BaseballHelm: derive Discover map count scope server-side

[njrini99-code]

Finding

getStateCounts trusts caller-supplied coachId and coachType even though it is exported as a server action and affects Discover map visibility.

Evidence

• src/app/baseball/actions/discover.ts lines 594-596 warns that the caller must derive coachType from the authenticated session.
• Lines 598-602 export getStateCounts(mode, coachId, coachType) directly as a server action.
• Lines 605-617 gate eligible player types based on the supplied coachType parameter.
• src/app/baseball/(dashboard)/dashboard/discover/DiscoverClient.tsx lines 320-321 passes client auth state into the action. A direct action call can supply a different coach type.
• getDiscoverPlayers and getDiscoverTeams correctly derive coach identity/type server-side, so this is a one-off mismatch in the map counts lane.

Why this matters

The map should reflect the same recruiting boundaries as the player/team lists. If counts can be requested with a forged coach type, the UI can reveal availability signals for player/org categories the coach should not recruit.

Acceptance criteria

• Remove coachId and coachType parameters from the exported action; derive both from supabase.auth.getUser() and the coach row server-side.
• Reuse the same coach-type eligibility helper as getDiscoverPlayers and getDiscoverTeams.
• Add tests that high-school/showcase coaches get empty counts and JUCO coaches do not see JUCO-player or showcase/JUCO-team counts.

[coderabbitai]

🔗 Related PRs

#31 - hotfix(coachhelm): P0 sweep — 16 fixes from 2026-05-23 audit [closed]
#281 - Men's/Women's Team Toggle — complete (backend, RLS, onboarding, UI) [merged]
#282 - Scope the messages rail to the coach's active team (team-toggle follow-up #2) [merged]
#304 - feat: integration roundup — CoachHelm + stats + demo + a11y + nightly fixes + safe deps [merged]
#336 - Stabilization + CoachHelm stale-data fix, goal tracking, PGA/LPGA baselines, UI pass [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

✅ Successfully generated implementation plan.

💡 Use @coderabbitai <feedback> to replan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[coderabbitai]

Coding Plan

Summary

• Centralize recruiting eligibility into a single shared helper and remove duplicated inline rules across the three Discover actions.
• Rewrite getStateCounts to derive coach id and coach type from supabase.auth.getUser() + the baseball_coaches row, dropping the trusted coachId/coachType parameters.
• Update DiscoverClient.tsx to call the action without identity arguments.
• Add Vitest coverage proving high_school/showcase coaches get empty counts and JUCO coaches cannot see JUCO-player or showcase/JUCO-team counts.

Design Choices

Design Choice 1: How should the "same coach-type eligibility helper" requirement be satisfied, given no shared helper exists today (logic is inlined in all three functions)?

Options Considered:

1. Extract a single shared helper that returns eligible player_types/org types (and a "no recruiting" flag) from a CoachType, and have all three functions consume it.
2. Inline the same auth + eligibility logic into getStateCounts without extracting a helper, leaving duplication in place.

Chosen Option: 1

Rationale: Extracting a shared helper directly satisfies the AC's "reuse the same helper" wording and removes the duplication that caused the original mismatch, reducing the risk of future divergence.

💡 User Tips

Regenerate the plan with different choices with @coderabbitai <feedback>.

Implementation Steps

Phase 1: Server-side scope hardening

Make the map-count lane derive coach scope from the authenticated session and centralize eligibility rules so all Discover lanes enforce identical recruiting boundaries.

Task 1: Extract a shared coach-type eligibility helper

Create a single source of truth for which player/org types a coach type may discover.

• Add a small helper in src/app/baseball/actions/discover.ts (or a colocated module under the same directory) that, given a CoachType, returns the eligible player_type array, the eligible org type array, and a flag indicating "no recruiting access" (true for high_school and showcase).
• Encode the existing rules: high_school/showcase → no access; juco → players ['high_school','showcase'], orgs ['high_school']; college/default → players ['high_school','showcase','juco'], orgs ['high_school','showcase','juco'].
• Keep the helper internal to the discover action module to avoid widening the public surface.

Task 2: Derive coach scope server-side in `getStateCounts` and remove client-supplied params

Replace trusted parameters with session-derived identity and type.

• Update the getStateCounts signature in src/app/baseball/actions/discover.ts to accept only mode: 'players' | 'teams', removing coachId and coachType.
• Reuse the same two-step auth pattern as getDiscoverPlayers/getDiscoverTeams: call supabase.auth.getUser(), return empty counts ({}) when there is no user, then look up the baseball_coaches row by user_id to obtain id and coach_type; return {} when no coach profile is found.
• Drive the eligibility gating (including the early empty-return for high_school/showcase) through the shared helper from Task 1.1 instead of the inlined coachType arrays.
• Continue excluding the coach's own roster players (players mode) using the server-derived coach id.
• Update the function's JSDoc to reflect that identity/type are now server-derived and client values are ignored.

Task 3: Route sibling functions through the shared helper

Ensure the helper is genuinely "the same" across lanes.

