@nextsparkjs/core 0.1.0-beta.74 → 0.1.0-beta.76

package/templates/app/api/v1/teams/[teamId]/invoices/route.ts

@@ -9,7 +9,6 @@ import {
   addCorsHeaders,
 } from '@nextsparkjs/core/lib/api/helpers'
 import { authenticateRequest } from '@nextsparkjs/core/lib/api/auth/dual-auth'
-import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
 import { MembershipService } from '@nextsparkjs/core/lib/services'
 import { invoiceQuerySchema } from '@nextsparkjs/core/lib/validation/invoices'
 import type { InvoiceResponse } from '@nextsparkjs/core/lib/validation/invoices'
@@ -20,7 +19,7 @@ export async function OPTIONS() {
 }
 
 // GET /api/v1/teams/:teamId/invoices - List team invoices (owner only)
-export const GET = withRateLimitTier(withApiLogging(
+export const GET = withApiLogging(
   async (req: NextRequest, { params }: { params: Promise<{ teamId: string }> }): Promise<NextResponse> => {
     try {
       // Authenticate using dual auth (API key OR session)
@@ -123,4 +122,4 @@ export const GET = withRateLimitTier(withApiLogging(
       return addCorsHeaders(response)
     }
   }
-), 'read')
+)

package/templates/app/api/v1/teams/[teamId]/members/[memberId]/route.ts

@@ -8,7 +8,6 @@ import {
   addCorsHeaders,
 } from '@nextsparkjs/core/lib/api/helpers'
 import { authenticateRequest } from '@nextsparkjs/core/lib/api/auth/dual-auth'
-import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
 import { updateMemberRoleSchema } from '@nextsparkjs/core/lib/teams/schema'
 import { MembershipService } from '@nextsparkjs/core/lib/services'
 import { validateRoleTransition, canManageRole } from '@nextsparkjs/core/lib/teams/permissions'
@@ -20,7 +19,7 @@ export async function OPTIONS() {
 }
 
 // PATCH /api/v1/teams/:teamId/members/:memberId - Update member role
-export const PATCH = withRateLimitTier(withApiLogging(
+export const PATCH = withApiLogging(
   async (
     req: NextRequest,
     { params }: { params: Promise<{ teamId: string; memberId: string }> }
@@ -156,10 +155,10 @@ export const PATCH = withRateLimitTier(withApiLogging(
       return addCorsHeaders(response)
     }
   }
-), 'write')
+)
 
 // DELETE /api/v1/teams/:teamId/members/:memberId - Remove member from team
-export const DELETE = withRateLimitTier(withApiLogging(
+export const DELETE = withApiLogging(
   async (
     req: NextRequest,
     { params }: { params: Promise<{ teamId: string; memberId: string }> }
@@ -261,4 +260,4 @@ export const DELETE = withRateLimitTier(withApiLogging(
       return addCorsHeaders(response)
     }
   }
-), 'write')
+)

package/templates/app/api/v1/teams/[teamId]/members/route.ts

@@ -10,7 +10,7 @@ import {
 } from '@nextsparkjs/core/lib/api/helpers'
 import { authenticateRequest } from '@nextsparkjs/core/lib/api/auth/dual-auth'
 import { isSuperAdmin } from '@nextsparkjs/core/lib/api/auth/permissions'
-import { checkRateLimit, withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
+import { checkRateLimit } from '@nextsparkjs/core/lib/api/rate-limit'
 import { RATE_LIMITS } from '@nextsparkjs/core/lib/api/keys'
 import { inviteMemberSchema, memberListQuerySchema } from '@nextsparkjs/core/lib/teams/schema'
 import { TeamMemberService, MembershipService } from '@nextsparkjs/core/lib/services'
@@ -37,7 +37,7 @@ export async function OPTIONS() {
 }
 
 // GET /api/v1/teams/:teamId/members - List team members
-export const GET = withRateLimitTier(withApiLogging(
+export const GET = withApiLogging(
   async (req: NextRequest, { params }: { params: Promise<{ teamId: string }> }): Promise<NextResponse> => {
     try {
       // Authenticate using dual auth
@@ -159,10 +159,10 @@ export const GET = withRateLimitTier(withApiLogging(
       return addCorsHeaders(response)
     }
   }
-), 'read')
+)
 
