Repository navigation
Upgrade Elysia to 1.4 - #25
Conversation
|
CodeAnt AI is reviewing your PR. Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
|
You've used up your 5 PR reviews for this month under the Korbit Starter Plan. You'll get 5 more reviews on November 6th, 2025 or you can upgrade to Pro for unlimited PR reviews and enhanced features in your Korbit Console. |
Reviewer's GuideThis PR upgrades the Elysia framework and related plugins to version 1.4, updates dependencies accordingly, migrates from the deprecated swagger plugin to the new openapi plugin with type-based references, and refines application startup and authentication configuration. Class diagram for updated authentication configurationclassDiagram
class AuthConfig {
+basePath: string
+plugins: Plugin[]
+trustedOrigins: string[]
+database: PrismaAdapter
+emailAndPassword: EmailAndPasswordConfig
+advanced: AdvancedConfig
+session: SessionConfig
+cache: CacheConfig
}
class EmailAndPasswordConfig {
+enabled: boolean
+sendOnSignUp: boolean
}
class AdvancedConfig {
+cookiePrefix: string
+crossSubDomainCookies: CrossSubDomainCookiesConfig
+defaultCookieAttributes: CookieAttributes
}
class SessionConfig {
+enabled: boolean
}
class CacheConfig {
+get(key, defaultValue)
+set(key, value, ttl)
}
class PrismaAdapter {
+provider: string
}
class Plugin {}
class CrossSubDomainCookiesConfig {
+enabled: boolean
}
class CookieAttributes {
+sameSite: string
+secure: boolean
}
AuthConfig --> EmailAndPasswordConfig
AuthConfig --> AdvancedConfig
AuthConfig --> SessionConfig
AuthConfig --> CacheConfig
AuthConfig --> PrismaAdapter
AuthConfig --> Plugin
AdvancedConfig --> CrossSubDomainCookiesConfig
AdvancedConfig --> CookieAttributes
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.
|
Caution Review failedThe pull request is closed. Note Other AI code review bot(s) detectedCodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review. 📝 WalkthroughSummary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings. WalkthroughDependency bumps across the API app, Swagger → OpenAPI migration, exported the Elysia app instance, added auth basePath "/auth", introduced a tsconfig for declaration output and simplified tsconfig, and added a docker-compose.base.yml with Postgres and Redis services. Startup now logs the API URL. Changes
Sequence Diagram(s)sequenceDiagram
participant Client
participant Server as Elysia App
participant OpenAPI as `@elysiajs/openapi`
participant Auth as betterAuth
Client->>Server: HTTP request / startup
Note right of Server: Initialize server with routes & middleware
Server->>OpenAPI: register OpenAPI (fromTypes / openapi({...}))
Server->>Auth: mount betterAuth with basePath "/auth"
Server-->>Client: respond to request
Note left of Server: on listen -> log API URL
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes
Possibly related PRs
Suggested labels
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro 📒 Files selected for processing (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
PR Compliance Guide 🔍Below is a summary of compliance checks for this PR:
Compliance status legend🟢 - Fully Compliant🟡 - Partial Compliant 🔴 - Not Compliant ⚪ - Requires Further Human Verification 🏷️ - Compliance label |
|||||||||||||||||||||||||
CI Feedback 🧐A test triggered by this PR failed. Here is an AI-generated analysis of the failure:
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey there - I've reviewed your changes - here's some feedback:
- Confirm that replacing @elysiajs/swagger with @elysiajs/openapi/fromTypes still exposes your API docs/UI at the expected endpoint, since the openapi plugin doesn’t bundle a UI by default.
- Double-check your CORS and static plugin configurations against the Elysia 1.4 upgrade guide — some plugin initialization signatures changed in v1.4.
- You’ve set basePath to "/auth" in the betterAuth config — ensure your frontend routes and OpenAPI references are updated accordingly.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- Confirm that replacing @elysiajs/swagger with @elysiajs/openapi/fromTypes still exposes your API docs/UI at the expected endpoint, since the openapi plugin doesn’t bundle a UI by default.
