Feat/ai sdk migration v2

[boxingknight]

No description provided.

[cursor]

Bug: Race condition when setting role before submit

The code calls setSelectedRole("auto") immediately before handleSubmit, intending to ensure the role is "auto" when submitting. However, React state updates are asynchronous, so selectedRoleRef.current in useAIChat.ts won't be updated until the next render. The transport's prepareSendMessagesRequest reads from selectedRoleRef.current which still holds the old value at the time of submission. This means if a user had previously changed the role, the request could be sent with the wrong role despite the defensive check. The ref is only updated via selectedRoleRef.current = selectedRole during render, not when setSelectedRole is called.

Additional Locations (1)

• chartsmith-app/hooks/useAIChat.ts#L126-L129

 

[cursor]

Bug: Missing workspace authorization allows cross-workspace access

The new message API endpoints authenticate users but don't verify workspace ownership. The PATCH endpoint updates messages using only workspaceId and messageId from the URL, and the GET/POST endpoints access workspace messages without checking if the authenticated user owns or has access to that workspace. Any authenticated user can read, create, or modify messages in any workspace by guessing or knowing the workspace ID.

Additional Locations (2)

• chartsmith-app/app/api/workspace/[workspaceId]/messages/route.ts#L56-L78
• chartsmith-app/app/api/workspace/[workspaceId]/messages/route.ts#L84-L114

 

[cursor]

Bug: Function throws error for valid system message role

The uiMessageToMessage function throws an error for any message role other than 'user' or 'assistant', but the chat API schema (ChatMessageSchema) explicitly accepts 'system' as a valid role. If a system message flows through uiMessageToMessage (such as in the onFinish callback at line 233 of useAIChat.ts), the application will crash with an unhandled error instead of gracefully handling the message.

 

[cursor]

Bug: Incorrect method call - regenerate doesn't exist on useChat

The reload function calls chat.regenerate(), but the AI SDK v5 useChat hook does not have a regenerate method. The correct method is likely reload(). When a user or component calls the exposed reload function from UseAIChatReturn, it will throw a runtime TypeError because chat.regenerate is undefined.

 

[cursor]

Bug: Production fallback to test tokens weakens authentication security

The sessionToken function silently falls back to test token format (test-token-{sessionId}-{timestamp}) in production if HMAC_SECRET is missing or JWT generation fails. While sessions are still validated against the database, this exposes internal session IDs directly in tokens and represents a security degradation from cryptographically signed JWTs. A misconfigured production deployment could unknowingly use insecure token formats with only a warning log.