[baktun14]

Why

Fixes CON-1266

The team and project endpoints were left out of the published API reference while the organizations flag was staff-only. The flag widens to customers with the Organizations & Projects launch, so the reference should list them.

What

• createRoute keeps a set of published feature flags. A route behind one of them shows up in the served /v1/doc while the flag still decides who may call it. organizations is the only one, so the invoices routes stay hidden
• Publishes all 35 routes behind organizations plus the public POST /v1/invitations/preview: organizations, members, invitations, projects, project grants, budgets, spend, activity, deployment move and location, and account deletion eligibility. Each signed-in one lists the x-organization-id and x-project-id headers
• Audited the error responses of those routes against the code. Added the 400 a malformed id gets where it was missing, said that only an admin gets owner_role_restricted on ownership transfer, covered a deleted team on invitation preview and accept, and named the team codes that lease create, deployment create, template save and account deletion return
• Regenerated swagger/openapi.json and console-api-types, which also pick up drift main had not regenerated: the template project fields and the proposal id path param from fix(network): answer 400 to a proposal id that is not a positive integer #4545

Testing

• docs.spec.ts: new test fails when any route but the withheld billing ones drops out of /v1/doc, so a new team route cannot stay hidden. Snapshot updated
• create-route.spec.ts: a route behind a published flag is served and still gated. Mutation score 100% on the changed lines
• Rebased on main (c5e062d): api unit suite (7187 tests), docs.spec.ts, lint and tsc pass

Summary by CodeRabbit

• Documentation

  • Expanded API documentation with clearer error codes and conditions for deployments, leases, invitations, organizations, projects, budgets, memberships, and account deletion.
  • Added documented validation responses for malformed IDs and requests.
  • Clarified retryable and non-retryable deployment and secret-handling failures.
  • Invitation documentation now includes deleted organizations and additional acceptance states.
  • Published organization routes are now visible in OpenAPI documentation, while restricted routes remain hidden.

• API Updates

  • Saved templates can optionally be associated with a project.
  • Proposal identifiers are now consistently required in API responses.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: akash-network/console/.coderabbit.yaml
• Review profile: CHILL
• Plan: Essentials
• Run ID: 79f2e85a-bb8d-4e69-8a4b-b32928a12b6c

📥 Commits

Reviewing files that changed from the base of the PR and between c5e062d and b152713.

⛔ Files ignored due to path filters: 1

• apps/api/test/functional/__snapshots__/docs.spec.ts.snap is excluded by !**/*.snap

📒 Files selected for processing: 16

• apps/api/src/core/lib/create-route/create-route.spec.ts
• apps/api/src/core/lib/create-route/create-route.ts
• apps/api/src/deployment/routes/deployments/deployments.router.ts
• apps/api/src/deployment/routes/leases/leases.router.ts
• apps/api/src/organization/routes/invitations/invitations.router.ts
• apps/api/src/organization/routes/organization-invitations/organization-invitations.router.ts
• apps/api/src/organization/routes/organization-members/organization-members.router.ts
• apps/api/src/organization/routes/organizations/organizations.router.ts
• apps/api/src/organization/routes/project-budgets/project-budgets.router.ts
• apps/api/src/organization/routes/project-members/project-members.router.ts
• apps/api/src/organization/routes/projects/projects.router.ts
• apps/api/src/user/routes/account-deletion/account-deletion.router.ts
• apps/api/src/user/routes/user-templates/user-templates.router.ts
• apps/api/swagger/openapi.json
• apps/api/test/functional/docs.spec.ts
• packages/console-api-types/src/schema.d.ts

Included review availability: This review used your included allowance. 1 included review remains after this review. Your included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

📝 Walkthrough

The API now publishes routes with designated published feature flags. OpenAPI descriptions and console API types also document additional validation responses, error conditions, and request parameters across deployment, account, organization, invitation, and project endpoints.

Changes: API documentation and route publication

Layer / File(s)	Summary
Published OpenAPI routes apps/api/src/core/lib/create-route/create-route.ts, apps/api/src/core/lib/create-route/create-route.spec.ts, apps/api/test/functional/docs.spec.ts	Routes with published feature flags remain in served OpenAPI documents. Tests check hidden-route behavior and compare generated routes with the withheld route list.
Deployment and lease responses apps/api/src/deployment/routes/deployments/deployments.router.ts, apps/api/src/deployment/routes/leases/leases.router.ts, apps/api/swagger/openapi.json, packages/console-api-types/src/schema.d.ts	Deployment and lease documentation adds or revises error conditions for deposit pricing, malformed sequence numbers, and unreadable stored secrets.
Account deletion and template contracts apps/api/src/user/routes/account-deletion/account-deletion.router.ts, apps/api/src/user/routes/user-templates/user-templates.router.ts, apps/api/swagger/openapi.json, packages/console-api-types/src/schema.d.ts	Account deletion and template responses gain more specific error conditions. The template request type adds an optional project ID. The proposal path parameter type is narrowed to a non-null number.
Organization and invitation responses apps/api/src/organization/routes/invitations/invitations.router.ts, apps/api/src/organization/routes/organization-invitations/organization-invitations.router.ts, apps/api/src/organization/routes/organization-members/organization-members.router.ts, apps/api/src/organization/routes/organizations/organizations.router.ts, apps/api/swagger/openapi.json, packages/console-api-types/src/schema.d.ts	Organization and invitation documentation adds UUID validation responses and clarifies invitation, authorization, deletion, and ownership-transfer conditions.
Project, membership, and budget responses apps/api/src/organization/routes/project-budgets/project-budgets.router.ts, apps/api/src/organization/routes/project-members/project-members.router.ts, apps/api/src/organization/routes/projects/projects.router.ts, apps/api/swagger/openapi.json, packages/console-api-types/src/schema.d.ts	Project, grant, membership, and budget documentation adds UUID validation responses and clarifies project-scoped authorization conditions.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Feature