 // POST /api/v1/teams/:teamId/members - Invite new member (creates invitation)
-export const POST = withRateLimitTier(withApiLogging(
+export const POST = withApiLogging(
   async (req: NextRequest, { params }: { params: Promise<{ teamId: string }> }): Promise<NextResponse> => {
     try {
       // Authenticate using dual auth
@@ -355,4 +355,4 @@ export const POST = withRateLimitTier(withApiLogging(
       return addCorsHeaders(response)
     }
   }
-), 'write')
+)

package/templates/app/api/v1/teams/[teamId]/route.ts

@@ -8,8 +8,7 @@ import {
   addCorsHeaders,
 } from '@nextsparkjs/core/lib/api/helpers'
 import { authenticateRequest } from '@nextsparkjs/core/lib/api/auth/dual-auth'
-import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
-import { updateTeamSchema } from '@nextsparkjs/core/lib/teams/schema'
+import { ownerUpdateTeamSchema, adminUpdateTeamSchema } from '@nextsparkjs/core/lib/teams/schema'
 import { TeamService, MembershipService } from '@nextsparkjs/core/lib/services'
 import type { Team, TeamRole } from '@nextsparkjs/core/lib/teams/types'
 
@@ -19,7 +18,7 @@ export async function OPTIONS() {
 }
 
 // GET /api/v1/teams/:teamId - Get team details
-export const GET = withRateLimitTier(withApiLogging(
+export const GET = withApiLogging(
   async (req: NextRequest, { params }: { params: Promise<{ teamId: string }> }): Promise<NextResponse> => {
     try {
       // Authenticate using dual auth
@@ -88,10 +87,10 @@ export const GET = withRateLimitTier(withApiLogging(
       return addCorsHeaders(response)
     }
   }
-), 'read')
+)
 
 // PATCH /api/v1/teams/:teamId - Update team (owners/admins only)
-export const PATCH = withRateLimitTier(withApiLogging(
+export const PATCH = withApiLogging(
   async (req: NextRequest, { params }: { params: Promise<{ teamId: string }> }): Promise<NextResponse> => {
     try {
       // Authenticate using dual auth
@@ -116,28 +115,56 @@ export const PATCH = withRateLimitTier(withApiLogging(
         return addCorsHeaders(response)
       }
 
-      // Check if user has permission to edit team using MembershipService
-      const membership = await MembershipService.get(authResult.user!.id, teamId)
-      const actionResult = membership.canPerformAction('teams.update')
-
-      if (!actionResult.allowed) {
-        const response = NextResponse.json(
-          {
-            success: false,
-            error: actionResult.message,
-            reason: actionResult.reason,
-            meta: actionResult.meta,
-          },
-          { status: 403 }
-        )
-        return addCorsHeaders(response)
+      const body = await req.json()
+
+      // FIX #2: Check owner-only requirement FIRST for name/description fields
+      // This provides clearer error messages to users
+      // Issue: https://github.com/NextSpark-js/nextspark/pull/1 (Issue #2)
+      // FIX #1: Use 'in' operator to check property existence (not value truthiness)
+      // This prevents type coercion bypass with falsy values (empty string, null, 0, false)
+      // Issue: https://github.com/NextSpark-js/nextspark/pull/1 (Issue #1)
+      const isOwnerOnlyUpdate = 'name' in body || 'description' in body
+
+      if (isOwnerOnlyUpdate) {
+        // Fetch team to verify ownership BEFORE other checks
+        const team = await TeamService.getById(teamId, authResult.user!.id)
+
+        if (!team || team.ownerId !== authResult.user!.id) {
+          const response = createApiError(
+            'Only team owners can edit team name and description',
+            403,
+            null,
+            'OWNER_ONLY'
+          )
+          return addCorsHeaders(response)
+        }
+
+        // Proceed with owner update (skip general permission check)
+      } else {
+        // Check general teams.update permission for non-owner-only fields
+        const membership = await MembershipService.get(authResult.user!.id, teamId)
+        const actionResult = membership.canPerformAction('teams.update')
+
+        if (!actionResult.allowed) {
+          const response = NextResponse.json(
+            {
+              success: false,
+              error: actionResult.message,
+              reason: actionResult.reason,
+              meta: actionResult.meta,
+            },
+            { status: 403 }
+          )
+          return addCorsHeaders(response)
+        }
       }
 
-      const body = await req.json()
-      const validatedData = updateTeamSchema.parse(body)
+      // Validate with appropriate schema based on update type
+      const schema = isOwnerOnlyUpdate ? ownerUpdateTeamSchema : adminUpdateTeamSchema
+      const validatedData = schema.parse(body) as Record<string, unknown>
 
