fix: account delete N+1, env webhook secret refine, empty reorder broadcast, members dialog double-submit + email validation

- account.delete: collapse the N+1 `COUNT(*) per room` loop into a single
  GROUP BY query with FILTER. Max plan owns up to 50 rooms; this turns 51
  round-trips into 1.
- lib/env: add refine that requires STRIPE_WEBHOOK_SECRET when STRIPE_SECRET_KEY
  is set in production. Without it the webhook returns 503 on every event and
  subscription state never reaches the DB — currently a silent misconfiguration.
- tabs.routes reorder: replace `serialized[0]?.roomId ?? ""` fallback with
  an explicit `if (firstRoomId)` guard. Passing "" to broadcastTabsReordered
  opens a stray Hocuspocus document named "room:" via openDirectConnection.
- members-dialog AddEmailInput: client-side email regex check + submitting
  state + disabled input/button. Previously rapid Enter or button mashing
  sent N parallel POSTs; an obvious typo (no @, no .) round-tripped to the
  server before the user got feedback.

Code review pass 6.

Author: justincordova

apps/server/src/account/routes.ts

@@ -49,25 +49,29 @@ export const accountRoutes: FastifyPluginAsync = async (app) => {
     // biome-ignore lint/style/noNonNullAssertion: auth plugin guarantees req.user is set for /api/ routes
     const userId = req.user!.id;
 
-    const ownedRooms = await db.query.rooms.findMany({
-      where: and(eq(rooms.ownerId, userId), isNull(rooms.deletedAt)),
-      columns: { id: true, slug: true, name: true },
-    });
+    // Single query: identify which owned rooms have other members (blocking)
+    // vs. solo (safe to soft-delete). Previous version ran one COUNT(*) per
+    // owned room — N+1 against the user's owned-room list. Max plan owns up
+    // to 50 rooms, so this collapses 51 round-trips to 1.
+    const roomsWithOtherCounts = await db
+      .select({
+        id: rooms.id,
+        slug: rooms.slug,
+        name: rooms.name,
+        otherCount: sql<number>`count(${roomMembers.userId}) filter (where ${roomMembers.userId} != ${userId})::int`,
+      })
+      .from(rooms)
+      .leftJoin(roomMembers, eq(roomMembers.roomId, rooms.id))
+      .where(and(eq(rooms.ownerId, userId), isNull(rooms.deletedAt)))
+      .groupBy(rooms.id, rooms.slug, rooms.name);
 
-    // Identify which owned rooms have other members (blocking) vs. solo
-    // (safe to soft-delete).
     const blockingRooms: Array<{ slug: string; name: string | null }> = [];
     const soloRooms: Array<{ id: string; slug: string }> = [];
-    for (const room of ownedRooms) {
-      const otherMemberCount = await db
-        .select({ count: sql<number>`count(*)::int` })
-        .from(roomMembers)
-        .where(and(eq(roomMembers.roomId, room.id), sql`${roomMembers.userId} != ${userId}`));
-      const others = otherMemberCount[0]?.count ?? 0;
-      if (others > 0) {
-        blockingRooms.push({ slug: room.slug, name: room.name });
+    for (const r of roomsWithOtherCounts) {
+      if (r.otherCount > 0) {
+        blockingRooms.push({ slug: r.slug, name: r.name });
       } else {
-        soloRooms.push({ id: room.id, slug: room.slug });
+        soloRooms.push({ id: r.id, slug: r.slug });
       }
     }
 

apps/server/src/lib/env.ts

@@ -40,6 +40,11 @@ const envSchema = z
     message:
       "SUPABASE_SERVICE_ROLE_KEY is required in production (whitelist invitee notifications, kick auto-blacklist, member email lookups all silently no-op without it)",
     path: ["SUPABASE_SERVICE_ROLE_KEY"],
+  })
+  .refine((d) => d.NODE_ENV !== "production" || !d.STRIPE_SECRET_KEY || d.STRIPE_WEBHOOK_SECRET, {
+    message:
+      "STRIPE_WEBHOOK_SECRET is required in production when STRIPE_SECRET_KEY is set — webhook signature verification fails closed and the billing webhook returns 503 without it, so subscription updates never reach the database",
+    path: ["STRIPE_WEBHOOK_SECRET"],
   });
 
 const parsed = envSchema.safeParse(process.env);

apps/server/src/rooms/tabs.routes.ts

@@ -66,8 +66,13 @@ export const tabsRoutes: FastifyPluginAsync = async (app) => {
         req.body.tabIds,
       );
       const serialized = reordered.map(serializeTab);
-      if (serialized.length > 0) {
-        void broadcastTabsReordered(app.hocuspocus, serialized[0]?.roomId ?? "", serialized);
+      // Guard explicitly: passing `""` to broadcastTabsReordered would open
+      // a Hocuspocus direct connection named `room:` which fails UUID
+      // validation in onAuthenticate but bypasses auth via openDirectConnection
+      // — it'd silently create a stray document.
+      const firstRoomId = serialized[0]?.roomId;
+      if (firstRoomId) {
+        void broadcastTabsReordered(app.hocuspocus, firstRoomId, serialized);
       }
       return { tabs: serialized };
     },

apps/web/src/components/rooms/members-dialog.tsx

@@ -410,21 +410,36 @@ export function MembersDialog({
   );
 }
 
+// Permissive client-side email shape check — defense against an obvious typo
+// before paying for a round-trip. The server is the source of truth.
+const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+
 function AddEmailInput({
   placeholder,
   onSubmit,
 }: {
   placeholder: string;
-  onSubmit: (email: string) => void;
+  onSubmit: (email: string) => void | Promise<void>;
 }) {
   const [value, setValue] = useState("");
+  const [submitting, setSubmitting] = useState(false);
 
-  function handleSubmit(e: React.FormEvent) {
+  async function handleSubmit(e: React.FormEvent) {
     e.preventDefault();
+    if (submitting) return;
     const trimmed = value.trim();
     if (!trimmed) return;
-    onSubmit(trimmed.toLowerCase());
-    setValue("");
+    if (!EMAIL_RE.test(trimmed)) {
+      toast.error("Please enter a valid email address");
+      return;
+    }
+    setSubmitting(true);
+    try {
+      await onSubmit(trimmed.toLowerCase());
+      setValue("");
+    } finally {
+      setSubmitting(false);
+    }
   }
 
   return (
@@ -435,12 +450,14 @@ function AddEmailInput({
           value={value}
           onChange={(e) => setValue(e.target.value)}
           placeholder={placeholder}
-          className="flex-1 rounded-md border border-border bg-background px-3 py-1.5 text-sm outline-none focus:ring-2 focus:ring-ring/30"
+          disabled={submitting}
+          className="flex-1 rounded-md border border-border bg-background px-3 py-1.5 text-sm outline-none focus:ring-2 focus:ring-ring/30 disabled:opacity-50"
         />
         <button
           type="submit"
           aria-label="Add email"
-          className="grid h-8 w-8 place-items-center rounded-md bg-foreground text-background hover:bg-foreground/90 transition-colors shrink-0"
+          disabled={submitting}
+          className="grid h-8 w-8 place-items-center rounded-md bg-foreground text-background hover:bg-foreground/90 transition-colors shrink-0 disabled:opacity-50"
         >
           <Plus className="h-4 w-4" />
         </button>