[Programcode]

Summary

• rewrite migrated feature configs with the permitted targeted UPDATE
• avoid authenticated INSERT attempts on user_settings during hydration

Verification

• focused settings tests: 12 passed
• lint passed
• typecheck passed
• protected staging failure reproduced the 403 before this fix

Summary by CodeRabbit

• Bug Fixes
  • Improved configuration migration so only migrated feature settings are saved for the authenticated user.
  • Prevented unrelated settings from being overwritten during server synchronization.
  • Ensured sensitive client credentials are excluded from persisted feature configurations.
• Tests
  • Expanded coverage for user-scoped settings updates and configuration sanitization.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
debate-navigator	Ready	Preview	Sep 18, 2026 5:43pm UTC

[coderabbitai]

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Free

Run ID: a7350b4f-1f59-4e5e-b2b8-766786ea7ab0

📥 Commits

Reviewing files that changed from the base of the PR and between 7fc286b and 897bc42.

📒 Files selected for processing (2)

• src/lib/stores/settings-store.ts
• src/test/settings-store.test.ts

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The settings migration now updates only feature_configs and updated_at for the authenticated user. Tests verify the user-scoped update, sanitized configurations, and no-rewrite behavior.

Changes

Settings migration persistence

Layer / File(s)	Summary
Targeted feature configuration update src/lib/stores/settings-store.ts, src/test/settings-store.test.ts	The migration uses a user-scoped update instead of a full-settings upsert. The update writes only migrated feature_configs and updated_at. Tests verify sanitized configurations and detect both update and upsert writes when checking for rewrites.

Estimated code review effort: 2 (Simple) | ~10 minutes

---

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Essentials by visiting https://app.coderabbit.ai/settings/billing.

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

🟡 Changes recommended

Normal settings updates can still fail with 403 because authenticated INSERT permission is revoked.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

This PR avoids authenticated INSERT attempts during settings migration by using a permitted targeted update.

Changes:

• Replaced migration-time upsert with a user-scoped UPDATE.
• Updated tests for targeted updates and canonical no-op behavior.
• Normal settings changes still use upsert, leaving a critical 403 issue unresolved.

File summaries

File	Summary
src/test/settings-store.test.ts	Verifies update behavior and canonical-config no-op behavior.
src/lib/stores/settings-store.ts	Uses targeted updates for migration; regular persistence still uses upsert.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.