You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
로컬 E2E는 Chromium을 실행했습니다. Firefox·WebKit은 이번 검증 범위에 포함하지 않았습니다.
셀프 리뷰
발견한 문제는 후속 커밋으로 수정했습니다.
확인한 문제
반영 내용
DB CLI가 환경을 명시하지 않아도 운영 환경 파일을 선택함
개발 환경을 기본값으로 지정하고, 별도 프로세스에서 환경 선택을 검증
Node 타입의 자동 메이저 업데이트가 런타임 정책과 충돌함
Dependabot에서 해당 패키지의 메이저 업데이트만 제외하고 계약 테스트 추가
캐시 전환 시 Proxy가 App Router 전용 locale 코드를 가져옴
순수 routing 설정과 navigation API를 분리하고 경계 테스트 추가
의존성의 Vite·esbuild·selector parser 취약점
Vite 갱신 및 필요한 상위 패키지에 한정한 override 적용, 전체 audit와 실제 빌드·DB 명령 재검증
Typography는 최신 버전도 취약한 parser를 고정하므로 해당 경로만 6.1.6으로 올렸습니다. 근거: GHSA-rj75-hqrm-r3gf. Drizzle의 이전 loader 경로도 override 범위를 제한했으며 상위 패키지 갱신 시 제거 여부를 검토해야 합니다.
저장소 스타일과 아키텍처 경계를 확인했습니다.
셀프 리뷰와 발견 사항 수정을 완료했습니다.
환경 변수·인증·DB·검증 문서를 갱신했습니다.
회귀 테스트와 전체 로컬 검증을 완료했습니다.
최종 코드 검토와 병합 여부 판단은 요청하신 대로 사용자에게 남깁니다.
Summary by CodeRabbit
New Features
Added account registration, sign-in, optional Google sign-in, personalized dashboards, and profile updates.
Added persistent PostgreSQL-backed accounts and sessions, with local database setup guidance.
Improved localized navigation and validation for English and Korean pages.
Bug Fixes
Added request-size limits and clearer handling of invalid or unexpected API responses.
Improved protection for profile access, sign-out, and user-specific dashboard content.
Documentation
Updated setup, authentication, environment, database, and testing guidance.
Tests
Expanded coverage for authentication, profile flows, localization, and request handling.
No actionable comments were generated in the recent review.
Walkthrough
The pull request replaces mock authentication and user data with Better Auth and PostgreSQL-backed sessions. It adds registration and profile flows, request and environment validation, localized route handling, and updates CI, test, and workspace configuration.
Changes: Authentication and web API
Layer / File(s)
Summary
Database schema and environment compose.yaml, apps/web/drizzle/*, apps/web/src/config/env.ts, apps/web/src/lib/db.ts, .env.example
Adds a PostgreSQL service, Drizzle auth tables and migrations, a shared database client, and production environment validation.
Authentication service and sessions apps/web/src/modules/auth/server/*, apps/web/src/app/api/auth/*, apps/web/src/proxy.ts
Replaces NextAuth and mock auth routes with Better Auth handlers, session helpers, and cookie-based proxy checks.
Localized account and dashboard flows apps/web/src/modules/auth/components/*, apps/web/src/app/[locale]/*, apps/web/src/i18n/*
Adds registration and updates login, sign-out, dashboard, and locale handling to use translated, locale-aware flows.
Authenticated APIs and HTTP safeguards apps/web/src/app/api/v1/users/*, apps/web/src/lib/http/*
Requires authentication for user endpoints, restricts profile updates to the matching user, limits request bodies to 64 KiB, and validates API response envelopes.
Web integration and validation .github/workflows/*, apps/web/e2e/*, apps/web/src/test/*, apps/web/next.config.ts, README.md, package.json, pnpm-workspace.yaml, turbo.json
Updates CI and Playwright for PostgreSQL-backed production-server tests; adds coverage for auth, locale, environment, and workflow behavior; updates framework, package, and setup documentation.
Utility object handling
Layer / File(s)
Summary
Safe object operations and tests packages/utils/src/object.ts, packages/utils/src/object.test.ts, packages/utils/vitest.config.ts, packages/utils/package.json
Deep merge and nested-path updates reject prototype-related keys and use own properties. Tests cover these rules and object cloning.
Calendar component extraction
Layer / File(s)
Summary
Calendar components and regression test packages/ui/src/components/calendar.tsx, apps/web/src/test/calendar.test.tsx
Extracts named calendar components without changing their described markup or behavior, and adds a focus-retention test.
sequenceDiagram
participant Browser
participant NextApp as Next.js app
participant BetterAuth as Better Auth
participant PostgreSQL
Browser->>NextApp: Submit registration or login
NextApp->>BetterAuth: Forward auth request
BetterAuth->>PostgreSQL: Store or retrieve account and session
PostgreSQL-->>BetterAuth: Return account and session data
BetterAuth-->>Browser: Return response and session cookie
Browser->>NextApp: Request localized dashboard
NextApp->>BetterAuth: Retrieve session
BetterAuth-->>NextApp: Return session data
NextApp-->>Browser: Render personalized dashboard
Loading
Merge Risk: Minimal · up to 65696
The change moves authentication to PostgreSQL-backed sessions with server-side ownership checks, and no concrete merge-blocking problem remains. One minor edge case exists: multi-host PostgreSQL connection strings are rejected at startup, and a single-host URL works.
