feat: block structural project edits

[usmanliaqat0]

Summary

• Block structural project edits after team formation.
• Keep non structural project updates available when stacks were already taken.
• Fix SonarCloud findings by using locale aware sorting and extracting stack mutation flow out of the route handler.
• Run stack diff mutations and the project update inside a single Prisma transaction.
• Configure SonarCloud to read the generated JavaScript LCOV report.

Validation

• npx jest src/tests/unit/api/team-project/team-project-id-route.test.ts --coverage --collectCoverageFrom='src/app/api/team-project/[id]/route.ts' --runInBand
• npm run lint
• npm test
• npm run build
• npm run test:push
• Chrome browser QA on /, /login, /dashboard/team-projects/1234567890123456789012345/edit, and PUT /api/team-project/[id]

Summary by CodeRabbit

• Bug Fixes
  • Prevented edits that change a team project’s structure once team formation has begun, blocking unauthorized changes and returning a clear 403 response.
  • Improved how project stack updates are applied, including better consistency and automatic cleanup of related records.
• Chores
  • Added SonarCloud coverage report path configuration for JavaScript.
• Tests
  • Added unit tests for the PUT /api/team-project/[id] route covering both permitted updates and blocked structural changes after team formation.

[vercel]

@usmanliaqat0 is attempting to deploy a commit to the TryCatch 4 Match's projects Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds structural change detection to the team-project PUT endpoint, blocks structural updates after team formation, refactors stack persistence into a helper, adds unit tests, and configures SonarCloud LCOV coverage reporting.

Changes

Structural Change Guard for Team-Project Updates

Layer / File(s)	Summary
Structural comparison and stack diff helpers src/app/api/team-project/[id]/route.ts	Adds internal types and helpers to compare incoming and existing project structure, normalize skills and stacks, and plan and apply stack changes.
PUT endpoint query and 403 guard wiring src/app/api/team-project/[id]/route.ts	Narrows the project lookup to structural comparison fields, returns 403 when structural changes are attempted after stacksTaken exist, and routes stack updates through applyProjectStackChanges.
Unit tests for PUT structural guard src/tests/unit/api/team-project/team-project-id-route.test.ts	Adds Jest mocks, fixtures, and tests for allowed updates and blocked structural changes after team formation.
SonarCloud coverage config sonar-project.properties	Adds sonar.javascript.lcov.reportPaths pointing to coverage/lcov.info.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant PUTRoute
  participant planProjectStackChanges
  participant Prisma

  PUTRoute->>planProjectStackChanges: compare existing and incoming structure
  planProjectStackChanges-->>PUTRoute: stack changes
  PUTRoute->>Prisma: delete/update/create projectStack rows

Loading

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description covers the summary and validation, but it is missing the related issue, implementation details, testing steps, and checklist sections.	Add the missing template sections: related issue, changes made, step-by-step testing, optional evidence/notes, and the checklist.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the main change: blocking structural project edits.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

src/tests/unit/api/team-project/team-project-id-route.test.ts (1)

146-206: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Consider adding coverage for deadline and totalValue structural blocks.

hasStructuralProjectChanges also guards deadline and totalValue (route lines 85-86), but only name, skills, and stacks are exercised here. Two small cases mirroring the existing blocked-update tests would lock in the full guard contract.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/tests/unit/api/team-project/team-project-id-route.test.ts` around lines
146 - 206, Add test coverage in team-project-id-route.test for the remaining
structural guards handled by hasStructuralProjectChanges in the PUT route:
verify that changing deadline and changing totalValue after stacksTaken exist
both return 403 and do not call prisma.project.update. Mirror the existing
blocked-update cases using PUT, createRequest, createContext, existingProject,
and the same MESSAGES.AUTH.UNAUTHORIZED assertion pattern.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/app/api/team-project/`[id]/route.ts:
- Around line 92-129: The stack CRUD in applyProjectStackChanges and the later
project update are not atomic, so partial failures can leave projectStack and
stackTaken mutations persisted without the project update. Refactor
applyProjectStackChanges to accept a transactional Prisma client and execute its
deleteMany/update/create work inside a single prisma.$transaction alongside the
prisma.project.update call in the team-project route handler. Use the same tx
for all stack and project writes so the diff application and project update
succeed or fail together.

---

Nitpick comments:
In `@src/tests/unit/api/team-project/team-project-id-route.test.ts`:
- Around line 146-206: Add test coverage in team-project-id-route.test for the
remaining structural guards handled by hasStructuralProjectChanges in the PUT
route: verify that changing deadline and changing totalValue after stacksTaken
exist both return 403 and do not call prisma.project.update. Mirror the existing
blocked-update cases using PUT, createRequest, createContext, existingProject,
and the same MESSAGES.AUTH.UNAUTHORIZED assertion pattern.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 8f34f932-55f0-4be0-a55c-4173774e01d1

📥 Commits

Reviewing files that changed from the base of the PR and between f8a4bdf and fef574d.

📒 Files selected for processing (3)

• sonar-project.properties
• src/app/api/team-project/[id]/route.ts
• src/tests/unit/api/team-project/team-project-id-route.test.ts

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
87.1% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud