-
Notifications
You must be signed in to change notification settings - Fork 0
fix: Add validation for required body in CustomizePostDialog #46
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Changes from 3 commits
f387180
dadf937
30d8137
53b6208
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -272,18 +272,18 @@ function validateBody(input: PreflightInput): ValidationIssue[] { | |
| if (!reqs) continue; | ||
|
|
||
| // Body required check | ||
| if (reqs.body_restriction_policy === 'required' && !body.trim()) { | ||
| issues.push({ | ||
| code: 'BODY_REQUIRED', | ||
| severity: 'error', | ||
| subreddit, | ||
| message: `r/${subreddit} requires a description`, | ||
| suggestion: 'Add a description to your post', | ||
| field: 'body', | ||
| expectedCategory: 'fixable_now', | ||
| }); | ||
| continue; | ||
| } | ||
| // if (reqs.body_restriction_policy === 'required' && !body.trim()) { | ||
| // issues.push({ | ||
| // code: 'BODY_REQUIRED', | ||
| // severity: 'error', | ||
| // subreddit, | ||
| // message: `r/${subreddit} requires a description`, | ||
| // suggestion: 'Add a description to your post', | ||
| // field: 'body', | ||
| // expectedCategory: 'fixable_now', | ||
| // }); | ||
| // continue; | ||
| // } | ||
|
Comment on lines
+275
to
+286
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Restore server-side/preflight Line 275-Line 286 currently bypasses required-body validation by commenting out the check. This regresses preflight guarantees and allows invalid payloads to pass 🔧 Proposed fix- // Body required check
- // if (reqs.body_restriction_policy === 'required' && !body.trim()) {
- // issues.push({
- // code: 'BODY_REQUIRED',
- // severity: 'error',
- // subreddit,
- // message: `r/${subreddit} requires a description`,
- // suggestion: 'Add a description to your post',
- // field: 'body',
- // expectedCategory: 'fixable_now',
- // });
- // continue;
- // }
+ // Body required check
+ if (reqs.body_restriction_policy === 'required' && !body.trim()) {
+ issues.push({
+ code: 'BODY_REQUIRED',
+ severity: 'error',
+ subreddit,
+ message: `r/${subreddit} requires a description`,
+ suggestion: 'Add a description to your post',
+ field: 'body',
+ expectedCategory: 'fixable_now',
+ });
+ continue;
+ }As per coding guidelines, "Never bypass validation" and "Always validate inputs." 🤖 Prompt for AI Agents |
||
|
|
||
| // Min length (only if body exists) | ||
| if (body && reqs.body_text_min_length && body.length < reqs.body_text_min_length) { | ||
|
|
||
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,37 +1,139 @@ | ||
| import React, { useEffect } from 'react'; | ||
| import React, { useEffect, useState, useRef, useCallback } from 'react'; | ||
| import Head from 'next/head'; | ||
| import Link from 'next/link'; | ||
| import { useRouter } from 'next/router'; | ||
| import axios from 'axios'; | ||
| import { mutate } from 'swr'; | ||
| import { CheckCircle } from 'lucide-react'; | ||
| import { CheckCircle, Loader2, ArrowRight } from 'lucide-react'; | ||
| import { SWR_KEYS } from '@/lib/swr'; | ||
|
|
||
| export default function CheckoutSuccess() { | ||
| // Refresh auth data on mount to pick up the new entitlement from webhook | ||
| const POLL_INTERVAL_MS = 2_000; | ||
| const MAX_POLL_DURATION_MS = 30_000; | ||
|
|
||
| /** | ||
| * Poll /api/me until entitlement === 'paid', or auto-resolve after timeout. | ||
| * Payment already succeeded on Dodo's side — the poll just waits for the | ||
| * webhook to propagate so we can pre-warm the SWR cache before navigation. | ||
| */ | ||
| const usePaymentConfirmation = () => { | ||
| const [ready, setReady] = useState(false); | ||
| const startRef = useRef(Date.now()); | ||
|
|
||
| useEffect(() => { | ||
| mutate(SWR_KEYS.AUTH); | ||
| let cancelled = false; | ||
| let timer: ReturnType<typeof setTimeout>; | ||
|
|
||
| const poll = async () => { | ||
| if (cancelled) return; | ||
|
|
||
| if (Date.now() - startRef.current > MAX_POLL_DURATION_MS) { | ||
| if (!cancelled) setReady(true); | ||
| return; | ||
|
Comment on lines
+28
to
+30
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Do not mark payment as confirmed on timeout. When polling exceeds MAX_POLL_DURATION_MS, the code sets Proposed fix (separate confirmed vs timeout states)-const usePaymentConfirmation = () => {
- const [ready, setReady] = useState(false);
+const usePaymentConfirmation = () => {
+ const [status, setStatus] = useState<'checking' | 'confirmed' | 'timeout'>('checking');
const startRef = useRef(Date.now());
@@
- if (Date.now() - startRef.current > MAX_POLL_DURATION_MS) {
- if (!cancelled) setReady(true);
+ if (Date.now() - startRef.current > MAX_POLL_DURATION_MS) {
+ if (!cancelled) setStatus('timeout');
return;
