apps/web/client/src/server/api/routers/user/user.ts (1)

25-26: Harden avatar derivation with broader fallbacks

Some IdPs store avatar under different keys. Add a short fallback chain to be resilient across providers.

Apply this diff:

-            avatarUrl: user.avatarUrl ?? authUser.user_metadata.avatar_url,
+            avatarUrl:
+                user.avatarUrl
+                ?? authUser.user_metadata?.avatar_url
+                ?? authUser.user_metadata?.avatarUrl
+                ?? authUser.user_metadata?.picture
+                ?? null,

-                avatarUrl: input.avatarUrl ?? authUser.user_metadata.avatar_url,
+                avatarUrl:
+                    input.avatarUrl
+                    ?? authUser.user_metadata?.avatar_url
+                    ?? authUser.user_metadata?.avatarUrl
+                    ?? authUser.user_metadata?.picture
+                    ?? null,

Also applies to: 59-60

apps/backend/supabase/config.toml (1)

10-15: Consider adding 127.0.0.1 app URLs for local dev flexibility

If you sometimes run the web app at 127.0.0.1:3000 (not localhost), add it to allowed redirects to avoid blocked post-auth redirects.

Apply this diff:

 additional_redirect_urls = [
     "http://localhost:3000",
     "http://localhost:3000/auth/callback",
+    "http://127.0.0.1:3000",
+    "http://127.0.0.1:3000/auth/callback",
 ]

apps/backend/package.json (1)

5-5: Excluding logflare/vector may conflict with analytics settings

You’re starting Supabase without logflare/vector, while analytics.enabled = true remains in config.toml. Validate local startup health and decide whether to:

• keep exclude flags and set [analytics] enabled = false, or
• include the services during supabase start.

apps/web/client/src/app/project/[id]/_hooks/use-start-project.tsx (1)

39-44: Surface mutation errors to the user

Add onError to toast/log failures so access-tracking issues aren’t silent.

Apply this diff:

-    const { mutateAsync: trackProjectAccess } = api.project.trackAccess.useMutation({
-        onSuccess: () => {
+    const { mutateAsync: trackProjectAccess } = api.project.trackAccess.useMutation({
+        onSuccess: () => {
             // Invalidate project list to refresh recent projects
             apiUtils.project.list.invalidate();
-        },
+        },
+        onError: (err) => {
+            console.error('Failed to track project access', err);
+            toast.message('Could not update recent projects', {
+                description: err instanceof Error ? err.message : 'Unknown error',
+            });
+        },
     });

apps/web/client/src/server/api/routers/project/project.ts (2)

164-181: Sort in SQL by last access (or updatedAt) to reduce app-side work and align semantics.

Move sorting to the query and, if adopting lastAccessedAt, order by it (fallback to projects.updatedAt).

Example (Drizzle-style; adjust imports for desc/sql):

-            const fetchedUserProjects = await ctx.db.query.userProjects.findMany({
-                where: input?.excludeProjectId ? and(
-                    eq(userProjects.userId, ctx.user.id),
-                    ne(userProjects.projectId, input.excludeProjectId),
-                ) : eq(userProjects.userId, ctx.user.id),
-                with: {
-                    project: true,
-                },
-                limit: input?.limit,
-            });
-            return fetchedUserProjects.map((userProject) => toProject(userProject.project)).sort((a, b) => new Date(b.metadata.updatedAt).getTime() - new Date(a.metadata.updatedAt).getTime());
+            const rows = await ctx.db
+                .select()
+                .from(userProjects)
+                .leftJoin(projects, eq(userProjects.projectId, projects.id))
+                .where(
+                    input?.excludeProjectId
+                        ? and(eq(userProjects.userId, ctx.user.id), ne(userProjects.projectId, input.excludeProjectId))
+                        : eq(userProjects.userId, ctx.user.id),
+                )
+                // If lastAccessedAt exists, prefer it; otherwise order by projects.updatedAt
+                .orderBy(sql`COALESCE(${userProjects.lastAccessedAt}, ${projects.updatedAt}) DESC`)
+                .limit(input?.limit ?? undefined);
+            return rows.map((r) => toProject(r.projects));

Additional imports (top of file):

import { desc, sql } from 'drizzle-orm';

---

406-412: Track access per user instead of mutating project.updatedAt
updatedAt should reflect content changes; using it for “recent” access affects all members and conflates semantics. Add a lastAccessedAt timestamp to your user_projects table and update that here:

await ctx.db
  .update(userProjects)
  .set({ lastAccessedAt: new Date() })
  .where(and(
    eq(userProjects.userId, ctx.user.id),
    eq(userProjects.projectId, input.projectId),
  ));

You’ll need to add the lastAccessedAt column in the Drizzle schema and create a migration.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

apps/web/client/src/server/api/routers/project/project.ts (1)

407-430: IDOR closed with membership check + UUID validation; consider atomic update/returning and access-specific timestamp.

Well done on adding protectedProcedure, z.string().uuid(), and the membership check. To harden further and improve UX semantics:

• Make the update atomic and verify one row changed (handles race where project is deleted between check and update) and use DB time to avoid clock skew.
• Optional: avoid overloading updatedAt for “recently accessed.” Add a lastAccessedAt column and sort by it to prevent confusing modification history.

Apply within these lines:

-            await ctx.db.update(projects).set({
-                updatedAt: new Date(),
-            }).where(eq(projects.id, input.projectId));
-            
-            return { success: true };
+            const updated = await ctx.db
+                .update(projects)
+                .set({ updatedAt: sql`now()` })
+                .where(eq(projects.id, input.projectId))
+                .returning({ id: projects.id });
+
+            if (updated.length === 0) {
+                // Project was likely removed between membership check and update
+                throw new TRPCError({ code: 'NOT_FOUND' });
+            }
+            return { success: true };

Outside the selected range, add sql to the drizzle import:

import { and, eq, ne, sql } from 'drizzle-orm';

If you opt for a dedicated access timestamp later, I can propose the migration + list query change.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.