Merge pull request #836 from ayinde38/feat/clips-management-and-seo

feat: bulk clip delete/archive, dynamic OG images, robots/sitemap coverage, dependabot policy

Author: Emmzyemms

.changeset/795-796-797-799-clips-management-and-seo.md

@@ -0,0 +1,11 @@
+---
+"clipsproject": minor
+---
+
+Add bulk delete and archive for clips, dynamic Open Graph images, verified robots/sitemap coverage, and a split Dependabot policy.
+
+- `DELETE /api/clips` soft-deletes clips (`deletedAt`) and `PATCH /api/clips/archive` archives them (`archivedAt`); both are exposed from `SelectionFooter`, with deletion gated behind a confirmation.
+- Projects page gains an "Archived" filter tab.
+- `/api/og` generates 1200×630 Open Graph images; the share page emits dynamic OG/Twitter tags built from the clip's title, score, and thumbnail.
+- `robots.ts` now disallows every `(dashboard)` route including `/billing`, `/analytics`, and `/referral`; `sitemap.ts` covers the public share section.
+- Dependabot splits patch (weekly, auto-approved) from minor (monthly, manual), grouped by `@stellar/*`, `@sentry/*`, `@storybook/*`, and `@testing-library/*`; CI verifies the lockfile with `npm ci --dry-run`.

.github/dependabot.yml

@@ -1,10 +1,107 @@
 version: 2
 updates:
+  # Patch updates: weekly, grouped, low-risk enough to auto-approve.
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
       interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "patch"
+    commit-message:
+      prefix: "chore(deps)"
     groups:
-      dependencies:
+      stellar-patch:
+        patterns:
+          - "@stellar/*"
+          - "stellar-sdk"
+        update-types:
+          - "patch"
+      sentry-patch:
+        patterns:
+          - "@sentry/*"
+        update-types:
+          - "patch"
+      storybook-patch:
+        patterns:
+          - "@storybook/*"
+          - "storybook"
+        update-types:
+          - "patch"
+      testing-patch:
+        patterns:
+          - "@testing-library/*"
+        update-types:
+          - "patch"
+      all-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "patch"
+    ignore:
+      # Minor and major land on the monthly schedule below, so this weekly
+      # run stays patch-only.
+      - dependency-name: "*"
+        update-types:
+          - "version-update:semver-minor"
+          - "version-update:semver-major"
+
+  # Minor updates: monthly, grouped, always reviewed by a human.
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "minor"
+      - "needs-review"
+    commit-message:
+      prefix: "chore(deps)"
+    groups:
+      stellar-minor:
+        patterns:
+          - "@stellar/*"
+          - "stellar-sdk"
+        update-types:
+          - "minor"
+      sentry-minor:
+        patterns:
+          - "@sentry/*"
+        update-types:
+          - "minor"
+      storybook-minor:
+        patterns:
+          - "@storybook/*"
+          - "storybook"
+        update-types:
+          - "minor"
+      testing-minor:
+        patterns:
+          - "@testing-library/*"
+        update-types:
+          - "minor"
+      all-minor:
         patterns:
           - "*"
+        update-types:
+          - "minor"
+    ignore:
+      # Majors stay manual — Next and React majors carry breaking changes this
+      # app has to migrate deliberately.
+      - dependency-name: "*"
+        update-types:
+          - "version-update:semver-patch"
+          - "version-update:semver-major"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    labels:
+      - "dependencies"
+      - "github-actions"
+    commit-message:
+      prefix: "ci(deps)"

.github/workflows/ci.yml

@@ -42,8 +42,13 @@ jobs:
           node-version: lts/*
           cache: npm
           cache-dependency-path: package-lock.json
+      # `npm ci --dry-run` fails when package.json and package-lock.json have
+      # drifted, catching a dependency bump that never updated the lockfile.
+      - name: Verify package-lock.json is in sync
+        run: npm ci --dry-run
+
       - name: Install dependencies
-        run: npm install
+        run: npm ci
       - name: Unit tests
         run: echo "E2E PR — unit coverage validated on sibling PRs."
       - name: Check for changeset

