Migrate channel API to new router

[tudddorrr]

No description provided.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.53%. Comparing base (6897cc9) to head (a6610a8).
⚠️ Report is 3 commits behind head on develop.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop     #810      +/-   ##
===========================================
- Coverage    98.53%   98.53%   -0.01%     
===========================================
  Files          344      357      +13     
  Lines        18969    18848     -121     
  Branches      1789     1767      -22     
===========================================
- Hits         18692    18571     -121     
  Misses         269      269              
  Partials         8        8              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[claude]

Code Review - PR #810: Migrate channel API to new router

Overall, this is a solid migration from koa-clay to the new router pattern. The code follows the documented conventions well. I found one potential improvement worth considering:

---

🟡 Security - Defense in Depth

src/routes/api/game-channel/subscriptions.ts:58

The subscriptions query doesn't explicitly filter channels by game:

const where: FilterQuery<GameChannel> = {
  members: {
    $some: {
      id: aliasId
    }
  }
}

const channels = await em.repo(GameChannel).find(where)

While this is likely safe because loadAlias middleware already ensures the alias belongs to ctx.state.game, adding an explicit game filter would provide defense-in-depth:

const where: FilterQuery<GameChannel> = {
  game: ctx.state.game,
  members: {
    $some: {
      id: aliasId
    }
  }
}

This prevents potential issues if the alias loading logic ever changes or if there are edge cases with the ORM's relationship handling.

Note: This same pattern exists in the old implementation, so this isn't a regression - but worth fixing while migrating.

---

✅ All Other Categories

• Code quality and best practices: Follows CLAUDE.md conventions correctly
• Potential bugs: No issues found
• Performance considerations: No issues found
• Test coverage: Tests updated appropriately