fix(chat): return 403 for inactive chats without writing an execution log

[waleedlatif1]

Summary

• POST /api/chat/[identifier] on a disabled chat now returns 403 right after the chat lookup, the same as GET
• Previously that branch loaded the workflow, started a LoggingSession and wrote a failed workflow_execution_logs row per request, before chat auth and before the execution rate limits, so anonymous callers could grow the log table and fill the owner's logs with fake failed runs at will
• A request that never reached execution no longer produces an execution log; the warn log line stays for operators
• Rate limits stay where they are: moving the chat-execute buckets above auth would let unauthenticated callers drain a password/email chat's execution budget (existing test asserts auth-only POSTs are not metered)

Type of Change

• Bug fix

Testing

• Added a POST test for an inactive chat: 403, a single DB read, no LoggingSession start/complete, no auth check; confirmed it fails against the old route
• app/api/chat/** tests pass (134), lint, check:audits, docs-manifest:check, and type-check pass

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 19, 2026 7:36pm UTC

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge and consistently treats inactive chats as rejected before execution admission.

Summary

The PR moves inactive-chat POST handling to a clean pre-admission 403 path.

• Removes the workflow lookup and failed execution-log write for inactive chats.
• Preserves the operator warning and existing response semantics.
• Adds coverage verifying one database read and no authentication or logging work.

_{Reviews (1) · Last reviewed commit: "fix(chat): return 403 for inactive chats..."}

[cubic-dev-ai]

No issues found across 2 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}