- Double-check your CORS and static plugin configurations against the Elysia 1.4 upgrade guide — some plugin initialization signatures changed in v1.4.
- You’ve set basePath to "/auth" in the betterAuth config — ensure your frontend routes and OpenAPI references are updated accordingly.Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
codeant-ai
Bot
added
the
size:M
PR Code Suggestions ✨Explore these optional code suggestions:
|
||||||||||||
Pull Request Feedback 🔍
|
![codeant-ai[bot]](https://avatars.githubusercontent.com/in/646884?s=60&v=4){kind=small}
| "@opentelemetry/exporter-trace-otlp-proto": "^0.203.0", | ||
| "@opentelemetry/sdk-trace-node": "^2.0.1", | ||
| "@elysiajs/cors": "^1.4.0", | ||
| "@elysiajs/openapi": "^1.4.11", |
There was a problem hiding this comment.
Suggestion: Search the codebase for any imports or runtime usage of @elysiajs/swagger and update them to @elysiajs/openapi; also update plugin initialization to the OpenAPI plugin API (e.g., use the new fromTypes or current OpenAPI initialization pattern) so there are no lingering imports or old API usage at runtime. [possible issue]
| set: async (key, value, ttl) => { | ||
| if (ttl) { | ||
| await redis.set(key, value, 'EX', ttl); | ||
| await redis.set(key, value, "EX", ttl); |
There was a problem hiding this comment.
Suggestion: Replace the direct variadic call to redis.set(key, value, "EX", ttl) with a robust implementation that detects the Redis client API at runtime and uses setEx, the options-object signature, or falls back to the variadic form so TTL is actually applied across different Redis clients. [possible bug]
|
CodeAnt AI finished reviewing your PR. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
…ostgreSQL and Redis
|
CodeAnt AI is running Incremental review Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
codeant-ai
Bot
added
size:L
|
CodeAnt AI Incremental review completed. |
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (1)
apps/api/package.json (1)
16-16: Verify swagger to openapi migration is complete.The package dependencies correctly replace
@elysiajs/swaggerwith@elysiajs/openapi. However, as noted in a previous review comment, you should verify that all runtime code has been updated accordingly.This duplicates an earlier concern about the swagger→openapi migration. Please confirm that:
- No lingering swagger imports exist in the codebase
- All plugin initialization uses the new OpenAPI API
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
bun.lockis excluded by!**/*.lock
📒 Files selected for processing (5)
apps/api/package.json(1 hunks)apps/api/src/index.ts(2 hunks)apps/api/tsconfig.dts.json(1 hunks)apps/api/tsconfig.json(1 hunks)docker-compose.base.yml(1 hunks)
🧰 Additional context used
📓 Path-based instructions (3)
**/*.{ts,tsx}
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
**/*.{ts,tsx}: Use object destructuring for method parameters (wrap multiple parameters in an object; define shapes with TypeScript interfaces)
Use authClient.useSession() for session state
Avoid React hooks; use Legend State observables directly (exception: Better Auth hooks)
Import UI components via path aliases (e.g., @/src/components/ui/)
Prefer union string/number literals over TypeScript enums
Use export type and import type for types
Don't use non-null assertions (!) or implicit any
Avoid TypeScript namespaces; prefer ESM modules
Files:
apps/api/src/index.ts
**/*.{tsx,ts}
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
Use Platform.OS and process.env.EXPO_OS for conditional platform logic
Files:
apps/api/src/index.ts
**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
**/*.{ts,tsx,js,jsx}: Don't use the arguments object
Use for...of instead of Array.forEach
