feat(api): call WolfStar bot API via $api (legacy-style)

[RedStar071]

Summary

Legacy-style bot API auth: the browser establishes a real sapphire SAPPHIRE_AUTH cookie via POST ${NUXT_PUBLIC_API_BASE_URL}/oauth/callback (e.g. http://localhost:8282/oauth/callback), matching the old Skyra/dashboard flow.

Auth flow

1. Better Auth completes Discord login (dashboard session)
2. Callback probes the bot API; if no sapphire cookie, silent Discord authorize (prompt=none) returns a fresh code
3. Browser POSTs that code to ${apiBaseUrl}/oauth/callback with credentials: "include" → SAPPHIRE_AUTH on the API origin
4. Client $api calls the bot origin directly with credentials: "include"
5. Sign-out also hits ${apiBaseUrl}/oauth/logout

Structure

• Pure helpers in shared/utils/bot-oauth.ts
• Nuxt-aware fetch helpers in app/utils/bot-oauth.ts (no fake use* composable)
• Removed the /api/** catch-all BFF (only Nuxt auth routes remain)
• SSR still synthesizes a sapphire cookie from the better-auth Discord token when needed

Test plan

• pnpm lint:fix / pnpm typecheck / pnpm test:unit
• Logged-in profile: Network shows localhost:8282/oauth/callback POST then localhost:8282/users/@me → 200 with SAPPHIRE_AUTH cookie
• If local cookies fail, try NUXT_PUBLIC_API_BASE_URL=http://127.0.0.1:8282 + bot domainOverwrite: '127.0.0.1'

  

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

Confidence Score: 4/5

This PR has one contained issue to fix before merging.

The main API migration is coherent, and prior auth-scoped cache issues appear addressed. The remaining issue is a real mutation-cache bug that can skip repeated settings saves.

shared/utils/fetch-cache-config.ts; server/plugins/fetch-cache.ts

T-Rex Logs

What T-Rex did

• Reproduced the mutation cache behavior with a standalone TypeScript harness, showing shouldCacheFetch returns true for the PATCH mutation and that two identical PATCH requests produce the same cache key; the first call misses the cache and hits upstream once, while the second call uses the cached response.
• Reviewed the environment blockers and recovery steps, noting that Playwright could not start from config.webServer, recovery logs show install and Nuxt types generated, Storybook became reachable despite earlier issues, and transform errors related to Tsconfig prevented full UI rendering; blocker evidence includes a screenshot and a video.

_{Ran code and verified through T-Rex}

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
shared/utils/fetch-cache-config.ts:157-163
**Do not cache mutations**
`shouldCacheFetch` allows every method for allowed bot hosts, and `cachedFetch` returns a stored response before calling `$fetch`. The changed `submitChanges` path now sends `PATCH /guilds/:id/settings` through `$api`, so repeating the same settings body within the TTL hits this cache and skips the bot API update entirely while the UI treats it as saved. Restrict caching to safe read methods before checking the domain.

_{Reviews (6): Last reviewed commit: "fix(api): keep botApi crypto helpers ser..." | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.

[codecov]

Codecov Report

❌ Patch coverage is 55.20833% with 43 lines in your changes missing coverage. Please review.
✅ Project coverage is 71.14%. Comparing base (8babfde) to head (7bfbb0d).
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
shared/utils/fetch-cache-config.ts	64.00%	8 Missing and 10 partials ⚠️
server/utils/discord/index.ts	8.33%	9 Missing and 2 partials ⚠️
app/plugins/api.ts	22.22%	5 Missing and 2 partials ⚠️
server/utils/botApi.ts	77.77%	0 Missing and 4 partials ⚠️
app/plugins/payload-cache.client.ts	50.00%	2 Missing ⚠️
app/composables/useAuditLog.ts	66.66%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #303      +/-   ##
==========================================
- Coverage   71.53%   71.14%   -0.39%     
==========================================
  Files         167      169       +2     
  Lines        3302     3393      +91     
  Branches      702      730      +28     
==========================================
+ Hits         2362     2414      +52     
- Misses        447      468      +21     
- Partials      493      511      +18     

Flag	Coverage Δ
component	65.93% <37.50%> (-0.17%)	⬇️
unit	67.31% <58.75%> (-0.37%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
package.json	100.00% <ø> (ø)
server/utils/runtimeConfig.ts	78.57% <ø> (ø)
app/composables/useAuditLog.ts	68.18% <66.66%> (-1.82%)	⬇️
app/plugins/payload-cache.client.ts	50.00% <50.00%> (ø)
server/utils/botApi.ts	77.77% <77.77%> (ø)
app/plugins/api.ts	50.00% <22.22%> (-30.00%)	⬇️
server/utils/discord/index.ts	34.28% <8.33%> (-1.60%)	⬇️
shared/utils/fetch-cache-config.ts	67.74% <64.00%> (-16.88%)	⬇️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[codspeed-hq]

Merging this PR will not alter performance

✅ 44 untouched benchmarks

---

_{Comparing cursor/backport-structure-api-88be (17e6d59) with main (6194ef0)}

[greptile-apps]

Do not cache mutations
shouldCacheFetch allows every method for allowed bot hosts, and cachedFetch returns a stored response before calling $fetch. The changed submitChanges path now sends PATCH /guilds/:id/settings through $api, so repeating the same settings body within the TTL hits this cache and skips the bot API update entirely while the UI treats it as saved. Restrict caching to safe read methods before checking the domain.

Artifacts

Repro: standalone mutation cache harness source

• Contains supporting evidence from the run (text/typescript; charset=utf-8).

Repro: mutation cache harness execution log

• Keeps the command output available without making the summary code-heavy.

_{Ran code and verified through T-Rex}

Prompt To Fix With AI

This is a comment left during a code review.
Path: shared/utils/fetch-cache-config.ts
Line: 157-163

Comment:
**Do not cache mutations**
`shouldCacheFetch` allows every method for allowed bot hosts, and `cachedFetch` returns a stored response before calling `$fetch`. The changed `submitChanges` path now sends `PATCH /guilds/:id/settings` through `$api`, so repeating the same settings body within the TTL hits this cache and skips the bot API update entirely while the UI treats it as saved. Restrict caching to safe read methods before checking the domain.

How can I resolve this? If you propose a fix, please make it concise.

[greptile-apps]

Too many files changed for review. (146 files found, 100 file limit)

Bypass the limit by tagging @greptile-apps to review.