feat(website): add API wrapper for collections backend API

[fhennig]

This is part of #938

Summary

• move existing backendApi dir out of the subscriptions, into the top level where the other API stuff is also located (lapis, covspectrum).
• Add new types and functions for the backend API
• Use a common proxyToBackend function for subscriptions and collections API
• drop userId everywhere, because it's already added later on in the backend proxy

PR Checklist

• All necessary documentation has been adapted.
• The implemented feature is covered by an appropriate test. (We're not testing these functions)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
dashboards	Ready	Preview, Comment	Mar 19, 2026 3:29pm

[Copilot]

Pull request overview

Adds a generalized website-side API wrapper to support the new “collections” backend endpoints while consolidating existing subscriptions backend API plumbing at website/src/backendApi and introducing a shared /api/* proxy that injects userId from the authenticated session.

Changes:

• Introduces BackendService collections endpoints + Collection zod schemas.
• Replaces the subscriptions-specific proxy with a shared proxyToBackend used by both subscriptions and collections routes.
• Removes explicit userId plumbing in subscriptions UI and client API calls (now derived in the proxy).

Reviewed changes

Copilot reviewed 18 out of 19 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
website/src/util/getErrorLogMessage.ts	Updates import path after backend API relocation.
website/src/types/Collection.ts	Adds zod schemas/types for collections + request/update payloads.
website/src/pages/subscriptions/index.astro	Drops userId prop wiring into client component.
website/src/pages/subscriptions/create.astro	Drops userId prop wiring into client component.
website/src/pages/api/subscriptions/[...path].ts	Switches to shared proxyToBackend.
website/src/pages/api/collections/[...path].ts	Adds collections API route using shared proxyToBackend.
website/src/pages/api/backendProxy.ts	New shared backend proxy that appends userId from session.
website/src/layouts/OrganismPage/DataPageLayout.tsx	Updates withQueryProvider import location.
website/src/components/views/wasap/WasapPage.tsx	Updates withQueryProvider import location.
website/src/components/views/sequencingEfforts/CountStatistics.tsx	Updates withQueryProvider import location.
website/src/components/subscriptions/overview/Subscriptions.tsx	Removes userId prop usage; updates query/service calls to new API location.
website/src/components/subscriptions/overview/SubscriptionEntry.tsx	Removes userId usage for delete; updates API import location.
website/src/components/subscriptions/create/SubscriptionsCreate.tsx	Removes userId usage for create; updates API import location.
website/src/components/pageStateSelectors/DynamicDateFilter.browser.spec.tsx	Updates withQueryProvider import location for tests.
website/src/backendApi/withQueryProvider.tsx	New shared React Query provider HOC.
website/src/backendApi/querySubscriptions.ts	Drops userId parameter; uses session-proxied backend API.
website/src/backendApi/backendService.ts	Moves/extends backend API client; adds collections endpoints; removes userId params.
website/src/backendApi/backendService.spec.ts	Updates tests to align with removal of userId in client calls.
website/routeMocker.ts	Updates backend route mock helpers to match new request shapes (no userId).

Comments suppressed due to low confidence (3)

website/src/backendApi/backendService.ts:166

• The deleteSubscription response schema uses z.literal('').refine((input): input is never => true), which makes the parsed return type never even though the method resolves with an empty string at runtime. This is misleading for callers and can break type-driven control flow. Prefer returning void (transform the schema to undefined) or keep the output type as string without narrowing to never.
  website/src/backendApi/backendService.ts:198
• Same issue as deleteSubscription: the schema z.literal('').refine((input): input is never => true) narrows the return type to never while the request resolves normally. Consider returning void (schema transform) or keep the schema output type as string to avoid misleading typing for deleteCollection.
  website/src/backendApi/backendService.ts:199
• BackendService adds new collections endpoints (getCollections, getCollection, postCollection, putCollection, deleteCollection) but there are no corresponding tests in backendService.spec.ts. Since this file already has request/response contract tests for subscriptions, adding similar tests for the collections methods would help catch regressions (URL, params, and schema parsing).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[fengelniederhammer]

Astro didn't create a proper route for this (or at least I didn't find one), but let's still move this out of pages/?

[fengelniederhammer]

Suggested change

	type: z.literal('mutationList'),
	type: z.literal('filterObject'),

... etc. :)

[fengelniederhammer]

This makes the login required for every route, but the collections have public routes. We probably need to exclude some from this check?