Fix code issues - #12
Conversation
|
/opencode fix the Dependabot vulnerability |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bdee92ed30
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| return createClient(url, anonKey); | ||
| } | ||
| export function createClient() { |
There was a problem hiding this comment.
When this replacement lands, existing modules still import getBrowserSupabase (src/app/auth/page.tsx and src/lib/database/missions.ts; searched repo-wide for getBrowserSupabase). Those routes/features will fail to build/load because this file no longer exports the symbol, so keep a compatibility export or update all callers in the same change.
Useful? React with 👍 / 👎.
| } = await supabase.auth.getUser(); | ||
|
|
||
| // If no user and trying to access protected route, redirect to login | ||
| if (!user && !request.nextUrl.pathname.startsWith("/login")) { |
There was a problem hiding this comment.
With the matcher covering /signup, this condition only exempts /login, so an unauthenticated user clicking the new login-page /signup link is immediately redirected back to /login before the signup page can render. That prevents new users from creating accounts unless they already have a session; add /signup to the public-route check.
Useful? React with 👍 / 👎.
| const supabase = createServerClient( | ||
| process.env.NEXT_PUBLIC_SUPABASE_URL!, | ||
| process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!, |
There was a problem hiding this comment.
In environments before Supabase keys are configured, this middleware still runs on every non-static request and passes undefined env values into createServerClient, which makes the app fail before pages like settings/auth can show the existing “missing Supabase keys” guidance. Since the repo still has explicit missing-key UI and fallback behavior, skip auth middleware or return NextResponse.next() until both public keys are present.
Useful? React with 👍 / 👎.
| @@ -0,0 +1 @@ | |||
| Subproject commit d4c373f380a5c16899021fe52828066029809197 | |||
There was a problem hiding this comment.
This commit adds ai-engineering-platform and ai-engineering-platform - Copy as gitlink/submodule entries but does not add a .gitmodules mapping; after this change, git submodule status fails with no submodule mapping found in .gitmodules for path 'ai-engineering-platform'. Anyone using submodule-aware checkout/update commands will hit that repository error, so remove the accidental nested gitlinks or add proper submodule metadata.
Useful? React with 👍 / 👎.
| process.env.NEXT_PUBLIC_SUPABASE_URL!, | ||
| process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY! |
There was a problem hiding this comment.
In local/demo environments where NEXT_PUBLIC_SUPABASE_URL or NEXT_PUBLIC_SUPABASE_ANON_KEY is not configured, this now passes undefined into createBrowserClient instead of returning null like the previous helper. The new /login and /signup pages call createClient() during render, so even after the middleware is bypassed those public auth pages can crash instead of showing the repo's existing missing-key guidance.
Useful? React with 👍 / 👎.
| setError(error.message); | ||
| setLoading(false); | ||
| } else { | ||
| router.push("/"); |
There was a problem hiding this comment.
When Supabase email confirmation is enabled, signUp can succeed without creating a session, but this branch immediately sends the user to the protected home page. The middleware then redirects them back to /login with no indication that they need to confirm their email, so the signup flow looks like it silently failed; keep them on the page with a confirmation message or route them to an explicit check-email state.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: db01315c10
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| import { cookies } from "next/headers"; | ||
|
|
||
| export function createClient() { | ||
| const cookieStore = cookies(); |
There was a problem hiding this comment.
This repo pins Next 16.2.10, where cookies() from next/headers is async. As written, cookieStore is the unresolved Promise, so the first server-side use of this helper will call getAll/set on a Promise inside the Supabase cookie adapter and fail before authenticated server reads can complete; make createClient async and await cookies() before wiring the adapter.
Useful? React with 👍 / 👎.
|
|
||
| export const config = { | ||
| matcher: [ | ||
| "/((?!_next/static|_next/image|favicon.ico|.*\\.(?:svg|png|jpg|jpeg|gif|webp)$).*)", |
There was a problem hiding this comment.
This matcher also runs the auth redirect on /api/mission/generate, while src/app/missions/new/page.tsx fetches that route and immediately parses JSON. If a session expires while the form is open, or an API client posts without a session, the request gets a redirect/login response instead of JSON, so mission creation throws and stays in the loading path; exclude API routes from this page redirect or return a 401 JSON response for them.
