Added Category update option to more options inside dashboard - #103

Adds an “Edit categories” option in the authenticated dashboard so tool owners can assign (or update) categories for their tool—particularly useful when a tool ended up without categories due to a first-time submission error.

Changes:

• Added a new /api/tools/update-categories POST route to update tool↔category relationships in Supabase.
• Added a dashboard “Edit categories” modal (multi-select up to 3) wired to the new API route.
• Updated mock tool data to include an example tool with no categories.

• Files reviewed: 3/3 changed files
• Comments generated: 2
• Review effort level: Lite

• Files reviewed: 3/3 changed files
• Comments generated: 2
• Review effort level: Lite

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

app/api/tools/update-categories/route.ts:53

• request.json() can throw (invalid JSON / empty body), but the outer catch will convert that client error into a 500 "Internal server error". This should be handled explicitly and return a 400 so the client gets a correct error response.

        // Parse request body
        const body = (await request.json()) as UpdateCategoriesRequest;
        const { toolId, categoryIds } = body;

• Files reviewed: 3/3 changed files
• Comments generated: 0 new
• Review effort level: Lite

Suppressed comments (2)

Previously missed (2) — in code that hasn't changed since the last review.

app/api/tools/update-categories/route.ts:73

• The request validates uniqueCategoryIds.length <= 3, but it still builds a Set from the full categoryIds array first. A malicious (but authenticated) client can send an extremely large array to force unnecessary memory/CPU work. Since the UI only ever sends up to 3 IDs, consider rejecting overly large payloads before deduplication.

        if (!categoryIds || !Array.isArray(categoryIds) || categoryIds.length === 0) {
            return NextResponse.json({ error: "At least one category is required" }, { status: 400 });
        }

        if (!categoryIds.every((id) => typeof id === "number" && Number.isInteger(id))) {

app/(authenticated)/dashboard/page.tsx:266

• handleAssignCategories returns early when authToken is empty, which can leave the UI appearing to "do nothing" (Save/Update button stays enabled and no error is shown). This is possible if sessionStorage lacks supabaseToken while the dashboard still loads user data.

    const handleAssignCategories = async () => {
        if (!categoryModal || !authToken) return;

• Files reviewed: 3/3 changed files
• Comments generated: 0 new
• Review effort level: Lite