[IAmJSD]

getUpcomingPurchases() declared Promise<UpcomingPurchase[]>, but GET /api/dashboard/upcoming returns { purchases: [...] }, and both dashboard call sites cast around the mismatch, so tsc never checked how the response was used. There is no user-visible bug today; this PR types the real envelope and removes the casts so a future refactor can't silently break the Home upcoming-purchases widget.

Closes #1189

What changed

• frontend/src/api/types.ts: new UpcomingPurchasesResponse { purchases: UpcomingPurchase[] | null } (nullable because the Go handler serializes an empty nil slice as null).
• frontend/src/api/dashboard.ts: getUpcomingPurchases(): Promise<UpcomingPurchasesResponse>; the type is exported from frontend/src/api/index.ts.
• frontend/src/dashboard.ts: both casts removed (loadDashboard and retryUpcomingPurchases).
• frontend/src/types.ts: the duplicated local UpcomingPurchase interface (with provider narrowed to Provider) is now export type UpcomingPurchase = api.UpcomingPurchase, since that narrowing was what forced a cast.
• Tests: api.test.ts "resolves the { purchases } envelope" (with a typed annotation, so typecheck also guards it); a parametrized dashboard.test.ts case for purchases: null and a null response, both showing the empty state and no error.

Commits: cdc5bf35, and the merge with main e7956be9.

Why this approach

It matches the existing PlannedPurchasesResponse pattern. Typing purchases as nullable reflects the real wire format and makes tsc require the existing || [] guard. Aliasing the local type instead of keeping two hand-synced copies removes the drift that caused the cast; the widget only uses provider as a string (badge class whitelist, uppercase label), so widening it loses nothing. Temporarily reverting the return type to an array produced 4 tsc errors (both dashboard call sites, the new api test and the then-unused import), so the type change is load-bearing.

Screenshots

No visible change: this is a types-only change; the dashboard renders the same.

Verification

Run on this branch's head e7956be9 (level with main 51aa5b13), from frontend/:

• npm run lint: 0 errors. Typecheck and build pass.
• Jest: 3917 passed, 1 skipped.
• Playwright (e2e-local.sh): 208 passed.
• Secrets scan clean (planted key flagged); scripts/test-git-secrets-allowlist.sh: 137 PASS, 0 FAIL.
• Merged with main at 51aa5b1; conflicts in frontend/src/__tests__/api.test.ts resolved, see the merge commit.

Notes for review

Aliasing the local types.ts UpcomingPurchase to api.UpcomingPurchase widens provider from Provider to string for the dashboard. Keeping a separate view type plus a mapping function is the alternative if the narrower type is preferred.

Overlaps

#713 changes renderUpcomingPurchases in the same file (frontend/src/dashboard.ts). git merge-tree reports a clean merge and the types stay compatible, but both touch the same widget, so they are best reviewed and landed together.

Note for the UI owner

This changes UI code that @cristim owns. IAmJSD reviewed the before/after screenshots and asked for it to be merged; any design point you disagree with can be a follow-up.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{This review includes 7 billable files and costs up to $1.75.}

Or wait 59 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: LeanerCloud/cloud-commitments-platform
• Branch: main
• File: .coderabbit.yaml
• Commit: 51aa5b1
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6e86ee10-38ed-4f7d-b4ae-87c9d96fe932

Commits

Reviewing files that changed from the base of the PR and between 51aa5b1 and e7956be.

Files selected for processing: 7

• frontend/src/__tests__/api.test.ts
• frontend/src/__tests__/dashboard.test.ts
• frontend/src/api/dashboard.ts
• frontend/src/api/index.ts
• frontend/src/api/types.ts
• frontend/src/dashboard.ts
• frontend/src/types.ts

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[IAmJSD]

Independent review (IAmJSD's agent, fresh context, given only the diff, the issue and the PR text): APPROVE e7956be9a7177976f94aea57a6982ad00d30c2c9

Blocking:

• none
  Non-blocking:
• frontend/src/api/dashboard.ts:21: the return type is Promise, but apiRequest can resolve null on an empty 2xx body (fix(ci): azure_sanity passes one subscription ID as both target and expected value #304). Both call sites use ?., and the dashboard test covers null, but the type does not force future callers to do so. Consider UpcomingPurchasesResponse | null.
• frontend/src/types.ts: aliasing to api.UpcomingPurchase widens provider from Provider to string (api/types.ts:105). The current uses (providerBadgeClass whitelist, toUpperCase at dashboard.ts:484/486/615) are safe. The body already flags this.
  Attacked: The branch is level with current main (0 behind, mb=51aa5b13). Full jest (3917/3918) and tsc pass at HEAD. I checked that both getUpcomingPurchases call sites in main's reworked dashboard.ts (:142/:147/:187 and :430) read .purchases without casts, and that the api.UpcomingPurchase fields (has_recommendations fix(plans): a plan with no matching recommendations schedules zero-count purchases instead of failing #609, created_by_user_id sec(auth): API key permission constraints are silently dropped on create #950) are a superset of the deleted local interface. The merge conflict was only the api.test.ts import line: main's base64Encode import is kept, and nothing was dropped.

[IAmJSD]

Local verification at e7956be9 merged onto current main (8fda7e51; merge-tree 9ca50b85; Linux, Node, headless Chromium):

• This branch's own checks passed at this head: lint, typecheck, build, the full jest suite, the full Playwright e2e suite, and the git-secrets checks (see Verification in the PR body).
• The combined tree of every UI PR in this merge wave (tree dc090cc2, main plus 17 PRs) passes npm ci, lint, typecheck, build, jest (1 skipped, 4097 passed, 4098 total), and the full Playwright suite (232 passed).
• CI is green on e7956be9 (CI Success, Run pre-commit hooks).
• The independent review above approves this exact head.
• Nothing was applied to any cloud.

[IAmJSD]

Marked ready and merged by IAmJSD's agent, at IAmJSD's request (IAmJSD reviewed the before/after screenshots; cristim is traveling), after the independent review and local verification above, all at e7956be9.