Use arrow functions instead of function expressions
Use Date.now() instead of new Date().getTime()
Use .flatMap() instead of map().flat() when possible
Prefer regex literals over RegExp constructor when possible
Use concise optional chaining instead of chained logical expressions
Always provide radix to parseInt()
Don't use var; use const/let and prefer const when single assignment
Use template literals over string concatenation
Use strict equality (===/!==)
Don't use console or debugger in committed code
Prevent import cycles and avoid namespace imports
Don't hardcode secrets (API keys/tokens) in source
Don't have unused vars, params, imports, labels, or private members
Avoid await inside loops; ensure Promise-like statements are handled
Disallow bitwise operators and comma operator
Ensure switch statements are exhaustive; default clause comes last; no fallthrough or duplicate cases
Use object spread over Object.assign when creating new objects
Prefer Array.isArray over instanceof Array; use at() instead of integer index access where appropriate
No unreachable code, duplicate conditions, or assignments in conditionals
Always use radix with parseInt; prefer Number.isNaN/Number.isFinite over globals
Disallow using global eval, with, var, and unsafe negation
Ensure typeof comparisons use valid strings; getters return values; constructors don’t return values
Files:
apps/api/src/index.ts
🧠 Learnings (15)
📚 Learning: 2025-08-28T12:01:24.375Z
Learnt from: chakrihacker
Repo: fyndx/universal-starter PR: 13
File: apps/frontend/tsconfig.json:13-17
Timestamp: 2025-08-28T12:01:24.375Z
Learning: When using TypeScript project references for Eden Treaty type safety, the backend needs both "composite": true and "declaration": true in tsconfig.json to emit .d.ts files that the frontend can consume. The workspace root also needs TypeScript as a devDependency for the build commands to work properly.
Applied to files:
apps/api/tsconfig.dts.jsonapps/api/tsconfig.json
📚 Learning: 2025-09-02T09:56:34.362Z
Learnt from: chakrihacker
Repo: fyndx/universal-starter PR: 15
File: apps/backend/package.json:43-55
Timestamp: 2025-09-02T09:56:34.362Z
Learning: For Eden Treaty type safety in monorepo setups, TypeScript source files can be referenced directly in package.json "types" fields (e.g., "./src/index.ts") since Eden Treaty works with compile-time type inference and doesn't require emitted .d.ts files for local development.
Applied to files:
apps/api/tsconfig.dts.jsonapps/api/tsconfig.jsonapps/api/package.json
📚 Learning: 2025-09-03T13:07:10.649Z
Learnt from: CR
Repo: fyndx/universal-starter PR: 0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-03T13:07:10.649Z
Learning: Applies to **/*.{ts,tsx} : Use export type and import type for types
Applied to files:
apps/api/tsconfig.dts.jsonapps/api/tsconfig.json
📚 Learning: 2025-09-03T13:07:10.649Z
Learnt from: CR
Repo: fyndx/universal-starter PR: 0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-03T13:07:10.649Z
Learning: Applies to **/*.{ts,tsx} : Avoid TypeScript namespaces; prefer ESM modules
Applied to files:
apps/api/tsconfig.dts.jsonapps/api/tsconfig.json
📚 Learning: 2025-08-28T12:01:24.375Z
Learnt from: chakrihacker
Repo: fyndx/universal-starter PR: 13
File: apps/frontend/tsconfig.json:13-17
Timestamp: 2025-08-28T12:01:24.375Z
Learning: The project uses TypeScript project references between frontend and backend specifically for Eden Treaty type safety. The frontend references the backend via "references": [{"path": "../backend"}] in tsconfig.json to access exported App types for compile-time type inference, not runtime imports.
