fix : replace SELECT * with explicit columns in data-export

e2e/dashboard-widgets.spec.js

@@ -15,6 +15,7 @@ test.beforeEach(async ({ page }) => {
       accessToken: "test-token",
     },
     maxAge: 60 * 60,
+    cookieName: "next-auth.session-token",
   });
 
   await page.context().addCookies([
@@ -93,6 +94,45 @@ test.beforeEach(async ({ page }) => {
     });
   });
 
+  await page.route("**/api/goals/sync", async (route) => {
+    await route.fulfill({
+      contentType: "application/json",
+      body: JSON.stringify({ updated: 1, commitCount: 4 }),
+    });
+  });
+
+  await page.route("**/api/ai-insights**", async (route) => {
+    await route.fulfill({
+      contentType: "application/json",
+      body: JSON.stringify({
+        data: {
+          insights: [
+            {
+              id: "insight-1",
+              type: "productivity",
+              title: "High Consistency",
+              description: "You have coded 5 days this week!",
+              severity: "positive",
+            },
+          ],
+          trend: { direction: "up", percentage: 15 },
+          aiSummary: "Great job shipping features this week. Keep up the high standard!",
+          generatedAt: "2026-05-18T12:00:00.000Z",
+        },
+      }),
+    });
+  });
+
+  await page.route("**/api/notifications**", async (route) => {
+    await route.fulfill({
+      contentType: "application/json",
+      body: JSON.stringify({
+        notifications: [],
+        unreadCount: 0,
+      }),
+    });
+  });
+
   const metricRoutes = [
     "**/api/metrics/prs**",
     "**/api/metrics/pr-breakdown**",

src/app/api/streak/freeze/route.ts

@@ -70,6 +70,13 @@ export async function POST() {
 
   const today = todayStr();
 
+  const { data: existing } = await supabaseAdmin
+    .from("streak_freezes")
+    .select("id")
+    .eq("user_id", user.id)
+    .eq("freeze_date", today)
+    .maybeSingle();
+
   const { data: freeze, error } = await supabaseAdmin
     .from("streak_freezes")
     .upsert({ user_id: user.id, freeze_date: today }, { onConflict: "user_id,freeze_date" })
@@ -80,7 +87,9 @@ export async function POST() {
     return Response.json({ error: "Failed to apply freeze." }, { status: 500 });
   }
 
-  return Response.json({ freeze }, { status: 201 });
+  const alreadyExisted = existing !== null;
+
+  return Response.json({ freeze, already_existed: alreadyExisted }, { status: 201 });
 }
 
 // DELETE /api/streak/freeze

src/app/api/user/data-export/route.ts

@@ -21,7 +21,7 @@ export async function GET() {
 
   const { data: userData } = await supabaseAdmin
     .from("users")
-    .select("*")
+    .select("id, github_login, is_public, leaderboard_opt_in, created_at")
     .eq("id", user.id)
     .single();
   if (userData) {
@@ -35,13 +35,13 @@ export async function GET() {
 
   const { data: goals } = await supabaseAdmin
     .from("goals")
-    .select("*")
+    .select("id, user_id, title, description, status, created_at, updated_at")
     .eq("user_id", user.id);
   sections.goals = goals || [];
 
   const { data: snapshots } = await supabaseAdmin
     .from("metric_snapshots")
-    .select("*")
+    .select("id, user_id, streak_current, streak_longest, total_commits, total_prs, total_issues, snapshot_at")
     .eq("user_id", user.id)
     .order("snapshot_at", { ascending: false })
     .limit(1000);
@@ -62,13 +62,13 @@ export async function GET() {
 
   const { data: streakFreezes } = await supabaseAdmin
     .from("streak_freezes")
-    .select("*")
+    .select("id, user_id, freeze_date, created_at")
     .eq("user_id", user.id);
   sections.streakFreezes = streakFreezes || [];
 
   const { data: streakMilestones } = await supabaseAdmin
     .from("streak_milestones")
-    .select("*")
+    .select("id, user_id, streak_length, milestone_type, achieved_at")
     .eq("user_id", user.id);
   sections.streakMilestones = streakMilestones || [];
 
@@ -80,7 +80,7 @@ export async function GET() {
 
   const { data: localCodingSessions } = await supabaseAdmin
     .from("local_coding_sessions")
-    .select("*")
+    .select("id, user_id, date, duration_minutes, lines_added, lines_deleted, commits_count")
     .eq("user_id", user.id)
     .order("date", { ascending: false })
     .limit(365);