fix: drop dead guild-guard entry for nonexistent features route

[LucasSantana-Dev]

Summary

• `/api/guilds/:id/features` had a guard registered in `guildGuardConfigs` but no matching route handler anywhere — the real feature-toggle endpoint is the global `/api/features`, not per-guild.
• Harmless at runtime (an app.use() guard on a path nothing registers just never fires), but paired with a stale `WEBAPP_SETUP.md` documenting per-server toggle endpoints that don't exist.
• Found during a security review of the guild-authorization guard table (verified every other guild-scoped route file is genuinely covered by `guildGuardConfigs`; this was the one orphan).

Changes

• Remove the dead entry from `guildGuardConfigs` (routes/index.ts)
• Correct `docs/WEBAPP_SETUP.md` to describe the actual (global-only) feature toggle API
• Drop the two test assertions in `index.test.ts` that were locking in the orphaned guard registration

Test plan

• `npm run type:check --workspace=packages/backend`
• `npm run lint --workspace=packages/backend` (0 errors, pre-existing unrelated warnings only)
• `npm run test --workspace=packages/backend -- --ci` — 85/85 suites, 1352/1352 tests passing

Fixes #2029

---

Summary by cubic

Removes the orphaned guild guard for /api/guilds/:id/features and updates docs to reflect the actual global feature-toggle API. Old behavior: guard registered for a route that doesn’t exist. New behavior: guard removed, docs corrected; no runtime behavior change.

• Drops the dead entry from guildGuardConfigs in packages/backend/src/routes/index.ts.
• Updates docs/WEBAPP_SETUP.md to remove per-guild toggles and document /api/toggles/global and /api/features (authenticated, read-only).
• Removes two test assertions in packages/backend/tests/unit/routes/index.test.ts that locked in the orphaned guard.
• Confirms other guild-scoped routes remain guarded; no authorization coverage regression.
• Satisfies Linear Dead guildGuardConfigs entry for /api/guilds/:id/features (no matching route) #2029. No migrations; clients already use the global endpoints.

^{Written for commit da10c11. Summary will update on new commits.}

[coderabbitai]

Warning

Review limit reached

@LucasSantana-Dev, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 58 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 5b28cc96-e496-4067-87f7-d66954186038

📥 Commits

Reviewing files that changed from the base of the PR and between eb21a33 and da10c11.

📒 Files selected for processing (3)

• docs/WEBAPP_SETUP.md
• packages/backend/src/routes/index.ts
• packages/backend/tests/unit/routes/index.test.ts

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/2029-orphaned-guild-features-guard

Warning

Billing warning: we have not been able to collect payment for this subscription for more than 72 hours. Please update the payment method or pay any pending invoices in Billing to avoid service interruption.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Failed to generate code suggestions for PR

[github-actions]

	Warnings
⚠️	User-facing change without a CHANGELOG.md update. Add a line under ## [Unreleased] if this should appear in release notes. (Or apply the skip-changelog label if this PR does not affect end users.)
⚠️	This PR appears to remove a feature or route (detected in commit message). Please fill in the Feature-removal sweep checklist in the PR template to ensure no orphan code (models, tests, types, imports) is left behind. See decisions/ for context.

Generated by 🚫 dangerJS against da10c11

[graphify-labs]

Graphify reviewed this change.

Worth a look — the grounded gate found no coupling regressions or blocking issues, but 1 advisory finding(s) below merit a look before merge.

---

Graphify review — findings

This PR removes the per-guild feature toggle route (/api/guilds/:id/features) and its associated RBAC guard registration from the backend routes setup. The corresponding unit test assertions for that route's guard are also removed, and the docs are updated to reflect that only global/authenticated read-only feature listings exist (/api/toggles/global, /api/features) with no per-server feature-toggle API. The changes span backend routing config, its unit tests, and the WEBAPP_SETUP documentation. The touched surface is the feature-toggle section of the API.

Worth a look

• Per-guild features endpoint loses auth/module guard — packages/backend/src/routes/index.ts:64 · Escalate · high
  • agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review Execution auto-disposal is off for this run; enable it (with sandbox isolation) to have Graphify try to confirm or refute this automatically.

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 81 functions depend on the 77 functions this change touches.

Health — this change adds coupling hotspots:

• new: setupRoutes() — 3 callers, 13 callees
• new: bootstrapBackend() — 2 callers, 8 callees

Verification — 81 functions in the blast radius were not formally verified this run (proofs are advisory here).

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

• verification_scope: 79 function(s) in the blast radius were not formally verified this run

· 2 more finding(s) on lines outside this diff (see the check run).

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud