fix: resolve all 18 CodeRabbitAI review findings on PR #199

Security:
- Restrict deploy-supabase-functions workflow to base repository only (#1)
- Fail-closed on missing IP metadata in before-signup hook (#11)
- Switch waitlist email from localStorage to sessionStorage (#9)
- Remove last_active_at from direct client UPDATE grant; use security definer RPC (#15)

Functional correctness:
- Clear profileRow on implicit sign-out in AuthProvider (#3)
- Prevent email useEffect from clobbering user input on ProComingSoonPage (#5)
- Add autoFocus to delete modal for immediate Escape dismissal (#6)
- Fix Link rendering outside Router context in ProWaitlistBanner (#2)
- Move skip-to-content link above ProWaitlistBanner for a11y (#18)

Stability & hardening:
- Add timeout to supabase.functions.invoke in accessService (#8)
- Add AbortSignal.timeout to Telegram fetch call (#10)
- Reorder delete-account to deleteUser before cleanup for atomicity (#12)
- Add error handling for all Supabase calls in post-signup (#13)
- Add idempotency guard (welcomed_at) to waitlist-welcome (#14)

Code quality:
- Rename proSort0-5 to kebab-case pro-sort-0-5 with stylelint suppression (#4)
- Restore expect import in cspHeaders.test (#7)
- Revert destructive column drop in migration (#17)
- Add new migration for welcomed_at column (#14)

Tests:
- Add test for implicit sign-out profile clearing (AuthProvider)
- Add test for email input not clobbered by async auth (ProComingSoonPage)
- Add test for Escape dismissing delete modal (ProfileSettingsPage)
- Add test for anchor rendering outside Router (ProWaitlistBanner)

Author: ayoub3bidi

.github/workflows/deploy-supabase-functions.yml

@@ -16,6 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     if: >-
       github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.head_repository.full_name == github.repository &&
       (github.event.workflow_run.head_branch == 'main' ||
        github.event.workflow_run.head_branch == 'develop')
     permissions:

src/components/ProWaitlistBanner.jsx

@@ -19,7 +19,7 @@ import { isRTL } from '@/utils/rtlManager';
  * @param {'landing' | 'app'} source
  * @param {string} pathname
  */
-function ProWaitlistBannerContent({ source, pathname }) {
+function ProWaitlistBannerContent({ source, pathname, inRouter }) {
   const { t, i18n } = useTranslation();
   const [dismissed, setDismissed] = useState(true);
 
@@ -46,6 +46,8 @@ function ProWaitlistBannerContent({ source, pathname }) {
       ? WAITLIST_SOURCES.APP
       : WAITLIST_SOURCES.LANDING;
   const CtaIcon = isRTL(i18n.language) ? ArrowLeft : ArrowRight;
+  const LinkComponent = inRouter ? Link : 'a';
+  const hrefProp = inRouter ? 'to' : 'href';
 
   const handleDismiss = () => {
     try {
@@ -68,13 +70,13 @@ function ProWaitlistBannerContent({ source, pathname }) {
           <p className="min-w-0 text-sm font-medium leading-snug text-(--color-pro-banner-text) sm:text-base">
             {t('pro.banner.message')}
           </p>
-          <Link
-            to={`/pro?source=${waitlistSource}`}
+          <LinkComponent
+            {...{ [hrefProp]: `/pro?source=${waitlistSource}` }}
             className="inline-flex min-h-touch shrink-0 items-center justify-center gap-1.5 rounded-lg bg-(--color-pro-banner-cta-bg) px-3.5 text-sm font-semibold text-(--color-pro-banner-cta-text) shadow-sm transition-colors hover:bg-(--color-pro-banner-cta-hover) hover:text-(--color-pro-banner-cta-hover-text) focus:outline-none focus-visible:ring-2 focus-visible:ring-white/50"
           >
             {t('pro.banner.cta')}
             <CtaIcon size={15} weight="bold" aria-hidden />
-          </Link>
+          </LinkComponent>
         </div>
         <button
           type="button"
@@ -91,7 +93,9 @@ function ProWaitlistBannerContent({ source, pathname }) {
 
 function ProWaitlistBannerRouted({ source }) {
   const { pathname } = useLocation();
-  return <ProWaitlistBannerContent source={source} pathname={pathname} />;
+  return (
+    <ProWaitlistBannerContent source={source} pathname={pathname} inRouter />
+  );
 }
 
 /**
@@ -100,7 +104,9 @@ function ProWaitlistBannerRouted({ source }) {
 function ProWaitlistBanner({ source }) {
   const inRouter = useInRouterContext();
   if (!inRouter) {
-    return <ProWaitlistBannerContent source={source} pathname="" />;
+    return (
+      <ProWaitlistBannerContent source={source} pathname="" inRouter={false} />
+    );
   }
   return <ProWaitlistBannerRouted source={source} />;
 }

src/components/ProWaitlistBanner.test.jsx

@@ -70,18 +70,27 @@ describe('ProWaitlistBanner', () => {
     ).not.toBeInTheDocument();
   });
 
-  it('hides when user is already enrolled (email in localStorage)', () => {
-    localStorage.setItem(WAITLIST_EMAIL_STORAGE_KEY, 'user@example.com');
+  it('hides when user is already enrolled (email in sessionStorage)', () => {
+    sessionStorage.setItem(WAITLIST_EMAIL_STORAGE_KEY, 'user@example.com');
     renderBanner('landing');
     expect(
       screen.queryByRole('link', { name: /join waitlist/i })
     ).not.toBeInTheDocument();
   });
 