• Update getDiscoverPlayers and getDiscoverTeams in src/app/baseball/actions/discover.ts to obtain their eligible player/org type arrays from the shared helper instead of their inlined conditionals.
• Preserve existing behavior (e.g., the explicit neq('player_type','college') exclusion) — this task is a non-behavioral consolidation only.

🤖 Prompt for AI agents

This phase hardens the server-side scope of the Discover actions by centralizing
eligibility logic into a shared helper and rewriting `getStateCounts` to derive
coach identity from the authenticated session.

**Task 1.1 – Extract a shared coach-type eligibility helper** in
`src/app/baseball/actions/discover.ts` (or a colocated internal module):
- Create an internal helper function that accepts a `CoachType` and returns:
  - `eligiblePlayerTypes`: an array of eligible `player_type` values
  - `eligibleOrgTypes`: an array of eligible org `type` values
  - `hasNoRecruitingAccess`: a boolean flag
- Encode the following rules:
  - `high_school` / `showcase` → `hasNoRecruitingAccess: true`, empty arrays
  - `juco` → players `['high_school', 'showcase']`, orgs `['high_school']`
- `college` / default → players `['high_school', 'showcase', 'juco']`, orgs
`['high_school', 'showcase', 'juco']`
- Keep this helper unexported (internal to the module)

**Task 1.2 – Rewrite `getStateCounts`**:
- Change the function signature to `getStateCounts(mode: 'players' | 'teams')`,
removing `coachId` and `coachType` parameters
- Add the two-step auth pattern:
  1. Call `supabase.auth.getUser()`; return `{}` if no user
2. Look up the `baseball_coaches` row by `user_id` to get `id` and `coach_type`;
return `{}` if no coach profile found
- Use the shared helper from Task 1.1 to determine eligibility; return `{}`
early for `hasNoRecruitingAccess` coaches
- Use the server-derived coach `id` to exclude the coach's own roster players
(players mode)
- Update the JSDoc to note that identity/type are server-derived and
caller-supplied values are ignored

**Task 1.3 – Route sibling functions through the shared helper**:
- Update `getDiscoverPlayers` and `getDiscoverTeams` to call the shared helper
instead of their inlined conditional arrays
- Do not change any other logic or behavior (e.g., preserve the
`neq('player_type','college')` exclusion)

Phase 2: Client caller update

Align the Discover map UI with the new server-derived signature.

Drop identity arguments from the `getStateCounts` calls

Stop passing client auth state into the action.

• Update src/app/baseball/(dashboard)/dashboard/discover/DiscoverClient.tsx (the fetchStateCounts effect) to call getStateCounts('players') and getStateCounts('teams') without coach.id/coach.coach_type.
• Keep the existing if (!coach?.id) return; guard and effect dependencies so counts still refetch appropriately once auth resolves; remove any now-unused CoachType import if it becomes orphaned.

🤖 Prompt for AI agents

This phase updates the client-side caller to match the new `getStateCounts`
signature that no longer accepts identity arguments.

In `src/app/baseball/(dashboard)/dashboard/discover/DiscoverClient.tsx`, locate
the `fetchStateCounts` effect:
- Update the calls to `getStateCounts` to pass only the mode string:
`getStateCounts('players')` and `getStateCounts('teams')` — remove any
`coach.id` and `coach.coach_type` arguments
- Keep the existing `if (!coach?.id) return;` guard and all effect dependencies
unchanged
- Remove any `CoachType` import that is no longer referenced elsewhere in the
file

Phase 3: Tests

Lock in the recruiting boundaries for the map-count lane.

Add unit tests for `getStateCounts` scope enforcement

Cover the auth-derivation and eligibility scenarios required by the AC.

• Create a new test file under src/app/baseball/actions/__tests__/ following the existing Vitest pattern (mock @/lib/supabase/server createClient, an auth getUser stub, and a table-aware from() recorder; mock next/cache).
• Assert that high_school and showcase coaches receive empty counts ({}) in both players and teams modes.
• Assert that JUCO coaches' player counts exclude juco players and their team counts exclude showcase/juco org types (only high_school orgs counted).
• Assert that a college coach includes the full eligible set, and that an unauthenticated caller / missing coach profile yields empty counts.
• Verify the action no longer relies on any caller-supplied identity (calling with no extra args produces scope based solely on the mocked session coach).

🤖 Prompt for AI agents

This phase adds Vitest unit tests for `getStateCounts` to lock in scope
enforcement behavior.

