[steebchen]

Summary

• The llmgateway_playground_key httpOnly cookie (set by /api/ensure-playground-key) was not cleared on logout, so the next user on the same browser inherited the previous user's auto-generated playground API key. Extended clearLastUsedProjectCookiesAction to also delete llmgateway_playground_key and its __Host- variant.
• After the cookie cleared, logging back in still didn't re-provision the key: the chat page (playground-shell.tsx) was the only playground route that defaulted selectedOrganization to null when no orgId was in the URL, so the ensure-playground-key effect short-circuited. Aligned with the other pages (image/video/canvas/group) which default to organizations[0].
• Refactored the duplicated "llmgateway_playground_key" / "__Host-llmgateway_playground_key" string literals across 7 playground API routes to import a single PLAYGROUND_KEY_COOKIE_NAME constant from @/lib/constants.

Test plan

• Log in, open playground, confirm llmgateway_playground_key cookie is set.
• Log out and confirm the cookie is deleted from the browser.
• Log in as a different user and confirm a fresh playground key is provisioned automatically (no manual org selection needed).
• Verify chat/image/video/canvas routes still authenticate against the gateway using the cookie.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Playground now defaults to the first available organization when a requested organization is missing, preventing an unselected state and ensuring downstream features render reliably.
  • Clearing or switching the last-used project now also removes additional playground API-key cookies, improving session cleanup and reducing leftover credentials.
  • Playground API endpoints now read and set the playground key using a single consistent cookie name, improving authentication reliability across features.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: f1292f08-62ca-4d99-80ab-9857e0f1552b

📥 Commits

Reviewing files that changed from the base of the PR and between ca5cb39 and 69c2bf1.

📒 Files selected for processing (7)

• apps/playground/src/app/api/canvas/generate/route.ts
• apps/playground/src/app/api/chat/route.ts
• apps/playground/src/app/api/ensure-playground-key/route.ts
• apps/playground/src/app/api/image/route.ts
• apps/playground/src/app/api/video/[videoId]/content/route.ts
• apps/playground/src/app/api/video/[videoId]/route.ts
• apps/playground/src/app/api/video/route.ts

---

Walkthrough

Organization selection in the playground shell now defaults to the first organization when orgId is missing or unresolved. Playground API-key cookie names are centralized in constants; routes now use those constants and logout clears both last-used-project cookies and the explicit playground API-key cookies.

Changes

Playground Authentication and Cookie Management

Layer / File(s)	Summary
Organization selection fallback apps/playground/src/app/playground-shell.tsx	selectedOrganization now defaults to organizations[0] when orgId is missing or unmatched instead of null.
Playground cookie name constants apps/playground/src/lib/constants.ts	Adds PLAYGROUND_KEY_COOKIE_NAME and PLAYGROUND_KEY_COOKIE_NAMES (including a __Host- variant).
Comprehensive logout cookie cleanup apps/playground/src/lib/actions/project.ts	clearLastUsedProjectCookiesAction now deletes cookies matching the last-used-project prefix and explicitly deletes each name listed in PLAYGROUND_KEY_COOKIE_NAMES.
API routes use centralized cookie name apps/playground/src/app/api/*	Multiple API routes (canvas/generate, chat, ensure-playground-key, image, video/*) import PLAYGROUND_KEY_COOKIE_NAME and read/set the playground API key using that constant and its __Host- prefixed variant instead of hard-coded cookie names.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• theopenco/llmgateway#2313: Related to playground API-key cookie usage when resolving finalApiKey for canvas generation.

Suggested reviewers

• smakosh

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 20.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The PR title accurately describes the main fix: clearing the auto-generated playground API key cookie on logout, which is the primary objective and key change across all modified files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch clear-playground-key-on-logout

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

Fixes a logout security gap in the Playground by ensuring the auto-generated playground API key cookie is cleared so subsequent users on the same browser don’t inherit a previous user’s key.

Changes:

• Adds a list of playground key cookie names (llmgateway_playground_key and __Host- variant) to be deleted on logout.
• Extends the existing logout cookie-clearing server action to also delete those playground key cookies.
• Updates the server action’s doc comment to reflect the expanded behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.