fix(shipping): audit depth + security tightening (SR-5/SR-8) — bia-shared 1.0.0 - #60
Conversation
…ared 1.0.0 SR-5 (audit depth): - payment PATCH: read-before-write, audit carries prior AND next money values (undo no longer erases who/when/how); missing parcel is now 404; un-marking paid clears the orphaned paid_note (prior survives in audit) - parcel.create seeds a parcel_events row — officer-created parcels no longer start with an empty/misleading timeline - routes/contacts PATCH audits old→new values (public-facing pricing/ contact info), not just field names - CSV export is audited (shipment.export, row count) — it exports member payment data SR-8 (security/validation): - bia-shared: `import "server-only"` in the service-role factory and the root-barrel re-export REMOVED — the CLAUDE.md "server-only export path" guardrail is now real, enforced at build time. BREAKING → 1.0.0 (all in-repo importers switched to the subpath; bia-roommate/george pin 0.6.x and don't import the factory from the barrel — verified) - routes/contacts PATCH: zod (last hand-rolled mutation bodies) — NaN pricing rejected, qr_code_url must be an http(s) URL, length caps - qr-upload: storage-key extension from the validated MIME type, never the client filename - CSV formula-injection guard also catches =+-@ hidden behind leading whitespace/control chars - parcels list: limit/offset validated (NaN was a PostgREST 500); shipments/requests lists bounded (limit 500) Tests: value-audit + NaN + URL-validation + timeline-seed assertions; vitest aliases server-only to a stub for Node runs. 250 passed; bia-shared suite 67 passed; tsc clean; build green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Warning Review limit reached
Next review available in: 29 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (31)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
Summary
Fourth PR of the 2026-07-03 shipping refinement.
SR-5 — the audit log can now reconstruct what happened
{prior, next}for amount/paid_at/paid_by/method/note — an undo no longer erases who/when/how. Missing parcel → 404 (was a 500 via.single()). Un-marking paid clears the orphanedpaid_note(prior value survives in the audit row).parcel.createseedsparcel_events— the status trigger only fires on UPDATE, so officer-created parcels had an empty timeline.fields: [...]alone couldn't answer "what was it before".shipment.export) — it contains member payment data.SR-8 — the imaginary guardrail is now real
bia-shared1.0.0 (BREAKING):import "server-only"in the service-role factory + root-barrel re-export removed. CLAUDE.md claimed the factory "lives in a server-only export path" — it didn't; 10+ client components import that barrel. Now a client-graph import fails the build. All in-repo importers (members routes, blog/members pages, audit-log, auth callback) switched to the subpath; bia-roommate/george pin^0.6and never imported the factory from the barrel (verified by grep), so nothing breaks downstream; they pick this up whenever they bump majors."12.5"strings — coerced, null preserved),qr_code_urlmust be http(s), length caps everywhere.=+-@behind leading whitespace/control chars (Excel strips them before evaluating).limit/offset→ 400 instead of a PostgREST 500; shipments/requests lists bounded at 500 rows.Tests
250 passed (new: value-audit assertions on routes/contacts, NaN rejection, URL validation, timeline-seed, id-set audit); bia-shared 67 passed;
server-onlyaliased to a stub for Node test runs; tsc clean; production build green (which itself now proves no client component pulls the factory).🤖 Generated with Claude Code