Create a new test file under `src/app/baseball/actions/__tests__/` following the
existing Vitest pattern:
- Mock `@/lib/supabase/server` (`createClient`) with an auth `getUser` stub and
a table-aware `from()` recorder
- Mock `next/cache`

Write test cases covering:
- **Unauthenticated caller**: `getUser` returns no user → result is `{}`
- **Missing coach profile**: user exists but no `baseball_coaches` row → result
is `{}`
- **`high_school` coach**: returns `{}` for both `players` and `teams` modes
- **`showcase` coach**: returns `{}` for both `players` and `teams` modes
- **`juco` coach (players mode)**: query filters include only `['high_school',
'showcase']` player types; `juco` player type is excluded
- **`juco` coach (teams mode)**: query filters include only `['high_school']`
org types; `showcase`/`juco` org types are excluded
- **`college` coach**: query filters include the full eligible set for both
modes
- **No caller-supplied identity**: call `getStateCounts('players')` /
`getStateCounts('teams')` with no extra arguments and confirm scope is derived
solely from the mocked session

Research

The Discover feature lives in src/app/baseball/actions/discover.ts, which exports three server actions: getDiscoverPlayers, getDiscoverTeams, and getStateCounts. The first two derive coach identity from supabase.auth.getUser() and a baseball_coaches lookup, then apply recruiting eligibility rules (which player_type/org types a coach may see) via inlined conditional arrays. getStateCounts powers the Discover map and currently accepts coachId/coachType as parameters, trusting them despite being a server action. The client component DiscoverClient.tsx passes auth-store values into getStateCounts. No unit tests exist for discover actions; the established Vitest pattern (Supabase/auth mocks, table-aware from() recorder) is found in src/app/baseball/actions/__tests__/.

---

🚀 Next Steps

🤖 All AI agent prompts combined

Task: 1

This phase hardens the server-side scope of the Discover actions by centralizing
eligibility logic into a shared helper and rewriting `getStateCounts` to derive
coach identity from the authenticated session.

**Task 1.1 – Extract a shared coach-type eligibility helper** in
`src/app/baseball/actions/discover.ts` (or a colocated internal module):
- Create an internal helper function that accepts a `CoachType` and returns:
  - `eligiblePlayerTypes`: an array of eligible `player_type` values
  - `eligibleOrgTypes`: an array of eligible org `type` values
  - `hasNoRecruitingAccess`: a boolean flag
- Encode the following rules:
  - `high_school` / `showcase` → `hasNoRecruitingAccess: true`, empty arrays
  - `juco` → players `['high_school', 'showcase']`, orgs `['high_school']`
- `college` / default → players `['high_school', 'showcase', 'juco']`, orgs
`['high_school', 'showcase', 'juco']`
- Keep this helper unexported (internal to the module)

**Task 1.2 – Rewrite `getStateCounts`**:
- Change the function signature to `getStateCounts(mode: 'players' | 'teams')`,
removing `coachId` and `coachType` parameters
- Add the two-step auth pattern:
  1. Call `supabase.auth.getUser()`; return `{}` if no user
2. Look up the `baseball_coaches` row by `user_id` to get `id` and `coach_type`;
return `{}` if no coach profile found
- Use the shared helper from Task 1.1 to determine eligibility; return `{}`
early for `hasNoRecruitingAccess` coaches
- Use the server-derived coach `id` to exclude the coach's own roster players
(players mode)
- Update the JSDoc to note that identity/type are server-derived and
caller-supplied values are ignored

**Task 1.3 – Route sibling functions through the shared helper**:
- Update `getDiscoverPlayers` and `getDiscoverTeams` to call the shared helper
instead of their inlined conditional arrays
- Do not change any other logic or behavior (e.g., preserve the
`neq('player_type','college')` exclusion)
===============================================================================

Task: 2

This phase updates the client-side caller to match the new `getStateCounts`
signature that no longer accepts identity arguments.

In `src/app/baseball/(dashboard)/dashboard/discover/DiscoverClient.tsx`, locate
the `fetchStateCounts` effect:
- Update the calls to `getStateCounts` to pass only the mode string:
`getStateCounts('players')` and `getStateCounts('teams')` — remove any
`coach.id` and `coach.coach_type` arguments
- Keep the existing `if (!coach?.id) return;` guard and all effect dependencies
unchanged
- Remove any `CoachType` import that is no longer referenced elsewhere in the
file
===============================================================================

Task: 3

This phase adds Vitest unit tests for `getStateCounts` to lock in scope
enforcement behavior.

Create a new test file under `src/app/baseball/actions/__tests__/` following the
existing Vitest pattern:
- Mock `@/lib/supabase/server` (`createClient`) with an auth `getUser` stub and
a table-aware `from()` recorder
- Mock `next/cache`

Write test cases covering:
- **Unauthenticated caller**: `getUser` returns no user → result is `{}`
- **Missing coach profile**: user exists but no `baseball_coaches` row → result
is `{}`
- **`high_school` coach**: returns `{}` for both `players` and `teams` modes
- **`showcase` coach**: returns `{}` for both `players` and `teams` modes
- **`juco` coach (players mode)**: query filters include only `['high_school',
'showcase']` player types; `juco` player type is excluded
- **`juco` coach (teams mode)**: query filters include only `['high_school']`
org types; `showcase`/`juco` org types are excluded
- **`college` coach**: query filters include the full eligible set for both
modes
- **No caller-supplied identity**: call `getStateCounts('players')` /
`getStateCounts('teams')` with no extra arguments and confirm scope is derived
solely from the mocked session

💡 Iterate on the plan with: `@coderabbitai` <feedback>

Example Feedback
- `@coderabbitai` You can skip phase 3. Add a simple unit test case for phase 2.
- `@coderabbitai` For design choice 1 go ahead with option 3 and replan.

---

💬 Have feedback or questions? Drop into our discord!