Conversation
- rewrite inngest createFunction calls to v3 three-arg signature
(options, trigger, handler); previously the handler was passed as the
trigger arg leaving fn undefined and triggers as [{}], so all four
background functions (welcome email, weekly news, alert checks,
inactive-user reengagement) never registered triggers
- require the authenticated session user in deleteAlert and scope the
delete query to that userId, fixing an IDOR that let any signed-in
user delete another user's alert; drop unused toggleAlert helper
- redact MONGODB_URI credentials in the connect log line
- add null guard for nodemailer transporter in reset-password email
- remove dead WatchlistTable component and unused getWatchlistData
- add deleteAlert regression tests (authenticated / unauthenticated /
cross-user)
Co-Authored-By: FuXi <fuxicodex@gmail.com>
Contributor
|
@fuxicodex is attempting to deploy a commit to the ravixalgorithm's projects Team on Vercel. A member of the Team first needs to authorize it. |
Contributor
|
Understand this PR’s impact Explore downstream dependencies and potential security impact with Blast Radius. No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (8)
💤 Files with no reviewable changes (2)
Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review. 📝 WalkthroughWalkthroughThe pull request secures alert deletion, removes watchlist rendering and data loading, updates Inngest trigger registration, adds a password-reset transporter guard, adjusts its test mock, and redacts MongoDB connection logs. ChangesAlert access control
Watchlist implementation removal
Inngest registration updates
Email handling updates
Database logging protection
Priority: ➖ Normal Estimated code review effort: 3 (Moderate) | ~25 minutes Change: Bug fix 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
createFunctioncalls to the v3 three-arg signature(options, trigger, handler). Previously the handler was passed as the trigger argument, leavingfnundefined andtriggersas[{}]— sosign-up-email,weekly-news-summary,check-stock-alerts, andcheck-inactive-usersnever registered usable triggers and would never fire.deleteAlert: the action now resolves the authenticated session user and scopes the delete query to{ _id, userId }. Previously any signed-in user could delete another user's alert. Removed the unusedtoggleAlerthelper.database/mongoose.tsno longer prints the fullMONGODB_URI(which contains username/password); it now prints a redacted host form.reset-password.tsso unconfigured email credentials fail cleanly instead of throwing onnull.sendMail().WatchlistTable.tsx(168 lines, no imports) plus the now-unusedgetWatchlistDataaction.deleteAlertfix (authenticated success / unauthenticated rejected / cross-user rejected).Verification
tsc --noEmit(strict): 0 errors (was 11 before)vitest: 82 passed, 4 skipped (includes new deleteAlert tests)triggers: [{}]/fn: undefinedand the new 3-arg form produces correct triggers and handlerNotes
Full
next buildcannot run locally without aMONGODB_URI(page-data collection connects to the DB); verified viagit stashthat the build failure is pre-existing and unrelated to these changes.🤖 Generated with FuXi
Summary by CodeRabbit
Security
Bug Fixes
Changes