to review.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="packages/services/src/workspace/schemas.ts">

<violation number="1" location="packages/services/src/workspace/schemas.ts:15">
P2: `name` validation allows whitespace-only workspace names. Trim before `min(1)` so blank names are rejected.</violation>
</file>

<file name="packages/services/src/import/schemas.ts">

<violation number="1" location="packages/services/src/import/schemas.ts:25">
P2: Restrict `pageId` to positive integers. Accepting `0`/negative values bypasses truthy-gated ownership and page-target logic, so invalid IDs are silently treated as missing IDs.</violation>
</file>

<file name="packages/services/src/import/phase-writers.ts">

<violation number="1" location="packages/services/src/import/phase-writers.ts:126">
P1: Missing idempotency check in `writeMaintenancesPhase`. Same pattern gap as incidents — every other writer deduplicates, but this one always inserts. A retried import will duplicate all maintenances. Consider matching on `title + from + to + pageId` before inserting.</violation>

<violation number="2" location="packages/services/src/import/phase-writers.ts:358">
P1: Missing idempotency check in `writeIncidentsPhase`. Every other phase writer deduplicates against existing records before inserting, but this one unconditionally creates new `statusReport` rows. A retried import will duplicate all incidents. Consider matching on `title + pageId` (or a provider-stable `sourceId`) before inserting.</violation>
</file>

<file name="packages/services/src/invitation/__tests__/invitation.test.ts">

<violation number="1" location="packages/services/src/invitation/__tests__/invitation.test.ts:87">
P2: Seed a member or existing pending invite before asserting the free-plan cap, otherwise this test will never hit `LimitExceededError`.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P1: Missing idempotency check in writeMaintenancesPhase. Same pattern gap as incidents — every other writer deduplicates, but this one always inserts. A retried import will duplicate all maintenances. Consider matching on title + from + to + pageId before inserting.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At packages/services/src/import/phase-writers.ts, line 126:

<comment>Missing idempotency check in `writeMaintenancesPhase`. Same pattern gap as incidents — every other writer deduplicates, but this one always inserts. A retried import will duplicate all maintenances. Consider matching on `title + from + to + pageId` before inserting.</comment>

<file context>
@@ -0,0 +1,761 @@
+    return existingBySlug.id;
+  }
+
+  const [inserted] = await tx
+    .insert(page)
+    .values({
</file context>

[cubic-dev-ai]

P1: Missing idempotency check in writeIncidentsPhase. Every other phase writer deduplicates against existing records before inserting, but this one unconditionally creates new statusReport rows. A retried import will duplicate all incidents. Consider matching on title + pageId (or a provider-stable sourceId) before inserting.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At packages/services/src/import/phase-writers.ts, line 358:

<comment>Missing idempotency check in `writeIncidentsPhase`. Every other phase writer deduplicates against existing records before inserting, but this one unconditionally creates new `statusReport` rows. A retried import will duplicate all incidents. Consider matching on `title + pageId` (or a provider-stable `sourceId`) before inserting.</comment>

<file context>
@@ -0,0 +1,761 @@
+        sourceComponentIds: string[];
+      };
+
+      const [insertedReport] = await tx
+        .insert(statusReport)
+        .values({
</file context>

[cubic-dev-ai]

P2: name validation allows whitespace-only workspace names. Trim before min(1) so blank names are rejected.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At packages/services/src/workspace/schemas.ts, line 15:

<comment>`name` validation allows whitespace-only workspace names. Trim before `min(1)` so blank names are rejected.</comment>

<file context>
@@ -0,0 +1,17 @@
+export type ListWorkspacesInput = z.infer<typeof ListWorkspacesInput>;
+
+export const UpdateWorkspaceNameInput = z.object({
+  name: z.string().min(1),
+});
+export type UpdateWorkspaceNameInput = z.infer<typeof UpdateWorkspaceNameInput>;
</file context>

[cubic-dev-ai]

P2: Restrict pageId to positive integers. Accepting 0/negative values bypasses truthy-gated ownership and page-target logic, so invalid IDs are silently treated as missing IDs.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At packages/services/src/import/schemas.ts, line 25:

<comment>Restrict `pageId` to positive integers. Accepting `0`/negative values bypasses truthy-gated ownership and page-target logic, so invalid IDs are silently treated as missing IDs.</comment>

<file context>
@@ -0,0 +1,42 @@
+   * against that page's current component count so the remaining-capacity
+   * warnings line up with what `run` will actually do.
+   */
+  pageId: z.number().int().optional(),
+});
+export type PreviewImportInput = z.infer<typeof PreviewImportInput>;
</file context>

[cubic-dev-ai]

P2: Seed a member or existing pending invite before asserting the free-plan cap, otherwise this test will never hit LimitExceededError.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At packages/services/src/invitation/__tests__/invitation.test.ts, line 87:

<comment>Seed a member or existing pending invite before asserting the free-plan cap, otherwise this test will never hit `LimitExceededError`.</comment>

<file context>
@@ -0,0 +1,220 @@
+
+  test("enforces the members plan cap on free workspace", async () => {
+    // Free plan has `members: 1` — the owner already occupies that slot.
+    await expect(
+      createInvitation({
+        ctx: freeCtx,
</file context>