       // Check if slug is being changed and if it's available
-      if (validatedData.slug) {
+      if ('slug' in validatedData && typeof validatedData.slug === 'string') {
         const slugAvailable = await TeamService.isSlugAvailable(validatedData.slug, teamId)
         if (!slugAvailable) {
           const response = createApiError('Team slug already exists', 409, null, 'SLUG_EXISTS')
@@ -150,27 +177,27 @@ export const PATCH = withRateLimitTier(withApiLogging(
       const values = []
       let paramCount = 1
 
-      if (validatedData.name !== undefined) {
+      if ('name' in validatedData && validatedData.name !== undefined) {
         updates.push(`name = $${paramCount++}`)
         values.push(validatedData.name)
       }
 
-      if (validatedData.slug !== undefined) {
+      if ('slug' in validatedData && validatedData.slug !== undefined) {
         updates.push(`slug = $${paramCount++}`)
         values.push(validatedData.slug)
       }
 
-      if (validatedData.description !== undefined) {
+      if ('description' in validatedData && validatedData.description !== undefined) {
         updates.push(`description = $${paramCount++}`)
         values.push(validatedData.description)
       }
 
-      if (validatedData.avatarUrl !== undefined) {
+      if ('avatarUrl' in validatedData && validatedData.avatarUrl !== undefined) {
         updates.push(`"avatarUrl" = $${paramCount++}`)
         values.push(validatedData.avatarUrl)
       }
 
-      if (validatedData.settings !== undefined) {
+      if ('settings' in validatedData && validatedData.settings !== undefined) {
         updates.push(`settings = $${paramCount++}`)
         values.push(JSON.stringify(validatedData.settings))
       }
@@ -229,10 +256,10 @@ export const PATCH = withRateLimitTier(withApiLogging(
       return addCorsHeaders(response)
     }
   }
-), 'write')
+)
 
 // DELETE /api/v1/teams/:teamId - Delete team (owners only, NOT personal teams)
-export const DELETE = withRateLimitTier(withApiLogging(
+export const DELETE = withApiLogging(
   async (req: NextRequest, { params }: { params: Promise<{ teamId: string }> }): Promise<NextResponse> => {
     try {
       // Authenticate using dual auth
@@ -292,4 +319,4 @@ export const DELETE = withRateLimitTier(withApiLogging(
       return addCorsHeaders(response)
     }
   }
-), 'write')
+)

package/templates/app/api/v1/teams/[teamId]/subscription/route.ts

@@ -6,14 +6,13 @@
 
 import { NextRequest, NextResponse } from 'next/server'
 import { validateAndAuthenticateRequest, createApiResponse, createApiError } from '@nextsparkjs/core/lib/api/helpers'
-import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
 import { SubscriptionService, MembershipService } from '@nextsparkjs/core/lib/services'
 
 interface RouteParams {
   params: Promise<{ teamId: string }>
 }
 
-export const GET = withRateLimitTier(async function GET(request: NextRequest, props: RouteParams) {
+export async function GET(request: NextRequest, props: RouteParams) {
   // Authenticate request
   const { auth, rateLimitResponse } = await validateAndAuthenticateRequest(request)
   if (rateLimitResponse) return rateLimitResponse
@@ -48,4 +47,4 @@ export const GET = withRateLimitTier(async function GET(request: NextRequest, pr
     console.error('[Billing API] Error fetching subscription:', error)
     return createApiError('Failed to fetch subscription', 500)
   }
-}, 'read')
+}

package/templates/app/api/v1/teams/[teamId]/usage/[limitSlug]/route.ts

@@ -7,7 +7,6 @@
 
 import { NextRequest, NextResponse } from 'next/server'
 import { validateAndAuthenticateRequest, createApiResponse, createApiError } from '@nextsparkjs/core/lib/api/helpers'
-import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
 import { SubscriptionService, UsageService, MembershipService } from '@nextsparkjs/core/lib/services'
 import { trackUsageSchema } from '@nextsparkjs/core/lib/billing/schema'
 
@@ -15,7 +14,7 @@ interface RouteParams {
   params: Promise<{ teamId: string; limitSlug: string }>
 }
 
