Forums Feature Requests Thread

[Enhancement] mobieusAI: Orphaned AI endpoint: AiController@suggestTags (/api/ai/suggest-tags) is wired to no surface

Patrick Bass · Jun 6 · 10 · 1 Locked
[Normal Priority] [Feature Enhancement] [Deployed to Production]
🚀 OP Jun 6, 2026 7:18pm

Area: mobieusAI (audit p11) · Surface: POST /api/ai/suggest-tags · Dimension: dead-code · Severity: minor

AiController@suggestTags and its route /api/ai/suggest-tags are the legacy ungated tag-suggester, superseded by the per-tenant-flag + spend-cap gated MemberAIController@suggestTags at /api/ai/forum/tag-suggest. The codebase comment confirms it "is no longer wired to any surface." It remains an unauthenticated-by-controller, ungated, billable Anthropic call reachable by URL with zero product use.

Evidence

The codebase itself documents the supersession at templates/forums/create-thread.php:200-203: "... routed through the gated MemberAI path (/api/ai/forum/tag-suggest) ... The legacy ungated AiController@suggestTags path (/api/ai/suggest-tags) is no longer wired to any surface."

Proof of zero callers — `grep -rn "api/ai/suggest-tags" --include="*.php" --include="*.js" --include="*.html" templates/ public/` returns ONLY the comment line:
  templates/forums/create-thread.php:202:  AiController@suggestTags path (/api/ai/suggest-tags) is no
No fetch()/wire()/aiPost() caller anywhere. Route still registered at src/routes.php:1095: `$router->post('/api/ai/suggest-tags', 'AiController@suggestTags');`. Method body lives at src/Controllers/AiController.php:59 (`public function suggestTags(): void`). The live replacement (ai_forum_tag_suggest → /api/ai/forum/tag-suggest) is invoked at templates/forums/create-thread.php:231.

Suggested fix. Delete the route registration at src/routes.php:1095 and remove the suggestTags() method from src/Controllers/AiController.php (lines 59-74). Update the dangling comment at templates/forums/create-thread.php:200-203 once removed.

Filed by the automated tenant-app audit and adversarially evidence-verified. Status: verified. Open — not yet actioned.


Patrick Bass
@mobieus

🚀 Jun 7, 2026 12:18pm

Shipped and deployed to production. Commit fddecc6472.

AiController::summarizeThread() now immediately returns 410 Gone with deprecation message (route already did this; controller now matches).

Closed as: deployed.


Patrick Bass
@mobieus

Log in or register to reply to this thread.