API sweep + cron pass: billing keys, Stripe webhook, AI not-configured, child savings, unsent email reported sent

[NewWorldVenture]

What this is

This covers Register B's API rows, which nobody had claimed.

scripts/api-audit finds every method of every app/api/**/route.ts on disk: 155 route methods in 147 files. It calls each one against a local production build and a local Supabase with all migrations through 0458, as four callers:

• signed out
• a child member
• a non-admin parent
• a super-admin parent

Each call sends the input a careless or hostile client would: no body, {}, and a body that isn't JSON. That is 1,008 calls in total. The summariser sorts each response into FAIL, BLOCKED (an honest 503 saying "not set up"), REVIEW or OK.

• First sweep: 24 FAIL.
• After these fixes: 0 FAIL, 30 BLOCKED (no AI, Stripe, push, GIF or Twilio keys in this build), 11 REVIEW (all read; each is public by design or deliberately reads an optional body as empty) and 114 OK.
• No admin route answered a child or a non-admin parent, no cron route ran without its secret, and no response leaked internal detail.

Fixes (each has a test that fails against the old code)

ID	Sev	What was wrong	Fix
API-SWEEP-01	Med	With no Google credentials, "Connect Google" on the calendar threw and showed a blank 500.	Returns the parent to /dashboard/calendar?gcal=not_configured with a translated toast.
API-SWEEP-02	High	Super Admin → Stripe Setup saves the secret key, but only checkout used it. Portal, cancel and change-plan read STRIPE_SECRET_KEY only. With no key anywhere, all four answered 500, and checkout built its Stripe client before reading the body.	All four resolve the key the same way: Setup first, then the environment variable. With no key they return 503 "billing isn't set up". Checkout now reads the body first.
API-SWEEP-03	High	The Stripe webhook read STRIPE_WEBHOOK_SECRET only and called getStripe() just to verify the signature. With the keys held only in Stripe Setup, every real event was refused as "signature invalid".	Uses the Setup secret first, then the environment variable, and Stripe's keyless static verifier. Tested with real signatures.
API-SWEEP-04	Med	With no AI key, 13 AI routes returned 500 or 502 "temporarily unavailable". health/coach checked only the environment, so it missed a key saved in Admin → AI Engine.	Each route calls isAIConfigured() before the provider. A guard test enforces this for every provider caller except three deliberate fallbacks.
API-SWEEP-05	High	/api/ai/savings answered a child with advice built from the family's transactions, budgets, bills and subscriptions.	403 for anyone who isn't a manager, before any read. This matches the finance service and the privacy export.

Recorded as open, not fixed here (API-SWEEP-06, High):

• At the database level, transactions, budgets, bills and subscriptions_tracked are readable by any family member, children included, and subscriptions_tracked is writable by any member.
• The app treats finances as adults-only in three places.
• Many readers (home, wallet hub, voting, briefing) depend on these tables, so tightening this needs an owner decision and a migration.

finalaudit.md

• 142 API rows move from NOT STARTED to 🔄 IN PROGRESS, not PASS. Each row records the sweep's per-caller statuses, its verdict and any fix. What remains is a valid request, its side effects and the response shape.
• The 11 rows already in progress keep their text, with the sweep result appended.
• Two routes had no row, and I added them.
• Register B now reads: 14,228 items, 13,688 NOT STARTED, 525 IN PROGRESS.
• PRODUCTION READY: NO.

Checks

• tsc clean and lint clean on the changed files; the i18n gate is clean.
• Full unit suite: 21,484 pass. The only failures are the two Node-24-only tests (node-version-is-pinned, stream-cancellation-runtime); this container runs Node 22.
• Re-sweeping the fixed build gives 0 FAIL.

🤖 Generated with Claude Code

https://claude.ai/code/session_01776xJyhVe8xJQvTGeNfT9T

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
bubaly	Ignored		Sep 27, 2026 11:09pm UTC

[NewWorldVenture]

I pushed a merge of main (877d9a5e: #620, #622) into this branch as 558ff300. My #622 had edited the same finalaudit.md header, which is why this PR showed a conflict. It is a merge commit, so no history was rewritten, and nothing outside finalaudit.md needed resolving.

How the conflict was resolved:

• Top entries: both are kept, the MAIN reconciliation first and then your API sweep.
• Session B header: recounted from the merged rows: 14,229 = 13,663 NOT STARTED + 535 IN PROGRESS + 21 FIXED + PASS + 9 BLOCKED + 1 FAIL, and completion is 0.15%. The 16 rows that finalaudit: the audit branch's MAIN verdicts, re-verified on main (110 rows) #622 moved out of IN PROGRESS account for your 551 becoming 535.
• Other header text: your "Last Updated" and "Total Audit Items" text is kept, with finalaudit: the audit branch's MAIN verdicts, re-verified on main (110 rows) #622's additions appended.

Checks on the merged tree:

• tsc is clean.
• The 14 finalaudit test files pass (768 tests).
• The 17 test files this PR and Page audit B12 re-crawl, a malformed id is not-found (P-23), and a pause during a concierge apply stands (CONC-002) #620 touch pass (339 tests).
• The finding index was regenerated.

If you push again, please pull first.

---

Generated by Claude Code