[Sentry] Fix N+1 API calls for package permissions

[Patrick-Erichsen]

🔗 Links

• Sentry Issue: APP-12T
• Linear Issue: To be created with team=Continue, project=b375d280-66d0-46f1-b5c8-7a19cb821c50, labels=sentry

🤖 Seer AI Analysis Summary

Seer identified that N+1 TRPC queries for package permissions made outside the initial batch window fail authentication due to missing or stale credentials. The root cause is that multiple PackageHit and AssistantHit components each trigger individual authenticated getAllowedOrgsForPackage queries asynchronously, resulting in 401 errors when authentication context is lost between the initial batch request (HTTP 207) and subsequent individual requests.

Seer Actionability Score: 0.24 (0-1 scale, higher is more actionable)

🔍 Full Seer Analysis

{
  "analysis_status": "complete",
  "run_id": 2321106,
  "root_cause": "N+1 TRPC queries for package permissions, made outside the initial batch window, fail authentication due to missing or stale credentials.",
  "issue_description": "The core issue stems from an N+1 pattern triggering subsequent, unauthorized individual API calls. The initial large batch TRPC request returns status 207 (Multi-Status), immediately followed by numerous individual GET requests to the same endpoint (getAllowedOrgsForPackage) that all return 401 Unauthorized, indicating a failure in authentication for the subsequent, non-batched calls.",
  "key_observations": [
    "The initial large batch request returns 207 Multi-Status",
    "Subsequent requests fail with 401s immediately following the batch completion",
    "These authed calls trigger after a significant delay, suggesting session loss"
  ],
  "execution_flow": [
    "User navigates to the homepage, triggering initial data fetch",
    "Homepage loads, triggering multiple TRPC queries in a single batch",
    "Initial large TRPC batch request succeeds with HTTP 207 Multi-Status",
    "Algolia search results render multiple PackageHit components",
    "Each rendered hit component triggers an unbatched, authenticated query",
    "Individual authenticated requests fail with 401 Unauthorized",
    "The repeated 401 errors trigger a cascading failure, including the RSC fetch error"
  ],
  "affected_files": [
    "app/components/Providers/index.tsx",
    "app/components/UseAgentOrBlockButtons/agent/hooks/useAssistantData.ts",
    "services/control-plane/src/trpc/routers/package/router.ts"
  ],
  "code_context": {
    "batching_config": "httpBatchLink in app/components/Providers/index.tsx with credentials: 'include'",
    "query_usage": "trpc.package.getAllowedOrgsForPackage.useQuery({ packageId }) in useAssistantData.ts",
    "auth_requirement": "authedProcedure requiring workOsUserId in package router"
  }
}

📋 Follow-up Prompts

• Use the get_issue_details Sentry tool to get details for APP-12T

💡 Additional Context

📦 Webhook Payload

{
  "timestamp": "2025-10-30T21:17:05.670Z",
  "resource": "issue",
  "action": "unresolved",
  "webhook": {
    "action": "unresolved",
    "installation": {
      "uuid": "6f4757c1-bca5-463f-9e99-85dcdd3646de"
    },
    "data": {
      "issue": {
        "id": "6967971082",
        "shareId": null,
        "shortId": "APP-12T",
        "title": "N+1 API Call",
        "culprit": "/explore",
        "permalink": "https://continue-xd.sentry.io/issues/6967971082/",
        "logger": null,
        "level": "info",
        "status": "unresolved",
        "statusDetails": {},
        "substatus": "regressed",
        "isPublic": false,
        "platform": "javascript",
        "project": {
          "id": "4508150678028288",
          "name": "app",
          "slug": "app",
          "platform": "javascript-nextjs"
        },
        "type": "transaction",
        "metadata": {
          "title": "N+1 API Call",
          "location": "/explore",
          "value": "https://api.continue.dev/trpc/package.getAllowedOrgsForPackage,package.getAllowedOrgsForPackage,package.getAllowedOrgsForPackage,package.getAllowedOrgsForPackage,package.getAllowedOrgsForPackage,package.getAllowedOrgsForPackage?batch=*&input=*",
          "initial_priority": 25,
          "sdk": {
            "name": "sentry.javascript.nextjs",
            "name_normalized": "sentry.javascript.nextjs"
          }
        },
        "numComments": 0,
        "assignedTo": null,
        "isBookmarked": false,
        "isSubscribed": false,
        "subscriptionDetails": null,
        "hasSeen": false,
        "annotations": [],
        "issueType": "performance_n_plus_one_api_calls",
        "issueCategory": "http_client",
        "priority": "low",
        "priorityLockedAt": null,
        "seerFixabilityScore": 0.23967063426971436,
        "seerAutofixLastTriggered": null,
        "isUnhandled": false,
        "count": "4",
        "userCount": 0,
        "firstSeen": "2025-10-23T08:53:03.570100Z",
        "lastSeen": "2025-10-30T21:16:59.850400Z"
      }
    },
    "actor": {
      "type": "application",
      "id": "sentry",
      "name": "Sentry"
    }
  }
}

---

Summary by cubic

Fixed N+1 API calls for package permissions on the explore page by batching getAllowedOrgsForPackage requests. Prevents 401s from late individual calls and reduces duplicate network traffic.

^{Written for commit cfa5012. Summary will update automatically on new commits.}