Repository navigation
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Updates to Preview Branch (eng-2418-update-libraries-talking-with-external-tools) ↗︎
Tasks are run on every commit but only new migration files are pushed.
View logs for this Workflow Run ↗︎. |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
There was a problem hiding this comment.
Devin Review found 4 potential issues.
1 flag not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)
| if (!userResponse.data.user) | ||
| userResponse.error = new AuthError("Did not create user"); |
There was a problem hiding this comment.
🟡 Duplicate group names return server errors
When createUser rejects an existing group name, userResponse.error loses its email_exists code. The duplicate-name request returns 500 instead of the expected 400.
| if (!userResponse.data.user) | |
| userResponse.error = new AuthError("Did not create user"); | |
| if (!userResponse.data.user && !userResponse.error) | |
| userResponse.error = new AuthError("Did not create user"); |
Was this helpful? React with 👍 or 👎 to provide feedback.
| join(projectRoot, "src", "dbTypes.ts"), | ||
| "// Generated by supabase -- do not edit\n" + stdout, | ||
| ); | ||
| execSync("oxfmt ./src/dbTypes.ts"); |
There was a problem hiding this comment.
🟡 Generated types conflict with repository formatter
Every gentypes run applies oxfmt, but the required formatter is Prettier. Their output differs, so generation and repository formatting repeatedly rewrite the generated types.
Learn more
The generator writes the database type file, then formats it with oxfmt. The repository's format script and pre-commit formatter use Prettier. The generated Json union already differs from the prior Prettier-formatted form, so running the standard formatter after generation rewrites the result.
Example: A developer runs pnpm gentypes and commits the output. Running pnpm format changes the generated file again without changing the schema.
Recommended fix: Use the repository's Prettier formatter in genTypes, with the same configuration as the root format command, and regenerate the committed types.
Was this helpful? React with 👍 or 👎 to provide feedback.
| ); | ||
| } | ||
| const token = authHeader.replace("Bearer ", ""); | ||
| console.log(Authorization, apikey, token); |
There was a problem hiding this comment.
🟥 Space creation logs live credentials
Every create-space request logs Authorization, apikey, and token in plaintext. Anyone with log access can reuse a logged bearer token to impersonate its user.
Was this helpful? React with 👍 or 👎 to provide feedback.
| const Authorization = req.headers.get("Authorization") as string | undefined; | ||
| const apikey = req.headers.get("apikey") as string | undefined; | ||
|
|
||
| const token = Authorization?.replace("Bearer ", "") ?? apikey; |
There was a problem hiding this comment.
🟥 Public API key can create spaces
Without Authorization, create-space accepts apikey as token. A public publishable key passes the read probe, then the service-role client creates a space and editor account.
Was this helpful? React with 👍 or 👎 to provide feedback.
This branch was successfully deployed
1 participant
Reviewer brief
Verification
Loom video
Scope check
$scope-checkagainst the ENG ticket and final diff.Done When:Standards check
$dg-pr-adherence-checkagainst the final diff and PR metadata.Local delegated full review
$dg-delegated-full-reviewwhen no other full-review workflow is available.https://linear.app/discourse-graphs/issue/ENG-2418/update-libraries-talking-with-external-tools