chore(release): v0.17.2#207
Conversation
|
Warning Review limit reached
Next review available in: 17 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThe collection snapshot endpoint now authenticates through the web session cookie, adds feature coverage for session and error responses, logs client-side snapshot failures, and updates release metadata to version 0.17.2. ChangesCollection snapshot authentication
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@backend/tests/Feature/Sync/CollectionSnapshotSessionAuthTest.php`:
- Around line 21-30: Extend test_authenticated_session_gets_the_snapshot with
two tenant fixtures and tenant-specific collection data, associating the
authenticated user with one tenant. Assert the response rows and channel contain
only that tenant’s data, matching CollectionController::index behavior, rather
than checking only the JSON structure.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: da300c10-b1aa-4838-a3a5-aa1fed173cc0
⛔ Files ignored due to path filters (1)
desktop/src-tauri/Cargo.lockis excluded by!**/*.lock
📒 Files selected for processing (8)
CHANGELOG.mdbackend/resources/js/lib/realtimeCollection.jsbackend/routes/api.phpbackend/routes/web.phpbackend/tests/Feature/Sync/CollectionSnapshotSessionAuthTest.phpdesktop/package.jsondesktop/src-tauri/Cargo.tomldesktop/src-tauri/tauri.conf.json
| public function test_authenticated_session_gets_the_snapshot(): void | ||
| { | ||
| $user = User::factory()->create(); | ||
|
|
||
| // No Origin / Referer / stateful-domain set — pure session auth, as it | ||
| // would be for any host the deployment is actually served on. | ||
| $this->actingAs($user) | ||
| ->getJson('/api/collections/issue_types') | ||
| ->assertOk() | ||
| ->assertJsonStructure(['rows', 'channel', 'at']); |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Assert tenant isolation, not only response shape.
This test would pass even if the snapshot returned another tenant’s rows or channel. Add a tenant-scoped fixture with two tenants and assert that the authenticated user receives only its tenant’s data, matching CollectionController::index.
As per coding guidelines, new endpoint tests must cover domain edge cases.
🧰 Tools
🪛 PHPStan (2.2.5)
[error] 23-23: Call to an undefined static method App\Models\User::factory().
(staticMethod.notFound)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@backend/tests/Feature/Sync/CollectionSnapshotSessionAuthTest.php` around
lines 21 - 30, Extend test_authenticated_session_gets_the_snapshot with two
tenant fixtures and tenant-specific collection data, associating the
authenticated user with one tenant. Assert the response rows and channel contain
only that tenant’s data, matching CollectionController::index behavior, rather
than checking only the JSON structure.
Source: Coding guidelines
- bundle-resources.sh: replace rsync (absent on Windows git-bash runner) with a portable cp-based copy + storage prune. - mobile/package-lock.json: regenerate in sync with package.json so npm ci passes (was missing @emnapi/*). Both verified locally (npm ci green, bundle produced).
1 participant
v0.17.2
Bundles the pending fixes into a release off
main. Desktop version bumped 0.17.1 → 0.17.2; the build injects the version from thev0.17.2tag.Fixed
GET /api/collections/{name}now authenticates via the plain web session cookie (web route group) instead of Sanctum stateful-domain matching, so admin lists load on any host / behind any reverse proxy. Client logs a console warning on snapshot failure instead of failing silently.Changed
After merge
main(admin — branch protection).v0.17.2on the merge commit and push → triggers the release build (web ZIP + desktop win/mac/linux + apk).Full suite green (1925). Closes #203.
🤖 Generated with claude-flow
Summary by CodeRabbit