Stage

[evereq]

Summary

Related Issues

Description

Changes Made

• [ ]
• [ ]
• [ ]

Screenshots / Videos

Type of Change

• 🐛 Bug fix (non-breaking change addressing an issue)
• ✨ New feature (non-breaking change adding functionality)
• 💥 Breaking change (fix or feature causing existing functionality to change)
• 📝 Documentation update
• 🔧 Configuration change
• 🧪 Test addition or modification
• 🛠️ CI/CD infrastructure improvement
• ♻️ Refactoring (no functional changes)
• 🎨 Code style/formatting update
• 🚀 Performance improvement

Implementation Details

Testing Instructions

Deployment Notes

Checklist

• I have performed a self-review of my code
• I have added/updated tests that prove my fix is effective or my feature works
• I have updated relevant documentation
• My changes generate no new warnings or errors
• I have verified my changes in multiple browsers/environments (if applicable)
• New and existing unit tests pass locally with my changes
• I have made corresponding changes to the documentation
• My code follows the established code style of the project
• I have commented my code, particularly in hard-to-understand areas

Additional Context

---

Note

Introduces end-to-end Sponsorships and Collections, adds item view tracking and client stats, and updates platform/cron/payment integrations and env/config.

• Collections: New admin UI (create/edit/delete, assign items) with REST APIs; public collections list/detail pages with ISR and cache invalidation
• Sponsorships: User sponsor page + checkout (Stripe/LemonSqueezy/Polar), public ads endpoint; admin sponsorships dashboard with approve/reject/cancel/delete; extended Polar/LemonSqueezy webhooks for sponsor ads activation/cancellation/renewal
• Tracking & dashboard: Item view tracking endpoint with bot/owner filtering and cookie dedupe; ItemViewTracker hooked into item page; new /api/client/dashboard/stats
• Platform extract: Secure proxy POST /api/extract to Ever Works Platform (gracefully disables when not configured)
• Cron & sync: New cron routes for subscription reminders and expirations; sync cron now uses config-based secret
• Auth/UX: Redirect defaults to /client/dashboard; Facebook env vars renamed to FB_CLIENT_ID/SECRET; added CurrencyProvider; listing pages wrap in SponsorAdsProvider; categories/tags layout/pagination tweaks
• Docs/Env/CI: .env.example and README expanded (Platform API, email provider, LemonSqueezy variants); CI uses FB_* secrets

^{Written by Cursor Bugbot for commit 3230af6. This will update automatically on new commits. Configure here.}

---

Summary by cubic

Introduces Sponsor Ads and Collections admin systems with multi-provider checkout and public display, plus subscription auto-renewal/expiration, item view analytics, and currency management. Also migrates to a typed config service, updates env/CI vars, and improves UI across listings and billing.

• New Features

  • Sponsor Ads: admin pages and APIs, Stripe/LemonSqueezy/Polar checkout, webhook activation, listing/sidebars display with rotating cards.
  • Collections Admin: create/edit/delete, batch item assignment, public collection pages, active-only visibility.
  • Subscriptions: auto-renewal toggle (API + UI), renewal reminders cron, expiration cron, plan-status API, expired/warning banners.
  • Analytics: unique daily item view tracking (server endpoint + client tracker), integrated into client dashboard stats.
  • Currency: user currency API, app-wide CurrencyProvider, locale-aware formatting in billing.
  • Client Dashboard: real stats API with views, engagement charts, and top items.

• Migration

  • Configure PLATFORM_API_URL and PLATFORM_API_SECRET_TOKEN to enable URL metadata extraction.
  • Set sponsor ad price/variant IDs for Stripe/LemonSqueezy/Polar (weekly/monthly) before enabling checkout.
  • Provide CRON_SECRET for cron endpoints (sync, subscription reminders/expiration).
  • CI env rename: use FB_CLIENT_ID and FB_CLIENT_SECRET (replaces FACEBOOK_* in workflow).
  • Ensure APP_URL and EMAIL settings are present for webhooks/emails; project now reads config via the ConfigService.

