Repository navigation
Add scoped Crawl and Mercure subscription services - #8
Conversation
|
@codex review |
|
@codex security review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c3a65bfd5c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
|
@codex security review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2f14d557bd
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
@codex review |
|
@codex security review |
|
Codex Review: Didn't find any major issues. Can't wait for the next one! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
Promote the archive and Mercure service foundation from `dev` into `master`, the repository's default branch. Included work from #8: - Add scoped Chess-Crawl archive, run and job reads, plus budgeted collection submissions with stable idempotency keys. - Add short-lived Mercure subscriber grants for exact authorized topics, event validation, and revision/reconnect handling based on authoritative API snapshots. - Document local credentials, workspace authorization and integration requirements; update Mercure runtime configuration and CI coverage. UX design and browser/Live Component/Turbo wiring remain open. The existing preview does not call the new services. SaaS exposure requires an authenticated app-user-to-workspace resolver. Validation: - [CI passed on the current dev commit](https://github.com/xormania/chess-dog/actions/runs/37250429470) (`3c90aa2e81bd77b9cdb060eb5255f7f4525b837a`). - Source PR #8 records 29 unit/existing functional tests with 136 assertions, Symfony YAML/container lint, Composer strict validation and dependency audit, and native Mate service checks. - At preparation, `dev` is 5 commits ahead of `master`, with no commits behind, across 30 changed files. Draft for maintainer review; PR CI runs through the existing workflow.
1 participant
Chess Dog needs a trusted service boundary to Chess-Crawl before its player workflows and Live/Turbo components are designed. This adds server-side archive reads, scoped run/job reads, and explicitly budgeted collection submissions with stable idempotency keys. Rich archive reads verify the configured token-to-workspace binding before fetching private observations.
Mercure Bundle supplies five-minute, subscriber-only JWTs for exact authorized run/job topics. Browser-safe connection options exclude credentials; cookies are HttpOnly, host-only, same-origin and HTTPS Secure. Validated JSON event identities feed snapshot-authoritative revision/reconnect decisions. Documentation explains local configuration and the authenticated app-user-to-workspace resolver needed for SaaS. UX design and browser/component wiring remain open; no templates, controllers, routes, styles or navigation change.
Validation: 29 unit/existing functional tests, 136 assertions; Symfony YAML/container lint; Composer strict validation and dependency audit; native Mate confirms PHP 8.5.11 and service wiring with secrets redacted. Independent scope/security review fixes are included, including rich-player credential binding and nullable retry timestamps in normal job events.
Integration limits: targets the companion workspace-scoped Crawl API. The local configured authority is not app-user authentication. Subscriber signing uses the hub's separate HMAC subscriber key and a same-origin proxy. No application subscriber route or arbitrary HTML publication is introduced. Live Components and Turbo are already installed; the Flowbite subscription can support the later UX work.