Suggested reviewers: olebel

Merge Risk: ⚪ Minimal · up to b1527

No actionable merge-blocking issue was identified; the change is ready for normal checks.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Some tools did not complete. Review the errors below.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

apps/api/src/core/lib/create-route/create-route.spec.ts

ESLint skipped: missing config or dependency (missing-dependency). The ESLint configuration references a package that is not available in the sandbox.

apps/api/src/core/lib/create-route/create-route.ts

ESLint skipped: the matched ESLint configuration already failed (missing-dependency).

apps/api/src/deployment/routes/deployments/deployments.router.ts

ESLint skipped: the matched ESLint configuration already failed (missing-dependency).

• 12 others

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.29%. Comparing base (c5e062d) to head (b152713).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4413      +/-   ##
==========================================
+ Coverage   94.08%   94.29%   +0.20%     
==========================================
  Files        1773     1664     -109     
  Lines       50963    48142    -2821     
  Branches    12435    11883     -552     
==========================================
- Hits        47951    45394    -2557     
+ Misses       2702     2454     -248     
+ Partials      310      294      -16     

Flag	Coverage Δ		*Carryforward flag
api	96.05% <100.00%> (+<0.01%)	⬆️
deploy-web	92.92% <ø> (ø)
log-collector	?
notifications	95.95% <ø> (ø)		Carriedforward from c5e062d
provider-console	81.68% <ø> (ø)		Carriedforward from c5e062d
provider-inventory	?
provider-proxy	92.21% <ø> (ø)		Carriedforward from c5e062d
tx-signer	?

*This pull request uses carry forward flags. Click here to find out more.

Files with missing lines	Coverage Δ
apps/api/src/core/lib/create-route/create-route.ts	100.00% <100.00%> (ø)

... and 109 files with indirect coverage changes

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[baktun14]

@claude review

[claude]

⚠️ Code review skipped — your organization's remaining monthly code review budget is too low to start another review, so this review was not started.

An organization admin can view or raise the monthly spending cap at claude.ai/admin-settings/usage, on the Claude Code Review row under Services. The cap resets at the start of the next billing period.

Once the cap resets or is raised, someone with write access to this repository can comment @claude review on this pull request to trigger a review.

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.

_{Tip: disable this comment in your organization's Code Review settings.}

[pullfrog]

✅ No new issues found.

Reviewed changes

• PUBLISHED_FEATURE_FLAGS in createRoute: routes behind FeatureFlags.ORGANIZATIONS are no longer registered in HIDDEN_ROUTES, so stripHiddenOperations serves them in /v1/doc, while requireFeatureFlag still decides per caller who may reach them. INVOICES stays unpublished, so the 16 billing routes stay withheld.
• Unhiding POST /v1/invitations/preview: the public token-preview route drops hiddenInOpenApiDocs, joining accept in the published reference.
• Error-response audit: the published routes' descriptions were checked against the code — added the 400 a malformed uuid gets, corrected the ownership-transfer 403 to say only an admin gets owner_role_restricted (a member is refused by the ability gate first), covered the deleted-team 404 on invitation preview/accept, named the codes account deletion and template save return, and fixed the deposit 400 (its denom is fixed by config, so unsupported_deposit_denom can only come from POST /v1/sign-and-broadcast-tx, which keeps documenting it).
• Test guards: docs.spec.ts gains an invariant that the served doc withholds exactly the 16 billing routes, and create-route.spec.ts covers the published-flag case; the snapshot is regenerated.
• Regenerated artifacts: swagger/openapi.json (description-only diff — the committed spec is built with includeHidden: true and already carried the org routes) and console-api-types, which also picks up main's unregenerated drift: the template projectId field and 403/404 responses, and the proposals {id} path param now typed number.

I verified the withholding end-to-end (the internal hidden routes live on internalOpenApiHonoHandlers, so they don't leak into the served doc or the new test), traced the description claims to their services, and ran both new spec files: they pass on this head, and reverting only create-route.ts to main makes the unit test fail 1/19 and the functional test fail listing exactly the 35 org routes — so both guards do their job.

  ^{｜ View workflow run ｜ Using GLM-5.3 ｜ 𝕏}