^{Written for commit 3230af6. Summary will update on new commits.}

[greptile-apps]

Skipped: This PR changes more files than the configured file change limit: (262 files found, 100 file limit)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
ever-works-website-template	Ready	Preview, Comment	Dec 30, 2025 6:59pm

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch develop

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cubic-dev-ai]

19 issues found across 262 files

Note: This PR contains a large number of files. cubic only reviews up to 75 files per PR, so some files may not have been reviewed.

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="app/api/sponsor-ads/user/[id]/cancel/route.ts">

<violation number="1" location="app/api/sponsor-ads/user/[id]/cancel/route.ts:43">
P2: Internal error messages are exposed to clients for 500 errors. This could leak sensitive implementation details (database errors, connection info, etc.). Consider using a generic message for unexpected errors while keeping the specific message for expected validation errors (400).</violation>
</file>

<file name="components/categories-grid.tsx">

<violation number="1" location="components/categories-grid.tsx:28">
P1: Standard pagination mode is broken: the `UniversalPagination` component and `totalPages` calculation were removed, but page sync logic was added. Users in standard pagination mode have no way to navigate between pages. Either restore the pagination UI or remove this sync logic if standard pagination is no longer needed.</violation>
</file>

<file name="components/admin/collections/assign-items-modal.tsx">

<violation number="1" location="components/admin/collections/assign-items-modal.tsx:40">
P2: The `page` and `search` dependencies are redundant here. React Query already re-fetches automatically when these values change (they&#39;re part of the query key in `useAdminItems`). This causes double API calls on every page change or search update. Consider removing these dependencies to only refetch when the modal opens.</violation>
</file>

<file name="app/api/sponsor-ads/route.ts">

<violation number="1" location="app/api/sponsor-ads/route.ts:54">
P2: Missing validation for `limit` parameter. `parseInt` can return `NaN` for non-numeric strings, and negative values aren&#39;t handled. This could cause unexpected behavior in the database query.</violation>
</file>

<file name="components/collections/collection-detail.tsx">

<violation number="1" location="components/collections/collection-detail.tsx:227">
P2: Hardcoded English strings should use the translation system for consistency. Consider adding translation keys like `t(&quot;common.SHOWING_ITEMS&quot;, { count: totalCount })` and `t(&quot;common.SHOWING_FILTERED_ITEMS&quot;, { filtered: filteredCount, total: totalCount })`.</violation>

<violation number="2" location="components/collections/collection-detail.tsx:390">
P2: Hardcoded English strings should use the translation system for i18n consistency. The component already has access to `t` from `useTranslations()` - use it here as well.</violation>
</file>

<file name="app/api/payment/[subscriptionId]/route.ts">

<violation number="1" location="app/api/payment/[subscriptionId]/route.ts:21">
P2: Invalid JSON from the client will result in a 500 error instead of 400 Bad Request. Consider wrapping `request.json()` in a try/catch to return a proper 400 status for malformed requests.</violation>
</file>

<file name="app/api/sponsor-ads/user/route.ts">

<violation number="1" location="app/api/sponsor-ads/user/route.ts:199">
P2: Potential information disclosure: Internal error messages are exposed to clients. For 500 errors, use a generic message like `&quot;Failed to create sponsor ad&quot;` instead of the raw `error.message`, which could leak internal details (database errors, paths, etc.). The specific &quot;already have&quot; check for 400 responses is fine to keep.</violation>
</file>

<file name="app/[locale]/categories/listing-categories.tsx">

<violation number="1" location="app/[locale]/categories/listing-categories.tsx:21">
P2: Interface declares `items` as required but it&#39;s never used after this refactoring. Consider removing unused props (`total`, `start`, `tags`, `items`) from the interface and their type imports to reduce caller burden and improve maintainability.</violation>
</file>