Pre-merge checks: 4
Check name
Status
Explanation
Title check
The title is in Korean and reads 'Update auth, cache, and dev tools to v0.4.0' under the feat(starter) scope. It names the main change: the demo auth is replaced with PostgreSQL-backed Better Auth acc…
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Description check
The PR description is written in Korean and is detailed. It covers the change summary (Better Auth/Drizzle/PostgreSQL migration, caching split, tooling updates, CI hardening), compatibility changes, v…
Full details: Title check
Explanation
The title is in Korean and reads 'Update auth, cache, and dev tools to v0.4.0' under the feat(starter) scope. It names the main change: the demo auth is replaced with PostgreSQL-backed Better Auth accounts and sessions, the cache and per-user rendering are separated, and dev tooling and libraries are updated. The version bump to 0.4.0 is also in the changeset (package.json 0.3.7 to 0.4.0). The title is specific and is not vague.
Full details: Description check
Explanation
The PR description is written in Korean and is detailed. It covers the change summary (Better Auth/Drizzle/PostgreSQL migration, caching split, tooling updates, CI hardening), compatibility changes, verification steps with results, and a self-review table. The template's required sections are present in substance: Description is filled in, and the Checklist is ticked. Related Issues is missing; the template expects a 'Closes #<issue_number>' line, and the description does not include one. The Screenshots section is not addressed, but it is marked 'if applicable' and the change is mostly backend and tooling. Additional Notes is covered by the compatibility and verification sections. The PR description does not follow the template's exact headings. It uses '변경 내용', '호환성 변경', '검증', '셀프 리뷰' instead of 'Description', 'Related Issues', 'Checklist', 'Screenshots', and 'Additional Notes'. Overall the description is mostly complete, so it passes, though the missing related-issue reference and the non-template headings are worth noting.
Finishing Touches
Generate unit tests (beta)
Commit to this branch
Create a new PR
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
변경 내용
데모 인증을 실제 PostgreSQL 계정·세션으로 바꾸고, 공개 화면의 캐시와 사용자별 서버 렌더링을 분리했습니다. 보일러플레이트 버전은
0.3.7 → 0.4.0으로 제안합니다. 요청하신 5번 OpenTelemetry 도입은 제외했습니다.기능별 커밋과
chore(bump): v0.4.0커밋을 분리했습니다. 이 PR에서는 병합, 태그 생성·푸시, Release 발행을 진행하지 않습니다.호환성 변경
.env.example을apps/web/.env.local로 복사한 뒤docker compose up -d,pnpm db:migrate를 실행합니다. 운영 환경에는AUTH_SECRET(32자 이상),AUTH_URL,DATABASE_URL이 필수입니다./api/auth/*의 Better Auth 계약을 따릅니다. 그 외 앱 API의data/error형식은 유지합니다./api/v1/users는 로그인한 본인 정보만 반환합니다. 개별 사용자 API는 본인 조회와 이름 수정만 허용하며, mock 생성·삭제 API를 제거했습니다.검증
24.18.0, pnpm11.21.0pnpm install --frozen-lockfile,pnpm lint: 통과, 진단 없음pnpm exec turbo run check-types --force: 통과pnpm exec turbo run test --force: 웹 56개 + 유틸리티 10개 통과pnpm exec turbo run build --force: 통과, 공개 홈은 정적 생성·대시보드는 부분 사전 렌더링pnpm db:generate,pnpm db:migrate: 실제 PostgreSQL에서 통과, 반복 마이그레이션도 확인docker compose config --quiet, Turbopackanalyze --output: 통과pnpm audit: 운영·개발 의존성 전체에서 알려진 취약점 0건verify와e2e모두 통과로컬 E2E는 Chromium을 실행했습니다. Firefox·WebKit은 이번 검증 범위에 포함하지 않았습니다.
셀프 리뷰
발견한 문제는 후속 커밋으로 수정했습니다.
Typography는 최신 버전도 취약한 parser를 고정하므로 해당 경로만
6.1.6으로 올렸습니다. 근거: GHSA-rj75-hqrm-r3gf. Drizzle의 이전 loader 경로도 override 범위를 제한했으며 상위 패키지 갱신 시 제거 여부를 검토해야 합니다.최종 코드 검토와 병합 여부 판단은 요청하신 대로 사용자에게 남깁니다.
Summary by CodeRabbit