fix: promote self-host isolation without changing hosted behavior - #826
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository UI Review profile: ASSERTIVE Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
The latest updates on your projects. Learn more about Unkey Deploy
|
* fix(slack): keep components with streamed responses * test(slack): use concrete response argument types * refactor(slack): use native block and button types
The wiring rule now resolves each script's directory, glob, and explicit-file arguments (honoring --path-ignore-patterns and runner-only invocations) instead of accepting any test script, so a file left out of an explicit enumeration like packages/rpc or an insights integration chain is reported. Widens the scratch-port check to all five-digit loopback ports, runs the policy pre-commit for test files and package manifests, and simplifies package discovery.
Bumps [@slack/web-api](https://github.com/slackapi/node-slack-sdk) from 7.17.0 to 8.1.1. - [Release notes](https://github.com/slackapi/node-slack-sdk/releases) - [Commits](https://github.com/slackapi/node-slack-sdk/compare/@slack/web-api@7.17.0...@slack/web-api@8.1.1) --- updated-dependencies: - dependency-name: "@slack/web-api" dependency-version: 8.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…abled The ported ClickHouse suites lost their scratch-port guards and would insert, delete, and create tables on whatever CLICKHOUSE_URL is set; the client now throws under CLICKHOUSE_INTEGRATION_TESTS unless the host is loopback. Moves the ai retention suite onto the shared client (fixing 404s when CLICKHOUSE_URL carries a database path), gives the cohort cleanup hook a real timeout, and ports the last scratch-port case in packages/ai to the shared test database.
autumn-js rebuilds every proxied body with sanitizeBody, which drops metadata along with the customer identity fields, so neither the Dub customer id nor the existing revenue attribution keys ever reached the checkout session. Authenticated attach calls now go straight to the SDK with the billing owner and merged metadata, mirroring the handler's error shape.
* fix(dashboard): reject blank feature flag targets * test(dashboard): derive flag targeting inputs from tool schema
* fix(slack): give suggested actions unique button IDs * docs(slack): note root SDK version overrides * fix(slack): share the drilldown action ID prefix
#833) * feat(rpc): retain business research and unanswered questions * fix(rpc): keep research tied to explicitly selected drafts * feat(dashboard): show research results and team follow-up questions * feat(api): report business context research coverage * test(dashboard): verify research states and document QA * test(dashboard): guard business context fixture state --------- Co-authored-by: Issa Nassar <iza@192.168.1.90>
 |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| customerId: string | ||
| ): Promise<Response> { | ||
| try { | ||
| const result = await getAutumn().billing.attach({ |
There was a problem hiding this comment.
Authenticated checkout now uses the default Autumn client. That client can accept an unconfirmed 202 response and uses the SDK's default retry and fail-open behavior, so the code may report a successful attachment and invalidate cached customer data without a confirmed purchase. This financial mutation should use the existing strict client.
| const result = await getAutumn().billing.attach({ | |
| const result = await getAutumn({ strict: true }).billing.attach({ |
Knowledge Base Used: Billing and entitlements
|
|
||
| async function attachWithDubCustomer( | ||
| request: Request, | ||
| body: Record<string, unknown>, |
There was a problem hiding this comment.
The new attach boundary declares its payload as Record<string, unknown> and then casts it to the SDK type. The repository requires explicit types instead of any, unknown, or never; the same new pattern also appears in the attach test. Please parse or type this payload against the available AttachParams contract before merging.
Context Used: Basic guidelines for the project so vibe coders don't fuck it up (source)
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
| @@ -9,11 +9,9 @@ | |||
| "check-types": "tsc --noEmit", | |||
| "test": "bun test --isolate --path-ignore-patterns='test/e2e/**' .", | |||
There was a problem hiding this comment.
Removing the smoke suite also removes the only browser coverage found for authenticated-session bootstrap, unauthenticated route protection, sign-out protection, and persisted profile edits. The full Playwright suite can now pass while these core auth and account journeys are broken. This is non-blocking, but these scenarios should be moved into the regression or core suite before the smoke tests are deleted.
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
1 participant
Summary
Promote #825 from staging to preserve hosted behavior with
SELFHOSTunset or false. The changes restore hosted auth cookies and verification emails, alarm senders, registration, setup snippets/prompts, and CSP while retaining the self-host improvements behindSELFHOST=true. Boolean-only mode checks no longer initialize unrelated URL configuration.#789 merged at 09:27 UTC on September 17, before #825 landed at 09:44 UTC. This follow-up contains only #825 (
9cf89be0c982ab81f2688fcd0e90fcb8d93c9177) at creation. Independent init-image publishing (#824) is already included in #789.Validation
This draft prepares the production follow-up; it does not deploy or publish images. Recheck final promotion-head CI and review and obtain the required main-branch approval before merging. Existing hosted verification opt-out UI and setup examples are deliberately preserved; improvements to those are separate from self-host isolation.
AI-assisted implementation and review under the maintainer workflow.
Summary by cubic
Promotes self-host isolation while restoring hosted behavior when
SELFHOSTis unset or false: hosted deployments keep their prior auth cookies, verification emails, alarm senders, registration prompts, setup snippets, and CSP, and self-hosted deployments keep isolated behavior behindSELFHOST=true. Mode checks now use@databuddy/env/booleanso readingSELFHOSTno longer initializes unrelated URL configuration.Slack
@slack/web-api8.1.1 bump.AI, API, lint, and cleanup
Written for commit 3f5bd75. Summary will update on new commits.