Skip to content

chore: promote test to main (sandbox staged-files cutover)#1749

Merged
sweetmantech merged 1 commit into
mainfrom
test
May 27, 2026
Merged

chore: promote test to main (sandbox staged-files cutover)#1749
sweetmantech merged 1 commit into
mainfrom
test

Conversation

@sweetmantech

@sweetmantech sweetmantech commented May 27, 2026

Copy link
Copy Markdown
Collaborator

Promotes test to main. Includes:

Manual verification of #1744 ran on the preview deployment — both Vercel Blob handshake (/api/sandboxes/staged-file) and commit (/api/sandboxes/files) hit api with the Authorization: Bearer header; CORS preflight ok; old /api/sandbox/upload route on chat returns 404 as expected.


Summary by cubic

Promotes test to main and completes the sandbox upload cutover to the API. Removes the local POST /api/sandbox/upload route and updates uploads to call the API’s /api/sandboxes/staged-file with an Authorization: Bearer header.

Written for commit 7f0c518. Summary will update on new commits. Review in cubic

Summary by CodeRabbit

  • Refactor
    • Updated the file upload mechanism to use a new authentication approach with bearer token headers for improved security and consistency across the sandbox infrastructure.

Review Change Stack

* feat(chat): migrate sandbox upload token handshake to api

Flips `handleUploadUrl` in lib/sandboxes/uploadSandboxFiles.ts from
the local /api/sandbox/upload route to the new
${getClientApiBaseUrl()}/api/sandboxes/staged-files on api, then
deletes the now-unused local route.

Closes Group 6 of the chat→api migration. Pairs with api PR for
the staged-files handler and docs PR for the OpenAPI entry.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor(chat): point sandbox upload at /api/sandboxes/stage-files

Pairs with the api-side rename of /api/sandboxes/staged-files to
/api/sandboxes/stage-files.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor(chat): point sandbox upload at /api/sandboxes/staged-file

Pairs with the api-side rename to the noun-shaped resource path.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor(chat): pass sandbox staging auth via Authorization header

Vercel Blob client's upload() supports a `headers` option that
forwards arbitrary headers onto the handshake POST — replacing the
clientPayload.token dance with a normal Bearer header. Pairs with
the api-side switch to validateAuthContext().

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@vercel

vercel Bot commented May 27, 2026

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
chat Building Building Preview May 27, 2026 1:14pm

Request Review

@coderabbitai

coderabbitai Bot commented May 27, 2026

Copy link
Copy Markdown
Contributor

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: db045c22-954a-4c84-9bac-43a7c911b31c

📥 Commits

Reviewing files that changed from the base of the PR and between 9e94db1 and 7f0c518.

📒 Files selected for processing (2)
  • app/api/sandbox/upload/route.ts
  • lib/sandboxes/uploadSandboxFiles.ts

📝 Walkthrough

Walkthrough

The pull request removes the legacy /api/sandbox/upload POST endpoint and updates the client-side uploadSandboxFiles function to use a new /api/sandboxes/staged-file endpoint with Bearer token authentication, replacing the prior clientPayload-based token mechanism.

Changes

Upload Endpoint Migration

Layer / File(s) Summary
Migrate upload endpoint and authentication
app/api/sandbox/upload/route.ts, lib/sandboxes/uploadSandboxFiles.ts
The legacy /api/sandbox/upload POST route is deleted, and uploadSandboxFiles updates its Vercel Blob upload target to the new ${getClientApiBaseUrl()}/api/sandboxes/staged-file endpoint with Authorization: Bearer <accessToken> header authentication.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Possibly related PRs

  • recoupable/chat#1601: Directly conflicts with this PR's endpoint migration; that PR modifies uploadSandboxFiles to target /api/sandbox/upload while this PR removes that endpoint entirely.
  • recoupable/chat#1607: Modifies the /api/sandbox/upload POST handler's token generation logic via onBeforeGenerateToken, which is being deleted in this PR.
  • recoupable/chat#1603: Originally added the /api/sandbox/upload endpoint and implemented the old uploadSandboxFiles flow; this PR reverses that work by removing the endpoint and redirecting to /api/sandboxes/staged-file.

Poem

🚀 Old upload paths fade to dust,
Bearer tokens now a must,
Staged files take the stage today,
Legacy routes drift away! 🎪

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch test

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@sweetmantech sweetmantech merged commit 464ccb7 into main May 27, 2026
2 of 4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants