refactor(auth/repositories): drop redundant 'Capability[]' casts

[sukvvon]

CLAUDE.md says never to cast types and to fix at the source instead. repositories.server.ts carried five as Capability[] casts reading capability columns.

None of them were needed. The schema already produces the right type:

export const capabilityEnum = pgEnum('capability', CAPABILITIES)
capabilities: capabilityEnum('capabilities').array().notNull().default([])

CAPABILITIES is an as const tuple used as the single source of truth, so Drizzle infers Capability[] on its own. Verified with a throwaway probe:

const probe = (c: InferSelectModel<typeof users>['capabilities']): Capability[] => c
// compiles with no cast

So this is a straight deletion — no schema change, no new types.

Two things went with them

A type guard that wasn't doing anything. roles.capabilities is .array().notNull(), so a leftJoin can produce null but never a non-array. The Array.isArray half of the guard was unreachable:

-      .filter(
-        (caps): caps is Capability[] => caps !== null && Array.isArray(caps),
-      )
-      .flat() as Capability[]
+      .filter((caps) => caps !== null)
+      .flat()

TypeScript narrows out the null from the predicate alone.

|| → ??. An empty array is a valid value here (it is the column default), and || reads as though it isn't. Behaviour is identical — [] is truthy, so only null ever hit the fallback — but the intent is clearer.

Consistency

Removing the guard in getEffectiveCapabilities left getBulkEffectiveCapabilities as the only place still calling Array.isArray on the same column from the same kind of join. Its row.roleCapabilities && check already excludes null, so the Array.isArray was dropped there too rather than leaving the two functions treating identical data differently.

Testing

tsc clean, oxlint --type-aware reports 0 errors across 916 files, and the unit suite passes (144/145, 1 pre-existing skip).

Worth flagging: there is no test covering this file. The reasoning above is type-level and from the schema definitions; nothing here was exercised at runtime. Since it is role-based capability resolution, a quick check that a user with an assigned role still shows the right capabilities in the admin UI would be worth doing before merge.

Summary by CodeRabbit

• Bug Fixes
  • Improved capability handling during authentication and authorization checks.
  • Ensured direct and role-based permissions are processed reliably, including cases where capability data is unavailable.
  • Preserved existing default behavior while reducing inconsistencies in permission evaluation.
  • Improved handling of missing or incomplete permission data to support more consistent access decisions.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 5e2d1b70-b05a-4b68-84ea-16d77ec763bf

📥 Commits

Reviewing files that changed from the base of the PR and between 549af86 and 7276900.

📒 Files selected for processing (1)

• src/auth/repositories.server.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• src/auth/repositories.server.ts

---

📝 Walkthrough

Walkthrough

Changes

Capability mapping

Layer / File(s)	Summary
Capability mapping and aggregation src/auth/repositories.server.ts	User capability mapping removes an explicit Capability[] cast. Direct capabilities use nullish defaults. Role capabilities are filtered without array-type checks and explicit casts.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: removing redundant Capability[] casts from authentication repositories.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch refactor/capability-column-types

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	tanstack-com	7276900	Commit Preview URL Branch Preview URL	Aug 05 2026, 08:31 PM

[coderabbitai]

🧹 Nitpick comments (1)

src/auth/repositories.server.ts (1)

244-250: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add regression tests for both capability aggregation methods.

Cover users with no role assignments, multiple roles with duplicate capabilities, and bulk requests containing users without roles. These cases exercise the nullish defaults, left-join null handling, and removed array guards.

Also applies to: 288-296

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/auth/repositories.server.ts` around lines 244 - 250, Add regression tests
for both capability aggregation methods surrounding directCapabilities and
roleCapabilities. Cover users without role assignments, multiple roles with
duplicate capabilities, and bulk requests containing users without roles,
asserting correct nullish defaults, left-join null handling, and behavior after
removing array guards.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@src/auth/repositories.server.ts`:
- Around line 244-250: Add regression tests for both capability aggregation
methods surrounding directCapabilities and roleCapabilities. Cover users without
role assignments, multiple roles with duplicate capabilities, and bulk requests
containing users without roles, asserting correct nullish defaults, left-join
null handling, and behavior after removing array guards.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: f0a6423b-13f5-4800-9238-5ef6dcd4b6c7

📥 Commits

Reviewing files that changed from the base of the PR and between e95911b and 4e6b2e8.

📒 Files selected for processing (1)

• src/auth/repositories.server.ts

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.