<file name="app/api/user/plan-status/route.ts">

<violation number="1" location="app/api/user/plan-status/route.ts:111">
P2: Exposing internal error messages to clients can leak implementation details (database schema, third-party service info, etc.). Follow the project&#39;s established pattern of returning a generic error message. Use Sentry (already installed) for detailed error tracking instead.</violation>
</file>

<file name="app/api/polar/webhook/handlers.ts">

<violation number="1" location="app/api/polar/webhook/handlers.ts:511">
P1: Errors in sponsor ad handlers are silently swallowed instead of being re-thrown. Unlike email notifications (which are non-critical), sponsor ad operations are critical business functions. If `confirmPayment`, `cancelSponsorAd`, or `renewSponsorAd` fails, the webhook will still return success, preventing automatic retries and potentially leaving the system in an inconsistent state (e.g., payment received but ad not activated).</violation>
</file>

<file name="app/api/admin/sponsor-ads/[id]/route.ts">

<violation number="1" location="app/api/admin/sponsor-ads/[id]/route.ts:38">
P2: Exposing raw error messages to API clients could leak sensitive internal details (database errors, table names, connection info). For the 500 case, use a generic error message like the pattern in other API routes, while keeping the specific check for the known &quot;Sponsor ad not found&quot; error.</violation>
</file>

<file name="app/api/admin/sponsor-ads/route.ts">

<violation number="1" location="app/api/admin/sponsor-ads/route.ts:32">
P2: Swagger documentation lists &quot;approved&quot; as valid status but code validates against &quot;pending_payment&quot; instead. Update the enum to match the actual valid values to avoid confusing API consumers.</violation>
</file>

<file name="app/[locale]/admin/sponsorships/page.tsx">

<violation number="1" location="app/[locale]/admin/sponsorships/page.tsx:98">
P2: Missing success check before closing modal. Unlike `handleRejectConfirm`, this handler closes the modal and resets state regardless of whether the operation succeeded. If `approveSponsorAd` fails, the user won&#39;t know the operation didn&#39;t complete.</violation>
</file>

<file name="app/[locale]/tags/tags-grid-client.tsx">

<violation number="1" location="app/[locale]/tags/tags-grid-client.tsx:196">
P1: Critical classes appear to have been accidentally removed from the footer. The `bg-gradient-to-t` class requires color stops (`from-*`, `via-*`, `to-*`) to render anything, and `bottom-0` needs `sticky` positioning to have any effect. This breaks the sticky pagination footer&#39;s appearance and behavior.</violation>
</file>

<file name="components/billing/expired-plan-banner.tsx">

<violation number="1" location="components/billing/expired-plan-banner.tsx:240">
P2: The `aria-label=&quot;Dismiss&quot;` should be translated for i18n consistency. All other user-facing strings in this component use the translation function.</violation>
</file>

<file name="app/api/admin/collections/[id]/route.ts">

<violation number="1" location="app/api/admin/collections/[id]/route.ts:242">
P2: Missing existence check before update. If `collectionRepository.findById(id)` returns `null`, the code proceeds to call `update()` which may fail with an unclear error. Add a 404 check after fetching the collection.</violation>

<violation number="2" location="app/api/admin/collections/[id]/route.ts:325">
P2: Path revalidation uses `id` instead of the collection&#39;s actual slug. Since `id` and `slug` can differ (as evidenced by the PUT handler), you should fetch the collection before deleting to obtain its slug for proper cache invalidation.</violation>
</file>

<file name="app/api/admin/collections/route.ts">

<violation number="1" location="app/api/admin/collections/route.ts:284">
P2: Malformed JSON in request body will return 500 instead of 400. Consider wrapping `request.json()` in a try/catch to return a 400 Bad Request for invalid JSON payloads.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cursor]

This PR is being reviewed by Cursor Bugbot

Details

You are on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle.

To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.