Conversation
apps/web/privacy：說明訪客模式本機資料、登入後透過 Clerk 蒐集的資料範圍、 第三方服務商（Clerk/Supabase/Vercel）、刪除帳號效果、App 權限用途， 使用者已在本機確認內容無誤。 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- 建立 EAS 專案並連結 app.json（extra.eas.projectId） - 新增 eas.json：development/preview/production build profile， preview/production 指向正式後端 https://easy-learn-inky.vercel.app - 加上 android.versionCode，production profile 開 autoIncrement - expo-image-picker 明確關閉 cameraPermission/microphonePermission， 避免預設帶入用不到的 RECORD_AUDIO/CAMERA 權限 - .gitignore 排除 google-play-service-account.json Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
apps/web 的 postinstall（prisma generate）會在任何一次 repo 根目錄的
yarn install 被觸發（Yarn 1 workspaces 對所有 workspace 一起跑
postinstall），即使只是要裝 apps/mobile 的依賴。prisma.config.ts 用
@prisma/config 的 env('DIRECT_URL') 讀不到就直接 throw，導致 EAS Build
（只建置 mobile，本來就不會有 apps/web 的資料庫連線字串）在
INSTALL_DEPENDENCIES 階段整個失敗。
改成直接讀 process.env.DIRECT_URL，讀不到時退回一個不會真的連線的假字串
——prisma generate 本身不需要真的連得上資料庫，只有 prisma migrate／正式
執行期的 @prisma/client 才需要真正有效的連線字串，那些情境本來就會有
apps/web 自己的 .env.local 或 Vercel 環境變數，不受這個 fallback 影響。
已用 env -i（清空所有環境變數＋暫時移開 .env）模擬 EAS Build 的環境，
確認 prisma generate 不再因缺 DIRECT_URL 而失敗；apps/web 的
typecheck/build 在正常環境下仍全部通過。
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Warning Review limit reached
Next review available in: 49 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughAdds mobile Android/EAS release configuration, makes Prisma generation tolerate a missing ChangesMobile release configuration
Prisma configuration
Privacy policy route
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
apps/web/src/app/privacy/page.tsx (2)
7-7: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueConsider extracting the contact email to an environment variable.
The personal Gmail address
112182ssss@gmail.comis hardcoded in the source. For maintainability and to allow changing the contact address without a code change, consider reading it from an environment variable (e.g.,process.env.NEXT_PUBLIC_CONTACT_EMAIL). This also makes it easier to use a custom domain email in the future.♻️ Suggested refactor
-const CONTACT_EMAIL = '112182ssss@gmail.com' +const CONTACT_EMAIL = process.env.NEXT_PUBLIC_CONTACT_EMAIL ?? '112182ssss@gmail.com'🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@apps/web/src/app/privacy/page.tsx` at line 7, Update the CONTACT_EMAIL constant to read from the NEXT_PUBLIC_CONTACT_EMAIL environment variable instead of hardcoding the Gmail address, while preserving an appropriate fallback only if the existing behavior requires one.
66-66: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winAdd
noopenerto external linkrelattributes.All three external links use
rel="noreferrer"but omitnoopener. While modern browsers implynoopenerwhennoreferreris set, explicitly including both is the recommended best practice for defense-in-depth against reverse tabnabbing.🔒️ Proposed fix
- <a href="https://clerk.com/legal/privacy" target="_blank" rel="noreferrer"> + <a href="https://clerk.com/legal/privacy" target="_blank" rel="noopener noreferrer">- <a href="https://supabase.com/privacy" target="_blank" rel="noreferrer"> + <a href="https://supabase.com/privacy" target="_blank" rel="noopener noreferrer">- <a href="https://vercel.com/legal/privacy-policy" target="_blank" rel="noreferrer"> + <a href="https://vercel.com/legal/privacy-policy" target="_blank" rel="noopener noreferrer">Also applies to: 72-72, 78-78
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@apps/web/src/app/privacy/page.tsx` at line 66, Update all three external links in the privacy page, including the links near the Clerk privacy, terms, and contact references, so their rel attributes explicitly include both noreferrer and noopener. Preserve the existing target="_blank" behavior and link destinations.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/mobile/eas.json`:
- Around line 21-27: Update the production profile in eas.json so
EXPO_PUBLIC_CLERK_PUBLISHABLE_KEY uses the Clerk production pk_live_ value
instead of the preview/test pk_test_ value, while leaving the preview profile
unchanged.
