fix(tier-client): avoid 414 URI Too Large on orgs with many enrollments (#1390)

## Summary

- **Root cause**: After migrating from DynamoDB to PostgREST,
`batchGetByKeys` generates GET requests with `?id=in.(uuid1,uuid2,...)`
in the URL. For orgs with hundreds of site enrollments, this exceeds
HTTP URL length limits causing **414 Request-URI Too Large**.
- **`getAllEnrollment()`**: When a specific site is provided, skips
batch fetch entirely and uses a single `findById` call. For org-only
path, chunks `batchGetByKeys` into groups of 50 IDs (~1,800 chars per
chunk, well under 8KB limit).
- **`getFirstEnrollment()`**: Now standalone (no longer calls
`getAllEnrollment`). Site-specific path does in-memory match and returns
`this.site` directly. Org-only path iterates enrollments with `findById`
one at a time with early exit on first match.

## Test plan

- [x] All 70 unit tests pass
- [x] 100% code coverage (statements, branches, functions, lines)
- [x] ESLint clean
- [ ] Deploy to dev and test `sites-resolve` endpoint with AEM Reference
Demo org (the org that was hitting 414)
- [ ] Verify login flow works for orgs with many enrollments

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: ekremney

packages/spacecat-shared-tier-client/src/tier-client.js

@@ -239,38 +239,54 @@ class TierClient {
         return { entitlement, enrollments: [] };
       }
 
-      // Fetch all sites using batchGetByKeys
+      // When a specific site is provided, skip batch fetch entirely.
+      // Just filter enrollments by site ID and verify org ownership with a single lookup.
+      if (this.site) {
+        const targetSiteId = this.site.getId();
+        const matchingEnrollments = allEnrollments.filter(
+          (se) => se.getSiteId() === targetSiteId,
+        );
+
+        if (matchingEnrollments.length === 0) {
+          return { entitlement, enrollments: [] };
+        }
+
+        const site = await this.Site.findById(targetSiteId);
+        if (!site || site.getOrganizationId() !== orgId) {
+          return { entitlement, enrollments: [] };
+        }
+
+        return { entitlement, enrollments: matchingEnrollments };
+      }
+
+      // Org-only path: fetch sites in chunks to avoid 414 URI Too Large.
+      // PostgREST uses GET with ?id=in.(...) which has URL length limits.
+      const CHUNK_SIZE = 50;
       const siteKeys = allEnrollments.map((enrollment) => ({ siteId: enrollment.getSiteId() }));
-      const sitesResult = await this.Site.batchGetByKeys(siteKeys);
-      const sitesMap = new Map(sitesResult.data.map((site) => [site.getId(), site]));
+      const sitesMap = new Map();
+
+      for (let i = 0; i < siteKeys.length; i += CHUNK_SIZE) {
+        const chunk = siteKeys.slice(i, i + CHUNK_SIZE);
+        // eslint-disable-next-line no-await-in-loop
+        const sitesResult = await this.Site.batchGetByKeys(chunk);
+        for (const site of sitesResult.data) {
+          sitesMap.set(site.getId(), site);
+        }
+      }
 
       // Filter enrollments where site's orgId matches the entitlement's orgId
       const validEnrollments = [];
 
       for (const enrollment of allEnrollments) {
         const site = sitesMap.get(enrollment.getSiteId());
         if (!site) {
-          // Site not found, log warning and skip
           this.log.warn(`Site not found for enrollment ${enrollment.getId()} with siteId ${enrollment.getSiteId()}`);
-        } else {
-          const siteOrgId = site.getOrganizationId();
-          if (siteOrgId === orgId) {
-            validEnrollments.push(enrollment);
-          }
+        } else if (site.getOrganizationId() === orgId) {
+          validEnrollments.push(enrollment);
         }
       }
 
-      if (this.site) {
-        // Return site enrollments matching the entitlement and site
-        const siteId = this.site.getId();
-        const matchingEnrollments = validEnrollments.filter(
-          (se) => se.getSiteId() === siteId,
-        );
-        return { entitlement, enrollments: matchingEnrollments };
-      } else {
-        // Return all valid enrollments for the entitlement
-        return { entitlement, enrollments: validEnrollments };
-      }
+      return { entitlement, enrollments: validEnrollments };
     } catch (error) {
       this.log.error(`Error getting all enrollments: ${error.message}`);
       throw error;
@@ -279,28 +295,51 @@ class TierClient {
 
   /**
    * Gets the first enrollment and its site, filtered by productCode.
-   * - If site is provided: returns site enrollment for the entitlement matching productCode
-   * - If org-only: returns first site enrollment for the entitlement matching productCode
+   * - If site is provided: finds matching enrollment and returns this.site directly
+   * - If org-only: iterates enrollments, fetches sites one at a time, returns first org match
    * @returns {Promise<object>} Object with entitlement, enrollment, and site.
    */
   async getFirstEnrollment() {
     try {
-      const { entitlement, enrollments } = await this.getAllEnrollment();
+      const orgId = this.organization.getId();
+      const entitlement = await this.Entitlement
+        .findByOrganizationIdAndProductCode(orgId, this.productCode);
+
+      if (!entitlement) {
+        return { entitlement: null, enrollment: null, site: null };
+      }
+
+      const allEnrollments = await this.SiteEnrollment.allByEntitlementId(entitlement.getId());
 
-      if (!entitlement || !enrollments?.length) {
+      if (!allEnrollments || allEnrollments.length === 0) {
         return { entitlement: null, enrollment: null, site: null };
       }
 
-      const firstEnrollment = enrollments[0];
-      const enrollmentSiteId = firstEnrollment.getSiteId();
-      const site = await this.Site.findById(enrollmentSiteId);
+      // When a specific site is set, find its enrollment in memory — no fetch needed.
+      if (this.site) {
+        const targetSiteId = this.site.getId();
+        const matchingEnrollment = allEnrollments.find(
+          (se) => se.getSiteId() === targetSiteId,
+        );
+        if (matchingEnrollment) {
+          return { entitlement, enrollment: matchingEnrollment, site: this.site };
+        }
+        return { entitlement: null, enrollment: null, site: null };
+      }
 
-      if (!site) {
-        this.log.warn(`Site not found for enrollment ${firstEnrollment.getId()} with site ID ${enrollmentSiteId}`);
-        return { entitlement, enrollment: firstEnrollment, site: null };
+      // Org-only: iterate enrollments, fetch site one at a time, return first org match.
+      // This avoids batch-fetching all sites (which causes 414 on large sets).
+      for (const enrollment of allEnrollments) {
+        // eslint-disable-next-line no-await-in-loop
+        const site = await this.Site.findById(enrollment.getSiteId());
+        if (!site) {
+          this.log.warn(`Site not found for enrollment ${enrollment.getId()} with siteId ${enrollment.getSiteId()}`);
+        } else if (site.getOrganizationId() === orgId) {
+          return { entitlement, enrollment, site };
+        }
       }
 
-      return { entitlement, enrollment: firstEnrollment, site };
+      return { entitlement: null, enrollment: null, site: null };
     } catch (error) {
       this.log.error(`Error getting first enrollment: ${error.message}`);
       throw error;