-export const GET = withRateLimitTier(async function GET(request: NextRequest, props: RouteParams) {
+export async function GET(request: NextRequest, props: RouteParams) {
   // Authenticate request
   const { auth, rateLimitResponse } = await validateAndAuthenticateRequest(request)
   if (rateLimitResponse) return rateLimitResponse
@@ -45,9 +44,9 @@ export const GET = withRateLimitTier(async function GET(request: NextRequest, pr
     console.error('[Billing API] Error checking quota:', error)
     return createApiError('Failed to check quota', 500)
   }
-}, 'read')
+}
 
-export const POST = withRateLimitTier(async function POST(request: NextRequest, props: RouteParams) {
+export async function POST(request: NextRequest, props: RouteParams) {
   // Authenticate request
   const { auth, rateLimitResponse } = await validateAndAuthenticateRequest(request)
   if (rateLimitResponse) return rateLimitResponse
@@ -89,4 +88,4 @@ export const POST = withRateLimitTier(async function POST(request: NextRequest,
     const errorMessage = error instanceof Error ? error.message : 'Failed to track usage'
     return createApiError(errorMessage, 500)
   }
-}, 'write')
+}

package/templates/app/api/v1/teams/route.ts

@@ -10,19 +10,18 @@ import {
 } from '@nextsparkjs/core/lib/api/helpers'
 import { authenticateRequest } from '@nextsparkjs/core/lib/api/auth/dual-auth'
 import { isSuperAdmin } from '@nextsparkjs/core/lib/api/auth/permissions'
-import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
 import { createTeamSchema, teamListQuerySchema } from '@nextsparkjs/core/lib/teams/schema'
 import { TeamService } from '@nextsparkjs/core/lib/services'
 import type { Team } from '@nextsparkjs/core/lib/teams/types'
 import { APP_CONFIG_MERGED } from '@nextsparkjs/core/lib/config/config-sync'
 
 // Handle CORS preflight
-export async function OPTIONS() {
-  return handleCorsPreflightRequest()
+export async function OPTIONS(req: NextRequest) {
+  return handleCorsPreflightRequest(req)
 }
 
 // GET /api/v1/teams - List user's teams
-export const GET = withRateLimitTier(withApiLogging(async (req: NextRequest): Promise<NextResponse> => {
+export const GET = withApiLogging(async (req: NextRequest): Promise<NextResponse> => {
   try {
     // Authenticate using dual auth
     const authResult = await authenticateRequest(req)
@@ -62,7 +61,7 @@ export const GET = withRateLimitTier(withApiLogging(async (req: NextRequest): Pr
         'Insufficient permissions. Superadmin access required for scope=all.',
         403
       )
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     }
 
     // Build WHERE clause based on filters
@@ -155,16 +154,16 @@ export const GET = withRateLimitTier(withApiLogging(async (req: NextRequest): Pr
     }))
 
     const response = createApiResponse(teamsWithMembers, paginationMeta)
-    return addCorsHeaders(response)
+    return addCorsHeaders(response, req)
   } catch (error) {
     console.error('Error fetching teams:', error)
     const response = createApiError('Internal server error', 500)
-    return addCorsHeaders(response)
+    return addCorsHeaders(response, req)
   }
-}), 'read')
+})
 
 // POST /api/v1/teams - Create new team
-export const POST = withRateLimitTier(withApiLogging(async (req: NextRequest): Promise<NextResponse> => {
+export const POST = withApiLogging(async (req: NextRequest): Promise<NextResponse> => {
   try {
     // Authenticate using dual auth
     const authResult = await authenticateRequest(req)
@@ -194,7 +193,7 @@ export const POST = withRateLimitTier(withApiLogging(async (req: NextRequest): P
         null,
         'TEAM_CREATION_DISABLED'
       )
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     }
 
     // Validate allowCreateTeams option
@@ -215,7 +214,7 @@ export const POST = withRateLimitTier(withApiLogging(async (req: NextRequest): P
           null,
           'MAX_TEAMS_REACHED'
         )
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
     }
 
@@ -223,7 +222,7 @@ export const POST = withRateLimitTier(withApiLogging(async (req: NextRequest): P
     const slugAvailable = await TeamService.isSlugAvailable(validatedData.slug)
     if (!slugAvailable) {
       const response = createApiError('Team slug already exists', 409, null, 'SLUG_EXISTS')
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     }
 
