Added Category update option to more options inside dashboard

[LucasHahne]

Option to assign when tool does not yet has a category assigned due to first time submission error:

Category choice selection:

[vercel]

@LucasHahne is attempting to deploy a commit to the Power Platform Tool Box Team on Vercel.

A member of the Team first needs to authorize it.

[LucasHahne]

Relates to Enhancement #102

[Power-Maverick]

Thanks for the enhancement. Two things:

1. Do not need to add a filter to only show the menu option when category doesnt exists; it should always show that allows them to edit (add/remove) the categories
2. There are some issues like z-[9998] which is not correct in tailwind

[LucasHahne]

Was not sure about that: Do not need to add a filter to only show the menu option when category doesnt exists; it should always show that allows them to edit (add/remove) the categories as the default was not even any change. Will adjust that.

Any default for the highest z-index to always be on top?

[LucasHahne]

Adjusted the mentioned issues. Also merged main to overcome merge conflict due to the latest update in the dashboard "More" Menu.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
web	Ready	Preview	Aug 30, 2026 3:24am

[Copilot]

🟡 Changes recommended

The update-categories endpoint currently deletes all existing category relations before inserting new ones, which can leave a tool with zero categories if the insert fails.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds an “Edit categories” option in the authenticated dashboard so tool owners can assign (or update) categories for their tool—particularly useful when a tool ended up without categories due to a first-time submission error.

Changes:

• Added a new /api/tools/update-categories POST route to update tool↔category relationships in Supabase.
• Added a dashboard “Edit categories” modal (multi-select up to 3) wired to the new API route.
• Updated mock tool data to include an example tool with no categories.

File summaries

File	Description
lib/mock-tools.ts	Adjusts mock tool data to represent a tool with no categories.
app/api/tools/update-categories/route.ts	New API endpoint to validate and update a tool’s category relationships.
app/(authenticated)/dashboard/page.tsx	Adds UI entry point + modal + client logic for editing categories.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Power-Maverick]

See copilot review notes

[Copilot]

🟡 Changes recommended

The new update-categories API route lacks robust input validation for categoryIds, and the mock-data change introduces a broken mock-mode path where the UI offers category assignment but the API cannot succeed without Supabase.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 2
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

The new API route currently turns malformed/invalid JSON requests into 500 responses instead of a proper 400, which should be corrected before approval.

Review details

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

app/api/tools/update-categories/route.ts:53

• request.json() can throw (invalid JSON / empty body), but the outer catch will convert that client error into a 500 "Internal server error". This should be handled explicitly and return a 400 so the client gets a correct error response.

        // Parse request body
        const body = (await request.json()) as UpdateCategoriesRequest;
        const { toolId, categoryIds } = body;

• Files reviewed: 3/3 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

The new flow has an authenticated-token edge case that can silently do nothing in the UI, and the new endpoint should reject overly large categoryIds arrays before deduplication to avoid unnecessary resource usage.

Review details

Suppressed comments (2)

Previously missed (2) — in code that hasn't changed since the last review.

app/api/tools/update-categories/route.ts:73

• The request validates uniqueCategoryIds.length <= 3, but it still builds a Set from the full categoryIds array first. A malicious (but authenticated) client can send an extremely large array to force unnecessary memory/CPU work. Since the UI only ever sends up to 3 IDs, consider rejecting overly large payloads before deduplication.

        if (!categoryIds || !Array.isArray(categoryIds) || categoryIds.length === 0) {
            return NextResponse.json({ error: "At least one category is required" }, { status: 400 });
        }

        if (!categoryIds.every((id) => typeof id === "number" && Number.isInteger(id))) {

app/(authenticated)/dashboard/page.tsx:266

• handleAssignCategories returns early when authToken is empty, which can leave the UI appearing to "do nothing" (Save/Update button stays enabled and no error is shown). This is possible if sessionStorage lacks supabaseToken while the dashboard still loads user data.

    const handleAssignCategories = async () => {
        if (!categoryModal || !authToken) return;

• Files reviewed: 3/3 changed files
• Comments generated: 0 new
• Review effort level: Lite