Add product API + permissions, tighten auth/cors/cookie handling, and wire up route rate limits - #25
Add product API + permissions, tighten auth/cors/cookie handling, and wire up route rate limits#25rujealfon wants to merge 15 commits into
Conversation
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d8cd5ef2e1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d8cd5ef2e1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…igration-issue Backfill product permissions for existing roles
|
@codex code review and fix all issue from the comments |
|
Summary
Testing
|
Refactor Claude Code Review workflow to trigger on issue comments and…
…hance health controller memory usage reporting; adjust auth test to use Bearer token; modify user test to allow non-admin account deletion.
|
@codex code review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0e7021395f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: feb8b9e713
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ff78168a16
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex code review |
|
Codex Review: Didn't find any major issues. What shall we delve into next? Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex security code review |
|
Codex Review: Didn't find any major issues. Nice work! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex code review |
|
Codex Review: Something went wrong. Try again later by commenting “@codex review”. ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex code review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a5a6ef8be6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
|
Codex Review: Didn't find any major issues. Nice work! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex code review |
|
Codex Review: Didn't find any major issues. Bravo. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
1 participant
Motivation
productsAPI surface with permission-based access control and seed permissions so product management can be controlled by roles.COOKIE_SECRETin production, and protect mobile login with a timing-safe API key check.Description
productpermission strings toPERMISSIONSand updated DB seeds insrc/db/seed.tsto include product CRUD permissions and map them to roles.productscontract schemas insrc/contract/schemas/products.tsand updated related contract files to inline Zod schemas for consistency and remove cross-file schema imports.RouteSchema/RouteMaptypes to support arateLimitconfig and plumbed per-route rate limiting into the RPC router insrc/plugins/rpc.tswithconfig: { rateLimit }.signed: trueand updatedjwtplugin toexpiresIn: '15m'; cookie plugin now enforcesCOOKIE_SECRETlength in production and usesCOOKIE_SECRET || JWT_SECRETfor signing; cookie handling in auth routes usessigned: trueandextractTokenFromCookiein tests decodes signed cookies.assertMobileApiKeywhich usestimingSafeEqualto compare theX-Mobile-API-Keyheader and added the header to CORSallowedHeaders.CORS_ORIGINSenv var and plugin logic to parse a comma-separated allow-list and require at least one origin in production.development, changed the rate-limitkeyGeneratorto use the request IP (removedx-forwarded-forusage), and registeredrateLimitPluginearlier insrc/app.ts./health/detailsnow requires authentication and theaudit-log:read:anypermission and has documentation updated.src/tests/modules/health.test.ts, updatedproducts/permissions/userstests to reflect permission changes and new product behavior, and updated test fixture cookie extraction to handle signed cookies.Testing
vitest(via the project test runner); all tests (including newhealth.test.tsand updatedproducts/permissions/userstests) completed successfully.Codex Task