     // Use transaction to ensure atomicity
@@ -275,7 +274,7 @@ export const POST = withRateLimitTier(withApiLogging(async (req: NextRequest): P
       }
 
       const response = createApiResponse(responseData, { created: true }, 201)
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     } catch (error) {
       await tx.rollback()
       throw error
@@ -284,11 +283,11 @@ export const POST = withRateLimitTier(withApiLogging(async (req: NextRequest): P
     if (error instanceof Error && error.name === 'ZodError') {
       const zodError = error as { issues?: unknown[] }
       const response = createApiError('Validation error', 400, zodError.issues, 'VALIDATION_ERROR')
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     }
 
     console.error('Error creating team:', error)
     const response = createApiError('Internal server error', 500)
-    return addCorsHeaders(response)
+    return addCorsHeaders(response, req)
   }
-}), 'write')
+})

package/templates/app/api/v1/teams/switch/route.ts

@@ -7,7 +7,6 @@ import {
   addCorsHeaders,
 } from '@nextsparkjs/core/lib/api/helpers'
 import { authenticateRequest } from '@nextsparkjs/core/lib/api/auth/dual-auth'
-import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
 import { TeamService } from '@nextsparkjs/core/lib/services'
 import { z } from 'zod'
 
@@ -21,7 +20,7 @@ export async function OPTIONS() {
 }
 
 // POST /api/v1/teams/switch - Switch active team context
-export const POST = withRateLimitTier(withApiLogging(async (req: NextRequest): Promise<NextResponse> => {
+export const POST = withApiLogging(async (req: NextRequest): Promise<NextResponse> => {
   try {
     // Authenticate using dual auth
     const authResult = await authenticateRequest(req)
@@ -86,4 +85,4 @@ export const POST = withRateLimitTier(withApiLogging(async (req: NextRequest): P
     const response = createApiError('Internal server error', 500)
     return addCorsHeaders(response)
   }
-}), 'write')
+})

package/templates/app/api/v1/theme/[...path]/route.ts

@@ -11,47 +11,46 @@ import {
   type ThemeRouteFile,
   type ThemeRegistryEntry
 } from '@nextsparkjs/registries/theme-registry'
-import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
 
-export const GET = withRateLimitTier(async (
+export async function GET(
   request: NextRequest,
   { params }: { params: Promise<{ path: string[] }> }
-) => {
+) {
   const { path } = await params
   return handleThemeRequest(request, path, 'GET')
-}, 'read');
+}
 
-export const POST = withRateLimitTier(async (
+export async function POST(
   request: NextRequest,
   { params }: { params: Promise<{ path: string[] }> }
-) => {
+) {
   const { path } = await params
   return handleThemeRequest(request, path, 'POST')
-}, 'write');
+}
 
-export const PUT = withRateLimitTier(async (
+export async function PUT(
   request: NextRequest,
   { params }: { params: Promise<{ path: string[] }> }
-) => {
+) {
   const { path } = await params
   return handleThemeRequest(request, path, 'PUT')
-}, 'write');
+}
 
-export const DELETE = withRateLimitTier(async (
+export async function DELETE(
   request: NextRequest,
   { params }: { params: Promise<{ path: string[] }> }
-) => {
+) {
   const { path } = await params
   return handleThemeRequest(request, path, 'DELETE')
-}, 'write');
+}
 
-export const PATCH = withRateLimitTier(async (
+export async function PATCH(
   request: NextRequest,
   { params }: { params: Promise<{ path: string[] }> }
-) => {
+) {
   const { path } = await params
   return handleThemeRequest(request, path, 'PATCH')
-}, 'write');
+}
 
 /**
  * Handle theme API requests with nested paths

package/templates/app/api/v1/theme/route.ts

@@ -8,11 +8,10 @@
 import { NextResponse } from 'next/server'
 import { PluginService, type PluginRegistryEntry } from '@nextsparkjs/core/lib/services'
 import { PLUGIN_REGISTRY } from '@nextsparkjs/registries/plugin-registry'
-import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
 
-export const GET = withRateLimitTier(async () => {
+export async function GET() {
   return listPluginsWithAPI()
-}, 'read');
+}
 
 /**
  * List all plugins with their API status

package/templates/app/api/v1/users/[id]/meta/[key]/route.ts

@@ -30,7 +30,6 @@ import {
 } from '@nextsparkjs/core/lib/api/helpers'
 import { authenticateRequest, hasRequiredScope } from '@nextsparkjs/core/lib/api/auth/dual-auth'
 import { z } from 'zod'
-import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
 
