[AchoArnold]

Summary

• Add a phone deletion confirmation dialog with the selected phone number, Cancel/Delete actions, and duplicate-submit protection.

• Display backend validation errors beneath each Edit Phone input using the existing error-message bag; clear stale errors on retry and keep failed edits open.

• Save the API key returned by /v1/users/me so all subsequent shared API requests send x-api-key alongside Firebase bearer authentication.

• Cap backend phone messages_per_minute at 30 (previously 60), with boundary coverage for 0, 30, 31, and 60.

Validation

• Frontend test suite: 64 tests passed (pnpm test).
• ESLint, Stylelint, Prettier, and git diff checks passed for changed files.
• Focused runtime checks verified phone deletion success/failure, field error bindings and retry behavior, and API-key propagation across existing/new clients, user reloads, and session reset.
• Phone validator tests passed: go test ./pkg/validators -run TestPhoneHandlerValidator -count=1; gofumpt and diff checks passed.

[AchoArnold]

@greptileai please review this pull request.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 42 complexity · 4 duplication

Metric	Results
Complexity	42
Duplication	4

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge; no new blocking issues were found.

Summary

The PR adds phone deletion confirmation, shows phone field errors, saves the account API key for shared requests, and lowers the phone send-rate limit to 30.

• Shared web requests use the current account API key alongside Firebase authentication.
• Phone edits show server validation messages beneath the matching fields.
• Phone deletion asks for confirmation before removing the selected number.
• Phone upserts accept at most 30 messages per minute.

_{Reviews (4) · Last reviewed commit: "fix(web): match sanitized schedule valid..." · Reviewed by Greptile}

[AchoArnold]

Updated Settings to reuse the existing validation-message sanitizer, now supporting both fetch and Axios error shapes. Backend field names such as messages_per_minute display as messages per minute, while error-bag keys remain unchanged.

Added regression tests; all 67 frontend tests and changed-file lint checks pass. Full frontend type checking remains blocked by existing $vuetify references in blog pages and useFilters references in Settings; no errors were reported in the new parsing code.

[AchoArnold]

@greptileai please review the latest changes, including the session-isolation fix for discussion_r4405741690.

[AchoArnold]

@greptileai please run another full review of the latest PR changes, including the session-isolation fix in 03a70c4.

[Copilot]

🟡 Changes recommended

Schedule validation errors are reformatted to “Day of week,” but scheduleWindowError() still matches “day_of_week,” causing overlapping-window and per-day window-limit failures to show neither inline feedback nor a notification.

1 open issue

• Update scheduleWindowError markers to match capitalized day errors · New

What changed in this PR

This PR improves phone settings in the web client, strengthens shared API authentication, and lowers the backend phone message-rate limit.

Changes:

• Add phone deletion confirmation and field-level validation feedback that keeps failed edits open.
• Save API keys from user responses and prevent stale authentication responses from restoring cleared credentials.
• Cap messages_per_minute at 30 and add validation, error-formatting, and authentication tests.

File	Description
web/​app/​utils/​errors.ts	Support shared validation-error formatting for fetch and Axios errors.
web/​app/​utils/​errors.test.ts	Test validation-error formats and non-validation failures.
web/​app/​stores/​auth.ts	Save API keys and guard credential updates across session changes.
web/​app/​stores/​auth.test.ts	Test API-key propagation and stale authentication responses.
web/​app/​pages/​settings/​index.vue	Add phone deletion confirmation and field-error bindings; reuse shared error formatting.
api/​pkg/​validators/​phone_handler_validator.go	Lower the maximum phone message rate to 30.
api/​pkg/​validators/​phone_handler_validator_test.go	Cover message-rate boundaries at 0, 30, 31, and 60.

_{Review effort: Balanced}

[AchoArnold]

The API integration failures came from test fixtures still calling setupPhone/setupAdapterPhone with 60 messages per minute after the backend maximum changed to 30. Updated all 20 affected fixture calls to 30 and left the dedicated 10-message rate-limit test unchanged (7d6ee76).

Phone validator tests and integration-test compilation pass locally. Docker is not running locally, so the full end-to-end rerun is being verified in CI.

@greptileai please review the latest head, including the corrected integration fixtures.

[AchoArnold]

Integration CI passed after correcting the phone-rate fixtures (run 40765718525). Also fixed the follow-up review finding about sanitized weekday window errors. @greptileai please review the latest head.