.github/workflows/dependabot-auto-approve.yml

@@ -0,0 +1,40 @@
+name: Dependabot Auto-Approve
+
+# Auto-approves patch-level Dependabot PRs. Minor and major updates are left
+# for manual review, matching the split in .github/dependabot.yml.
+#
+# `pull_request_target` is required so the token has write access on PRs from
+# Dependabot's fork. It is safe here only because this workflow never checks
+# out or executes PR code — it just reads metadata and approves.
+on: pull_request_target
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  auto-approve:
+    runs-on: ubuntu-latest
+    if: github.actor == 'dependabot[bot]'
+    steps:
+      - name: Fetch Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@v2
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Approve patch updates
+        if: steps.metadata.outputs.update-type == 'version-update:semver-patch'
+        run: gh pr review --approve "$PR_URL" --body "Auto-approved: patch-level dependency update."
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Flag minor and major updates for review
+        if: steps.metadata.outputs.update-type != 'version-update:semver-patch'
+        run: |
+          gh pr comment "$PR_URL" --body \
+            "This is a **${{ steps.metadata.outputs.update-type }}** update and needs manual review before merging."
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.husky/pre-commit

@@ -8,7 +8,11 @@ npx lint-staged
 # shallow clone) rather than failing the commit.
 BASE_BRANCH="${CHANGESET_BASE_BRANCH:-main}"
 if git rev-parse --verify "origin/$BASE_BRANCH" >/dev/null 2>&1; then
-  CHANGESET_COUNT=$(git diff --name-only "origin/$BASE_BRANCH"...HEAD 2>/dev/null | grep -c '^\.changeset/.*\.md$')
+  # `grep -c` exits 1 when it counts zero matches, which aborts this hook under
+  # husky's `set -e` — the exact case this reminder exists for. Fall back to 0
+  # so the block stays advisory, as documented above.
+  CHANGESET_COUNT=$(git diff --name-only "origin/$BASE_BRANCH"...HEAD 2>/dev/null | grep -c '^\.changeset/.*\.md$' || true)
+  CHANGESET_COUNT=${CHANGESET_COUNT:-0}
   if [ "$CHANGESET_COUNT" -eq 0 ]; then
     echo ""
     echo "No changeset found for this branch yet."

app/(dashboard)/projects/page.tsx

@@ -65,6 +65,10 @@ export default function ProjectsPage() {
   const [loadingNextPage, setLoadingNextPage] = useState(false);
   const [isPosting, setIsPosting] = useState(false);
   const [postError, setPostError] = useState<string | null>(null);
+  const [isDeleting, setIsDeleting] = useState(false);
+  const [deleteError, setDeleteError] = useState<string | null>(null);
+  const [isArchiving, setIsArchiving] = useState(false);
+  const [archiveError, setArchiveError] = useState<string | null>(null);
 
   const [mobileFiltersOpen, setMobileFiltersOpen] = useState(false);
   const [aiRecommendations, setAiRecommendations] = useState(false);
@@ -254,7 +258,7 @@ export default function ProjectsPage() {
       if (!res.ok) throw new Error(data.error || "Posting failed");
       if (Array.isArray(data.failed) && data.failed.length > 0) {
         setPostError(`${data.failed.length} post${data.failed.length > 1 ? "s" : ""} failed`);
-        data.failed.forEach((f: any) => console.warn(f));
+        data.failed.forEach((f: unknown) => console.warn(f));
       }
       if (Array.isArray(data.posted) && data.posted.length > 0) {
         showToast(`Posted ${data.posted.length} clip${data.posted.length > 1 ? "s" : ""} successfully`, "success");
@@ -268,6 +272,58 @@ export default function ProjectsPage() {
     }
   }, [showToast]);
 
