fix(subscriptions): reject unscoped batch replacement

[tiankaima]

Goal

Prevent an unscoped batch action=set request from replacing every historical section subscription. Production logs for #431 correlate the July 10 deletion with an automated CLI sweep that ran workspace calendar set 999999 using a production credential; the invalid section resolved to an empty target and the compatibility branch replaced the full relation.

Changed Surfaces

• Reject batch action=set unless semesterId is present.
• Preserve the existing scoped behavior: an empty selection may still clear only the named semester.
• Add schema and public-route regression coverage proving the rejected request does not mutate either semester.
• Update the subscription contract.

Evidence

Static/unit/build:

• bun run app:prepare
• bunx biome check
• bunx svelte-check --tsconfig ./tsconfig.json
• all three repository tsc --noEmit checks
• bunx vitest run — 154 files / 782 tests
• bun run build
• bun run openapi:check

Isolated database/API:

• 40 migrations and seed completed in a disposable local database
• related MCP integration: 11/11
• focused Playwright regression: 1 passed; both DATABASE_URL and local Hyperdrive override targeted the disposable database

Docs / Contracts

Updated docs/contracts/subscription.json to require semesterId for action=set. Generated OpenAPI has no drift because the conditional Zod refinement is enforced at runtime; the companion CLI guard is Life-USTC/cli#9.

REST/MCP parity was checked. MCP exposes add/remove/append only and has no replace tool. Bot has an unused internal replace wrapper, but no callers; this server guard makes any future unscoped use fail safely.

Risk Areas

This intentionally breaks clients that relied on unscoped batch replacement; they must select a semester. The separate legacy POST /api/calendar-subscriptions compatibility endpoint still supports explicit whole-set replacement and is not changed here because removing it is a broader public API break. It was not the caller in this incident.

No production data restoration is included. #431 remains open until the affected relations are restored with explicit authorization and the exposed calendar credential is rotated.

Cleanup

No scratch artifacts, Playwright output, generated drift, or unrelated rewrites remain.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	life-ustc	c54e918	Commit Preview URL Branch Preview URL	Jul 15 2026, 04:22 PM

[github-actions]

E2E HTML report is ready: https://life-ustc.github.io/e2e-snapshot-artifacts/reports/29432033519/index.html
All reports: https://life-ustc.github.io/e2e-snapshot-artifacts/

[github-actions]

🎉 This PR is included in version 1.51.4 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