}
@@
if (data?.entitlement === 'paid') {
if (!cancelled) {
mutate(SWR_KEYS.AUTH, data, { revalidate: false });
- setReady(true);
+ setStatus('confirmed');
}
return;
}
@@
- return ready;
+ return status;
};
@@
- const ready = usePaymentConfirmation();
+ const status = usePaymentConfirmation();
+ const ready = status === 'confirmed';Also applies to: 105-136 🤖 Prompt for AI Agents |
||
| } | ||
|
|
||
| try { | ||
| const { data } = await axios.get('/api/me'); | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
The new confirmation flow can block indefinitely when Useful? React with 👍 / 👎. |
||
| if (data?.entitlement === 'paid') { | ||
| if (!cancelled) { | ||
| mutate(SWR_KEYS.AUTH, data, { revalidate: false }); | ||
| setReady(true); | ||
| } | ||
| return; | ||
| } | ||
| } catch { | ||
| // Transient error — keep polling | ||
| } | ||
|
|
||
| if (!cancelled) { | ||
| timer = setTimeout(poll, POLL_INTERVAL_MS); | ||
| } | ||
| }; | ||
|
|
||
| poll(); | ||
| return () => { | ||
| cancelled = true; | ||
| clearTimeout(timer); | ||
| }; | ||
| }, []); | ||
|
|
||
| return ready; | ||
| }; | ||
|
|
||
| export default function CheckoutSuccess() { | ||
| const router = useRouter(); | ||
| const ready = usePaymentConfirmation(); | ||
| const [navigating, setNavigating] = useState(false); | ||
|
|
||
| const handleBackToApp = useCallback(async () => { | ||
| setNavigating(true); | ||
| try { | ||
| const { data } = await axios.get('/api/me'); | ||
| await mutate(SWR_KEYS.AUTH, data, { revalidate: false }); | ||
| } catch { | ||
| mutate(SWR_KEYS.AUTH); | ||
| } | ||
| router.push('/'); | ||
| }, [router]); | ||
|
|
||
| return ( | ||
| <> | ||
| <Head> | ||
| <title>Thank you - Reddit Multi Poster</title> | ||
| </Head> | ||
|
|
||
| <div className="min-h-viewport bg-[#0a0a0a] flex flex-col items-center justify-center p-4"> | ||
| <div className="max-w-md w-full text-center space-y-6"> | ||
| <div className="flex justify-center"> | ||
| <CheckCircle className="h-16 w-16 text-green-500" aria-hidden="true" /> | ||
| </div> | ||
| <h1 className="text-2xl font-semibold text-white">Thank you</h1> | ||
| <p className="text-zinc-400"> | ||
| You're all set. You can now save unlimited communities and post to as many as you | ||
| want at once. | ||
| </p> | ||
| <Link | ||
| href="/" | ||
| className="inline-flex items-center justify-center rounded-lg bg-orange-500 px-6 py-3 text-sm font-medium text-white hover:bg-orange-600 transition-colors cursor-pointer" | ||
| > | ||
| Back to app | ||
| </Link> | ||
|
|
||
| {/* ── Confirming (polling for webhook) ── */} | ||
| {!ready && ( | ||
| <> | ||
| <div className="flex justify-center"> | ||
| <Loader2 | ||
| className="h-16 w-16 text-violet-500 animate-spin" | ||
| aria-hidden="true" | ||
| /> | ||
| </div> | ||
| <h1 className="text-2xl font-semibold text-white"> | ||
| Confirming your upgrade… | ||
| </h1> | ||
| <p className="text-zinc-400"> | ||
| This usually takes just a few seconds. | ||
| </p> | ||
| </> | ||
| )} | ||
|
|
||
| {/* ── Ready — user is Pro ── */} | ||
| {ready && ( | ||
| <> | ||
| <div className="flex justify-center"> | ||
| <CheckCircle className="h-16 w-16 text-green-500" aria-hidden="true" /> | ||
| </div> | ||
| <h1 className="text-2xl font-semibold text-white"> | ||
| You're Pro now! | ||
| </h1> | ||
| <p className="text-zinc-400"> | ||
| Unlimited communities, unlimited posts. No limits, ever. | ||
| </p> | ||
| <button | ||
| onClick={handleBackToApp} | ||
| disabled={navigating} | ||
| className="inline-flex items-center justify-center gap-2 rounded-lg bg-orange-500 px-6 py-3 text-sm font-medium text-white hover:bg-orange-600 transition-colors cursor-pointer disabled:opacity-60 disabled:cursor-wait" | ||
| tabIndex={0} | ||
| aria-label="Go back to the app" | ||
| > | ||
| {navigating ? ( | ||
| <> | ||
| <Loader2 className="h-4 w-4 animate-spin" aria-hidden="true" /> | ||
| Loading… | ||
| </> | ||
| ) : ( | ||
| <> | ||
| Back to app | ||
| <ArrowRight className="h-4 w-4" aria-hidden="true" /> | ||
| </> | ||
| )} | ||
| </button> | ||
| </> | ||
| )} | ||
| </div> | ||
| </div> | ||
| </> | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Commenting out this branch removes the only global check that blocks submissions when a subreddit requires a description, so
validatePreflightcan now returncanProceed=truefor empty bodies and the queue/review flow will allow posting until Reddit rejects it downstream. The new inline check inCustomizePostDialogdoes not cover this because it only runs if that dialog is opened (and customization is gated by paid/trial inpages/index.tsx), so free users and any non-customized subreddit path lose required-body protection entirely.Useful? React with 👍 / 👎.