+  const handleDelete = useCallback(async (clipIds: string[]) => {
+    setIsDeleting(true);
+    setDeleteError(null);
+    try {
+      const res = await fetch("/api/clips", {
+        method: "DELETE",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ clipIds }),
+      });
+      const data = await res.json();
+      if (!res.ok) throw new Error(data.error || "Delete failed");
+
+      const count = data?.data?.deletedCount ?? clipIds.length;
+      showToast(`Deleted ${count} clip${count !== 1 ? "s" : ""}`, "success");
+      setSelectedIds([]);
+      // Deleted clips are filtered out server-side, so refetch rather than
+      // trying to reconcile the list locally.
+      await fetchClips(1);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : "Delete failed";
+      setDeleteError(msg);
+      showToast(msg, "error");
+    } finally {
+      setIsDeleting(false);
+    }
+  }, [fetchClips, setSelectedIds, showToast]);
+
+  const handleArchive = useCallback(async (clipIds: string[]) => {
+    setIsArchiving(true);
+    setArchiveError(null);
+    try {
+      const res = await fetch("/api/clips/archive", {
+        method: "PATCH",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ clipIds }),
+      });
+      const data = await res.json();
+      if (!res.ok) throw new Error(data.error || "Archive failed");
+
+      const count = data?.data?.archivedCount ?? clipIds.length;
+      showToast(`Archived ${count} clip${count !== 1 ? "s" : ""}`, "success");
+      setSelectedIds([]);
+      await fetchClips(1);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : "Archive failed";
+      setArchiveError(msg);
+      showToast(msg, "error");
+    } finally {
+      setIsArchiving(false);
+    }
+  }, [fetchClips, setSelectedIds, showToast]);
+
   return (
     <>
       {/* Mobile Filter Drawer Overlay */}
@@ -357,6 +413,12 @@ export default function ProjectsPage() {
               onPost={handlePost}
               isPosting={isPosting}
               postError={postError}
+              onDelete={handleDelete}
+              isDeleting={isDeleting}
+              deleteError={deleteError}
+              onArchive={handleArchive}
+              isArchiving={isArchiving}
+              archiveError={archiveError}
             />
           </div>
         </div>

app/api/clips/archive/route.ts

@@ -0,0 +1,101 @@
+import { NextRequest, NextResponse } from "next/server";
+import { auth } from "@/app/lib/auth";
+import { clipsStore } from "../clipsStore";
+import type { ApiResponse } from "../../types";
+import { bulkClipIdsBodySchema } from "../../schemas/index";
+
+/** Shared auth + validation + ownership path for both handlers below. */
+async function resolveRequest(request: NextRequest): Promise<
+  | { ok: true; userId: string; clipIds: string[] }
+  | { ok: false; response: NextResponse }
+> {
+  const session = await auth();
+  if (!session?.user?.id) {
+    return {
+      ok: false,
+      response: NextResponse.json({ error: "Unauthorized" }, { status: 401 }),
+    };
+  }
+
+  let payload: unknown;
+  try {
+    payload = await request.json();
+  } catch {
+    return {
+      ok: false,
+      response: NextResponse.json({ error: "Invalid JSON body" }, { status: 400 }),
+    };
+  }
+
+  const parsed = bulkClipIdsBodySchema.safeParse(payload);
+  if (!parsed.success) {
+    return {
+      ok: false,
+      response: NextResponse.json(
+        { error: "Validation failed", issues: parsed.error.issues },
+        { status: 400 },
+      ),
+    };
+  }
+
+  // Seed the user's clips so ownership resolves on a first-time request.
+  clipsStore.getClipsForUser(session.user.id);
+
+  const unowned = clipsStore.findUnownedClipIds(
+    session.user.id,
+    parsed.data.clipIds,
+  );
+  if (unowned.length > 0) {
+    return {
+      ok: false,
+      response: NextResponse.json(
+        { error: "One or more clips do not belong to you" },
+        { status: 403 },
+      ),
+    };
+  }
+
+  return { ok: true, userId: session.user.id, clipIds: parsed.data.clipIds };
+}
+
+/**
+ * PATCH /api/clips/archive
+ * Body: { clipIds: string[] }
+ *
+ * Stamps `archivedAt`, moving clips out of the default library and into the
+ * Archived tab. Non-destructive — DELETE /api/clips is the delete path.
+ */
+export async function PATCH(request: NextRequest) {
+  const resolved = await resolveRequest(request);
+  if (!resolved.ok) return resolved.response;
+
+  const archivedCount = clipsStore.archiveClips(resolved.userId, resolved.clipIds);
+
+  const body: ApiResponse<{ success: boolean; archivedCount: number }> = {
+    data: { success: true, archivedCount },
+    error: null,
+  };
+
+  return NextResponse.json(body);
+}
+
+/**
+ * DELETE /api/clips/archive
+ * Body: { clipIds: string[] }
+ *
+ * Unarchives — clears `archivedAt` and returns clips to the main library.
+ * This does not delete anything.
+ */
+export async function DELETE(request: NextRequest) {
+  const resolved = await resolveRequest(request);
+  if (!resolved.ok) return resolved.response;
+
+  const restoredCount = clipsStore.unarchiveClips(resolved.userId, resolved.clipIds);
+
+  const body: ApiResponse<{ success: boolean; restoredCount: number }> = {
+    data: { success: true, restoredCount },
+    error: null,
+  };
+
+  return NextResponse.json(body);
+}