Applied to files:
apps/api/tsconfig.dts.jsonapps/api/tsconfig.json
📚 Learning: 2025-09-03T13:07:10.649Z
Learnt from: CR
Repo: fyndx/universal-starter PR: 0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-03T13:07:10.649Z
Learning: Applies to **/*.{ts,tsx,js,jsx} : Prevent import cycles and avoid namespace imports
Applied to files:
apps/api/tsconfig.dts.jsonapps/api/tsconfig.json
📚 Learning: 2025-09-03T13:07:10.649Z
Learnt from: CR
Repo: fyndx/universal-starter PR: 0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-03T13:07:10.649Z
Learning: Applies to **/*.{ts,tsx,js,jsx} : Don't have unused vars, params, imports, labels, or private members
Applied to files:
apps/api/tsconfig.dts.jsonapps/api/tsconfig.json
📚 Learning: 2025-09-03T13:07:10.649Z
Learnt from: CR
Repo: fyndx/universal-starter PR: 0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-03T13:07:10.649Z
Learning: Applies to **/*.{ts,tsx} : Don't use non-null assertions (!) or implicit any
Applied to files:
apps/api/tsconfig.dts.jsonapps/api/tsconfig.json
📚 Learning: 2025-09-03T13:07:10.649Z
Learnt from: CR
Repo: fyndx/universal-starter PR: 0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-03T13:07:10.649Z
Learning: Applies to tsconfig.json : Configure TypeScript path aliases for @/* from project root
Applied to files:
apps/api/tsconfig.dts.jsonapps/api/tsconfig.json
📚 Learning: 2025-09-03T13:07:10.649Z
Learnt from: CR
Repo: fyndx/universal-starter PR: 0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-03T13:07:10.649Z
Learning: Applies to **/*.{ios,android,web}.{ts,tsx,js} : Use platform-specific file extensions (.ios.tsx, .web.ts, etc.) for platform implementations
Applied to files:
apps/api/tsconfig.dts.json
📚 Learning: 2025-09-03T13:07:10.649Z
Learnt from: CR
Repo: fyndx/universal-starter PR: 0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-03T13:07:10.649Z
Learning: Applies to **/*.{ts,tsx,js,jsx} : Don't hardcode secrets (API keys/tokens) in source
Applied to files:
apps/api/tsconfig.dts.jsonapps/api/tsconfig.json
📚 Learning: 2025-09-03T13:07:10.649Z
Learnt from: CR
Repo: fyndx/universal-starter PR: 0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-03T13:07:10.649Z
Learning: Applies to babel.config.js : Configure NativeWind Babel/Metro plugins for Tailwind compilation
Applied to files:
apps/api/tsconfig.json
📚 Learning: 2025-09-03T13:07:10.649Z
Learnt from: CR
Repo: fyndx/universal-starter PR: 0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-03T13:07:10.649Z
Learning: Applies to **/*.{ts,tsx,js,jsx} : Don't use var; use const/let and prefer const when single assignment
Applied to files:
apps/api/tsconfig.json
📚 Learning: 2025-09-03T13:07:10.649Z
Learnt from: CR
Repo: fyndx/universal-starter PR: 0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-03T13:07:10.649Z
Learning: Applies to **/*.{ts,tsx,js,jsx} : Disallow bitwise operators and comma operator
Applied to files:
apps/api/tsconfig.json
📚 Learning: 2025-08-28T11:58:48.129Z
Learnt from: chakrihacker
Repo: fyndx/universal-starter PR: 13
File: apps/backend/package.json:41-53
Timestamp: 2025-08-28T11:58:48.129Z
Learning: The universal/backend package in this project is used solely for Eden Treaty type safety (similar to ORPC), not for runtime code imports. Eden Treaty provides compile-time type inference from Elysia app types, so Metro transpilation of the backend package is not required.
Applied to files:
apps/api/package.json
🧬 Code graph analysis (1)
apps/api/src/index.ts (2)
packages/logger/src/index.ts (1)
elysiaLogger(27-30)apps/api/src/lib/open-api.ts (1)
prefix(8-24)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Sourcery review
🔇 Additional comments (6)
apps/api/tsconfig.dts.json (1)
1-106: LGTM! Declaration configuration is properly structured.This dedicated TypeScript configuration for declaration file generation is well-configured with
emitDeclarationOnly: trueand appropriate compiler options. It complements the maintsconfig.json(which usesnoEmit: true) by separating type declaration generation from the build process.Based on learnings, this setup supports Eden Treaty type safety by ensuring
.d.tsfiles are properly generated for consumers.apps/api/tsconfig.json (1)
3-3: LGTM! Streamlined configuration with separate declaration generation.The simplified configuration with
noEmit: trueworks well with the newtsconfig.dts.jsonfor declaration generation. The use ofmodule: "Preserve"andcomposite: truemaintains Eden Treaty type safety while reducing config complexity.Based on learnings, maintaining
composite: trueanddeclaration: trueis essential for Eden Treaty type inference across the monorepo.Also applies to: 28-38
apps/api/src/index.ts (2)
17-17: LGTM! App export and startup logging enhance developer experience.Exporting the
appinstance improves type safety for Eden Treaty consumers, and the startup log provides clear feedback during local development.Also applies to: 86-88
22-34: I need to gather more information about the backend TypeScript configuration and whether type definitions are being generated properly.Let me check the backend TypeScript configuration to understand if type declarations are being generated:
Based on my verification, I can now provide the rewritten review comment:
OpenAPI documentation is functional without type-based schema generation.
