Dashboard App Code Review — v1

Scope: apps/dashboard/src/ — middleware, lib, server actions, API routes, layouts
Date: 2026-04-08
Reviewer: Claude Code
Status: All findings resolved

All 10 findings resolved. Most were already fixed before this review was actioned; M-3 ($queryRaw for connected_channel in strategy/actions.ts) was replaced with db.connectedChannel.findMany during this session.

What’s Working Well

Server actions consistently use requireSession() from @/lib/server-auth
Layout validates full session via auth.api.getSession() as the real auth gate
Socket JWT already at 15-minute expiry matching access token lifetime
Race-condition-safe context approval via updateMany optimistic lock
Prisma ORM used consistently throughout