Describe the task.
Your AI builds it.

Request: Add a page where clients can see their unpaid invoices. The AI plans: - Read the invoice table and how the client portal signs people in. - Add a route that returns one client's own unpaid invoices, nobody else's. - Write a test that proves a client can't read another client's invoices. Writes app/api/clients/[id]/invoices/route.ts: // app/api/clients/[id]/invoices/route.ts // New: a client can see their own unpaid invoices. import { NextRequest, NextResponse } from "next/server"; import { db } from "@/lib/database"; import { requireClientSession } from "@/lib/auth"; export async function GET(req: NextRequest, { params }: { params: { id: string } }) { const session = await requireClientSession(req); if (session.clientId !== params.id) { return NextResponse.json({ error: "Forbidden" }, { status: 403 }); } const invoices = await db.invoice.findMany({ where: { clientId: params.id, status: "unpaid" }, orderBy: { dueDate: "asc" }, }); const total = invoices.reduce((sum, inv) => sum + inv.amount, 0); return NextResponse.json({ invoices, total }); } Runs the tests: ✓ returns a client's own unpaid invoices ✓ blocks a client from reading someone else's invoices ✓ total matches the sum of the invoice amounts You choose. Ship it to the test site: Live on the test site. Ask a client to check their invoices before it goes to production. Not yet: Nothing shipped. The code and its tests are saved on a branch, ready when you are.