 // Validation schema for metadata value
 const metadataValueSchema = z.object({
@@ -57,7 +56,7 @@ export async function OPTIONS() {
  * GET /api/v1/users/user-123/meta/theme
  * Response: { success: true, data: { key: "theme", value: "dark" } }
  */
-export const GET = withRateLimitTier(withApiLogging(async (
+export const GET = withApiLogging(async (
   req: NextRequest,
   { params }: { params: Promise<{ id: string; key: string }> }
 ): Promise<NextResponse> => {
@@ -141,7 +140,7 @@ export const GET = withRateLimitTier(withApiLogging(async (
     )
     return addCorsHeaders(response)
   }
-}), 'read');
+})
 
 /**
  * PUT /api/v1/users/:id/meta/:key
@@ -160,7 +159,7 @@ export const GET = withRateLimitTier(withApiLogging(async (
  * Body: { value: "dark", isPublic: false }
  * Response: { success: true, data: { key: "theme", value: "dark", updated: true } }
  */
-export const PUT = withRateLimitTier(withApiLogging(async (
+export const PUT = withApiLogging(async (
   req: NextRequest,
   { params }: { params: Promise<{ id: string; key: string }> }
 ): Promise<NextResponse> => {
@@ -271,7 +270,7 @@ export const PUT = withRateLimitTier(withApiLogging(async (
     )
     return addCorsHeaders(response)
   }
-}), 'write');
+})
 
 /**
  * PATCH /api/v1/users/:id/meta/:key
@@ -288,7 +287,7 @@ export const PATCH = PUT
  * DELETE /api/v1/users/user-123/meta/theme
  * Response: { success: true, data: { key: "theme", deleted: true } }
  */
-export const DELETE = withRateLimitTier(withApiLogging(async (
+export const DELETE = withApiLogging(async (
   req: NextRequest,
   { params }: { params: Promise<{ id: string; key: string }> }
 ): Promise<NextResponse> => {
@@ -361,4 +360,4 @@ export const DELETE = withRateLimitTier(withApiLogging(async (
     )
     return addCorsHeaders(response)
   }
-}), 'write');
+})

package/templates/app/api/v1/users/[id]/route.ts

@@ -1,7 +1,7 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { queryOneWithRLS, mutateWithRLS } from '@nextsparkjs/core/lib/db';
-import {
-  createApiResponse,
+import { 
+  createApiResponse, 
   createApiError,
   withApiLogging,
   handleCorsPreflightRequest,
@@ -13,7 +13,6 @@ import {
 } from '@nextsparkjs/core/lib/api/helpers';
 import { authenticateRequest, hasRequiredScope } from '@nextsparkjs/core/lib/api/auth/dual-auth';
 import { z } from 'zod';
-import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit';
 
 const updateUserSchema = z.object({
   firstName: z.string().min(1).optional(),
@@ -29,7 +28,7 @@ export async function OPTIONS() {
 }
 
 // GET /api/v1/users/:id - Get specific user
-export const GET = withRateLimitTier(withApiLogging(async (
+export const GET = withApiLogging(async (
   req: NextRequest,
   { params }: { params: Promise<{ id: string }> }
 ): Promise<NextResponse> => {
@@ -88,10 +87,10 @@ export const GET = withRateLimitTier(withApiLogging(async (
     const response = createApiError('Internal server error', 500);
     return addCorsHeaders(response);
   }
-}), 'read');
+});
 
 // PATCH /api/v1/users/:id - Update user
-export const PATCH = withRateLimitTier(withApiLogging(async (
+export const PATCH = withApiLogging(async (
   req: NextRequest,
   { params }: { params: Promise<{ id: string }> }
 ): Promise<NextResponse> => {
@@ -225,10 +224,10 @@ export const PATCH = withRateLimitTier(withApiLogging(async (
     const response = createApiError('Internal server error', 500);
     return addCorsHeaders(response);
   }
-}), 'write');
+});
 
 // DELETE /api/v1/users/:id - Delete user
-export const DELETE = withRateLimitTier(withApiLogging(async (
+export const DELETE = withApiLogging(async (
   req: NextRequest,
   { params }: { params: Promise<{ id: string }> }
 ): Promise<NextResponse> => {
@@ -300,4 +299,4 @@ export const DELETE = withRateLimitTier(withApiLogging(async (
     const response = createApiError('Internal server error', 500);
     return addCorsHeaders(response);
   }
-}), 'write');
+});