Useful? React with 👍 / 👎.
Shakeyswings
left a comment
Shakeyswings
left a comment
There was a problem hiding this comment.
4 files from beer spillage... Deleted from my phone
…s, await cookies, fix middleware logic, add compatibility exports
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f884527a98
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| setLoading(true); | ||
| setError(""); | ||
|
|
||
| const { error } = await supabase.auth.signInWithPassword({ |
There was a problem hiding this comment.
Fresh evidence after the missing-key fallback fix: createClient() now returns null when NEXT_PUBLIC_SUPABASE_URL or NEXT_PUBLIC_SUPABASE_ANON_KEY is absent, but this login handler still dereferences it. Submitting /login in the local/demo missing-key state throws before the page can show an error, unlike /signup which already guards this case; add the same null check here.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c86c899fe6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| import Dashboard from "@/components/dashboard/Dashboard"; | ||
|
|
||
| export default function Home() { | ||
| export default function Home) |
There was a problem hiding this comment.
This change leaves the root page as invalid TSX: export default function Home) is missing the parameter list braces and function body opener, so compiling or serving / fails before the dashboard can render. The parent had a valid Home() { ... } component, so restore the function declaration and closing brace.
Useful? React with 👍 / 👎.
| if (request.nextUrl.pathname.startsWith("/api/")) { | ||
| // Let the API route handle auth via createServerClient | ||
| return NextResponse.next({ request }); |
There was a problem hiding this comment.
In deployments with OPENAI_API_KEY configured, this makes every /api/* request skip the only new auth check, but I checked src/app/api/mission/generate/route.ts and it does not authenticate before calling client.responses.create. That leaves the paid mission-generation endpoint callable by unauthenticated clients even though the pages are protected, so either enforce a JSON 401 here or add equivalent auth inside the route before bypassing middleware redirects.
Useful? React with 👍 / 👎.
|
|
||
| // If no user and trying to access protected route, redirect to login | ||
| // But allow signup page for unauthenticated users | ||
| if (!user && !request.nextUrl.pathname.startsWith("/login") && !request.nextUrl.pathname.startsWith("/signup")) { |
There was a problem hiding this comment.
This commit still edits and ships src/app/auth/page.tsx, but the new middleware only treats /login and /signup as public. A signed-out user who opens the existing /auth sign-in/sign-up page now gets redirected to /login, making that route's auth UI unreachable unless the user is already authenticated; either add /auth to the public-route check or remove/update the legacy route intentionally.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b3d4984516
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| <StatusIndicator status="96% success ra-[; | ||
| mjku . te" tone="info" /> |
There was a problem hiding this comment.
When the dashboard renders, this prop displays 96% success ra-[; mjku . te instead of the success-rate label, exposing accidental text on the primary MVP dashboard and making the status metric unreadable. Restore the intended 96% success rate text.
AGENTS.md reference: AGENTS.md:L25-L27
Useful? React with 👍 / 👎.
| <div> | ||
| <h3 className="mb-6 text-[24px] font-semibold leading-[1.3]">Active Missions</h3> | ||
| <div className="grid gap-6 md:grid-cols-2 2xl:grid-cols-3"> | ||
| <div className="grid gap-6 md:grid-cols-2 2xl:grid-cols-3">NM |
There was a problem hiding this comment.
When the Active Missions section renders, the literal NM is emitted as a visible text node immediately before the mission cards. Remove this accidental text so the primary dashboard does not show unexplained characters.
AGENTS.md reference: AGENTS.md:L25-L27
Useful? React with 👍 / 👎.
| // But allow signup page for unauthenticated users | ||
| if (!user && !request.nextUrl.pathname.startsWith("/login") && !request.nextUrl.pathname.startsWith("/signup")) { | ||
| const url = request.nextUrl.clone(); | ||
| url.pathname = "/login"; |
There was a problem hiding this comment.
When a signed-out user opens a protected deep link such as /missions/new, this redirect replaces the pathname without recording the original destination, and src/app/login/page.tsx always pushes to / after authentication. The user therefore loses the mission route they intended to open and must navigate back manually; include a validated return path and consume it after login.
AGENTS.md reference: AGENTS.md:L25-L28
Useful? React with 👍 / 👎.
1 participant
Explain what you fixed