---
Nitpick comments:
In `@apps/web/src/app/privacy/page.tsx`:
- Line 7: Update the CONTACT_EMAIL constant to read from the
NEXT_PUBLIC_CONTACT_EMAIL environment variable instead of hardcoding the Gmail
address, while preserving an appropriate fallback only if the existing behavior
requires one.
- Line 66: Update all three external links in the privacy page, including the
links near the Clerk privacy, terms, and contact references, so their rel
attributes explicitly include both noreferrer and noopener. Preserve the
existing target="_blank" behavior and link destinations.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 47f3ec3c-409f-4645-8f47-a06675c78cf2
📒 Files selected for processing (5)
apps/mobile/.gitignoreapps/mobile/app.jsonapps/mobile/eas.jsonapps/web/prisma.config.tsapps/web/src/app/privacy/page.tsx
| "production": { | ||
| "autoIncrement": true, | ||
| "env": { | ||
| "EXPO_PUBLIC_API_BASE_URL": "https://easy-learn-inky.vercel.app", | ||
| "EXPO_PUBLIC_CLERK_PUBLISHABLE_KEY": "pk_test_Z29sZGVuLWxhYi00OC5jbGVyay5hY2NvdW50cy5kZXYk" | ||
| } | ||
| } |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Production build uses a Clerk test publishable key.
The production profile sets EXPO_PUBLIC_CLERK_PUBLISHABLE_KEY to a pk_test_ key (line 25), identical to the preview profile (line 18). Production builds should use a pk_live_ key so authentication routes through Clerk's production environment, not the test environment.
🔐 Suggested fix
"production": {
"autoIncrement": true,
"env": {
"EXPO_PUBLIC_API_BASE_URL": "https://easy-learn-inky.vercel.app",
- "EXPO_PUBLIC_CLERK_PUBLISHABLE_KEY": "pk_test_Z29sZGVuLWxhYi00OC5jbGVyay5hY2NvdW50cy5kZXYk"
+ "EXPO_PUBLIC_CLERK_PUBLISHABLE_KEY": "pk_live_YOUR_LIVE_CLERK_PUBLISHABLE_KEY"
}
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "production": { | |
| "autoIncrement": true, | |
| "env": { | |
| "EXPO_PUBLIC_API_BASE_URL": "https://easy-learn-inky.vercel.app", | |
| "EXPO_PUBLIC_CLERK_PUBLISHABLE_KEY": "pk_test_Z29sZGVuLWxhYi00OC5jbGVyay5hY2NvdW50cy5kZXYk" | |
| } | |
| } | |
| "production": { | |
| "autoIncrement": true, | |
| "env": { | |
| "EXPO_PUBLIC_API_BASE_URL": "https://easy-learn-inky.vercel.app", | |
| "EXPO_PUBLIC_CLERK_PUBLISHABLE_KEY": "pk_live_YOUR_LIVE_CLERK_PUBLISHABLE_KEY" | |
| } | |
| } |
🧰 Tools
🪛 Betterleaks (1.6.0)
[high] 25-25: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@apps/mobile/eas.json` around lines 21 - 27, Update the production profile in
eas.json so EXPO_PUBLIC_CLERK_PUBLISHABLE_KEY uses the Clerk production pk_live_
value instead of the preview/test pk_test_ value, while leaving the preview
profile unchanged.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
1 participant
Summary by CodeRabbit