By default, Elysia relies on runtime schema to generate OpenAPI documentation. The current code using
openapi({})without thefromTypesconfiguration will still provide working OpenAPI endpoints at/openapiand/openapi/json.The commented code indicates it's recommended that declaration files (.d.ts) should be pre-generated to provide type declarations to the generator. For monorepo setups, it's recommended to provide the path to the project root to allow the generator to run correctly. A common error when enabling this is "Couldn't find generated declaration file" when calling the OpenAPI endpoint.
Recommended action: Either restore the
fromTypesconfiguration with proper monorepo paths (project root and tsconfig.dts.json), or document that type-based schema generation is temporarily disabled while OpenAPI documentation remains accessible via runtime schemas. If enabling type-based generation, ensure the backend's tsconfig.json has"declaration": trueand"composite": trueto emit .d.ts files.apps/api/package.json (1)
12-38: LGTM! Dependency updates align with Elysia 1.4 upgrade.All dependency updates are consistent with the PR objectives to upgrade Elysia core and related plugins to v1.4. The migration from
@elysiajs/swaggerto@elysiajs/openapiand the package name correction frombun-typesto@types/bunare appropriate.Also applies to: 41-41
docker-compose.base.yml (1)
6-8: Use stronger default passwords or document security expectations.The default passwords (
supersecret) are weak and hardcoded, violating the coding guideline against hardcoding secrets. While these may be intended for local development, they create security risks if this file is used as a template for other environments.Consider one of these approaches:
- Document that users must override these in a
.envfile before running- Use randomly generated defaults or fail if not set
- Add a security warning comment above these lines
As per coding guidelines.
Also applies to: 18-18
⛔ Skipped due to learnings
Learnt from: CR Repo: fyndx/universal-starter PR: 0 File: .github/copilot-instructions.md:0-0 Timestamp: 2025-09-03T13:07:10.649Z Learning: Applies to **/*.{ts,tsx,js,jsx} : Don't hardcode secrets (API keys/tokens) in source
| import { meRoutes } from "@src/modules/me"; | ||
| import { elysiaLogger } from "@universal/logger"; | ||
| import { Elysia } from "elysia"; | ||
| import path from "path"; |
There was a problem hiding this comment.
Remove unused import.
The path import is only used in the commented-out code block (lines 24-32). Since that code is disabled, this import is unused and should be removed.
As per coding guidelines.
-import path from "path";📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| import path from "path"; |
🤖 Prompt for AI Agents
In apps/api/src/index.ts around line 13, the import "path" is unused (only
referenced in a commented-out block); remove the unused import statement (delete
the import line) and run the project's linter/formatter or import fixer to
update and tidy remaining imports.
…word and remove unused environment variables
coderabbitai
Bot
added
Possible security concern
size:M
User description
Summary by Sourcery
Upgrade Elysia to v1.4, switch to the new OpenAPI plugin, refresh dependencies, and refine server and auth setup
New Features:
Enhancements:
CodeAnt-AI Description
Use OpenAPI docs, log API URL, and mount auth under /auth
What Changed
/auth, and the API now logshttp://localhost:3000/apion startup so developers can hit those endpoints immediately.Impact
✅ Auth endpoints served under /auth✅ Clearer API startup confirmation✅ Ready-to-run Postgres/Redis for local development💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.