fix: enforce ownership and disable caching for AI endpoint

[Rial1608]

• Enforced user ownership validation to prevent unauthorized access
• Added Cache-Control: no-store to all responses to prevent caching of sensitive data
• Standardized error handling (converted 403 to 404 to avoid resource exposure)
• Improved input validation with strict type checks and allowed analysis types
• Added structured logging for better debugging and observability
• Replaced magic numbers with constants for maintainability
• Improved type safety by replacing any with proper interfaces

Summary by CodeRabbit

• Bug Fixes

  • Enforced repository ownership checks to prevent unauthorized analysis access

• Improvements

  • Stronger request validation with clearer, structured failure logging
  • Unified success/error JSON responses with no-store cache headers
  • Improved error/status mapping, including distinct timeout (504) responses
  • Added timeout protection for analysis operations
  • More reliable authentication handling across API requests

• New Features

  • Introduced a dedicated timeout error type for clearer timeout reporting

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@app/api/ai/analyze-repository/route.ts`:
- Around line 2-7: Remove the unresolved Git conflict markers and restore a
single clean import block: import isHttpError and requireAuth from
"`@/lib/api-auth`" (as intended) and retain the existing AnalysisTimeoutError
import from "`@/lib/errors/AnalysisTimeoutError`"; ensure there are no duplicate
or conflicting imports for isHttpError/requireAuth and that the import list in
route.ts references the symbols exactly as shown so the file parses correctly.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: dff1e4f6-338c-4327-b8ae-124505d6f462

📥 Commits

Reviewing files that changed from the base of the PR and between 466316c and 9067815.

📒 Files selected for processing (1)

• app/api/ai/analyze-repository/route.ts

[coderabbitai]

⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Unresolved merge conflict markers will break the build.

The file contains Git conflict markers that prevent parsing. Based on the PR objectives (removing x-resource-owner-id header-based checks from middleware and moving ownership enforcement to route handlers), the @/lib/api-auth import path appears to be the intended resolution.

Proposed fix

 import { NextRequest, NextResponse } from "next/server";
-<<<<<<< HEAD
-import { isHttpError, requireAuth } from "`@/lib/middleware`";
-import { AnalysisTimeoutError } from "`@/lib/errors/AnalysisTimeoutError`";
-=======
 import { isHttpError, requireAuth } from "`@/lib/api-auth`";
->>>>>>> upstream/main
+import { AnalysisTimeoutError } from "`@/lib/errors/AnalysisTimeoutError`";
 import { getGeminiService } from "`@/lib/services/geminiService`";

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	<<<<<<< HEAD
	import { isHttpError, requireAuth } from "@/lib/middleware";
	import { AnalysisTimeoutError } from "@/lib/errors/AnalysisTimeoutError";
	=======
	import { isHttpError, requireAuth } from "@/lib/api-auth";
	>>>>>>> upstream/main
	import { NextRequest, NextResponse } from "next/server";
	import { isHttpError, requireAuth } from "`@/lib/api-auth`";
	import { AnalysisTimeoutError } from "`@/lib/errors/AnalysisTimeoutError`";
	import { getGeminiService } from "`@/lib/services/geminiService`";

🧰 Tools

🪛 Biome (2.4.15)

[error] 2-2: Expected a statement but instead found '<<<<<<< HEAD'.

(parse)

---

[error] 5-5: Expected a statement but instead found '======='.

(parse)

---

[error] 7-7: Expected a statement but instead found '>>>>>>> upstream/main'.

(parse)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@app/api/ai/analyze-repository/route.ts` around lines 2 - 7, Remove the
unresolved Git conflict markers and restore a single clean import block: import
isHttpError and requireAuth from "`@/lib/api-auth`" (as intended) and retain the
existing AnalysisTimeoutError import from "`@/lib/errors/AnalysisTimeoutError`";
ensure there are no duplicate or conflicting imports for isHttpError/requireAuth
and that the import list in route.ts references the symbols exactly as shown so
the file parses correctly.

[Rial1608]

Hi @nisshchayarathi

All requested changes have been addressed and conflicts resolved. The remaining Vercel check appears to require authorization—please let me know if anything is needed from my side.

Looking forward to your feedback.

[tmdeveloper007]

This issue has been fixed in PR #2594: #2594

The fix includes:

• Targeted code changes addressing the root cause
• TypeScript compilation passes
• All CI checks passing

Please review and merge.