+  it('renders anchor tag when outside Router context', () => {
+    const { container } = renderWithI18n(
+      <ProWaitlistBanner source="landing" />
+    );
+    const anchor = container.querySelector('a[href="/pro?source=landing"]');
+    expect(anchor).toBeInTheDocument();
+    expect(anchor.tagName).toBe('A');
+  });
+
   it('dispatches banner-dismissed event when hidden due to enrollment', () => {
     const spy = vi.fn();
     window.addEventListener('bayan-flow:banner-dismissed', spy);
-    localStorage.setItem(WAITLIST_EMAIL_STORAGE_KEY, 'user@example.com');
+    sessionStorage.setItem(WAITLIST_EMAIL_STORAGE_KEY, 'user@example.com');
     renderBanner('landing');
     expect(spy).toHaveBeenCalledTimes(1);
     window.removeEventListener('bayan-flow:banner-dismissed', spy);

src/contexts/AuthProvider.jsx

@@ -92,6 +92,7 @@ export function AuthProvider({ children }) {
       const checkId = ++accessCheckRef.current;
 
       if (!activeUser) {
+        setProfileRow(null);
         setAccessBlock(null);
         return;
       }

src/contexts/AuthProvider.test.jsx

@@ -460,6 +460,57 @@ describe('AuthProvider', () => {
     unmount();
   });
 
+  it('clears profileRow on implicit sign-out via SIGNED_OUT event', async () => {
+    supabaseAuthMock.getSession.mockResolvedValueOnce({
+      data: {
+        session: {
+          user: {
+            id: 'user-1',
+            email: 'user@example.com',
+            user_metadata: { full_name: 'Test User' },
+          },
+        },
+      },
+      error: null,
+    });
+
+    supabaseFromMock.mockReturnValue({
+      select: vi.fn().mockReturnThis(),
+      eq: vi.fn().mockReturnThis(),
+      maybeSingle: vi.fn(async () => ({
+        data: {
+          display_name: 'Test User',
+          avatar_url: null,
+          avatar_preference: 'google',
+          plan: 'free',
+          email: 'user@example.com',
+        },
+        error: null,
+      })),
+    });
+
+    render(
+      <AuthProvider>
+        <AuthProbe />
+      </AuthProvider>
+    );
+
+    await waitFor(() => {
+      expect(screen.getByTestId('authenticated')).toHaveTextContent('true');
+    });
+    expect(screen.getByTestId('display-name')).toHaveTextContent('Test User');
+
+    act(() => {
+      authStateChangeCallbackRef.current?.('SIGNED_OUT', null);
+    });
+
+    await waitFor(() => {
+      expect(screen.getByTestId('authenticated')).toHaveTextContent('false');
+    });
+    expect(screen.getByTestId('display-name')).toHaveTextContent('');
+    expect(screen.getByTestId('access-block')).toHaveTextContent('');
+  });
+
   it('sets accessBlock when profile is banned', async () => {
     supabaseAuthMock.getSession.mockResolvedValueOnce({
       data: {

src/index.css

@@ -575,7 +575,8 @@ body {
  */
 
 /* Tile 0: compare at 10%, sort at 15% */
-@keyframes proSort0 {
+/* stylelint-disable-next-line keyframe-block-no-duplicate-selectors -- intentional hold-then-jump frames */
+@keyframes pro-sort-0 {
   0%,
   10% {
     background-color: var(--color-primary);
@@ -603,7 +604,8 @@ body {
 }
 
 /* Tile 1: compare at 10%, swap right 180px, sort at 35% */
-@keyframes proSort1 {
+/* stylelint-disable-next-line keyframe-block-no-duplicate-selectors -- intentional hold-then-jump frames */
+@keyframes pro-sort-1 {
   0%,
   10% {
     background-color: var(--color-primary);
@@ -637,7 +639,8 @@ body {
 }
 
 /* Tile 2: compare at 40%, sort at 45% */
-@keyframes proSort2 {
+/* stylelint-disable-next-line keyframe-block-no-duplicate-selectors -- intentional hold-then-jump frames */
+@keyframes pro-sort-2 {
   0%,
   40% {
     background-color: var(--color-primary);
@@ -665,7 +668,8 @@ body {
 }
 
 /* Tile 3: compare at 50%, sort at 55% */
-@keyframes proSort3 {
+/* stylelint-disable-next-line keyframe-block-no-duplicate-selectors -- intentional hold-then-jump frames */
+@keyframes pro-sort-3 {
   0%,
   50% {
     background-color: var(--color-primary);
@@ -693,7 +697,8 @@ body {
 }
 
 /* Tile 4: compare at 10%, swap left 180px, sort at 35% */
-@keyframes proSort4 {
+/* stylelint-disable-next-line keyframe-block-no-duplicate-selectors -- intentional hold-then-jump frames */
+@keyframes pro-sort-4 {
   0%,
   10% {
     background-color: var(--color-primary);
@@ -727,7 +732,8 @@ body {
 }
 
 /* Tile 5: compare at 60%, sort at 65% */
-@keyframes proSort5 {
+/* stylelint-disable-next-line keyframe-block-no-duplicate-selectors -- intentional hold-then-jump frames */
+@keyframes pro-sort-5 {
   0%,
   60% {
     background-color: var(--color-primary);
@@ -759,22 +765,22 @@ body {
 }
 
 .pro-sorting-tile-1 {
-  animation: proSort0 6s ease-in-out infinite;
+  animation: pro-sort-0 6s ease-in-out infinite;
 }
 .pro-sorting-tile-2 {
-  animation: proSort1 6s ease-in-out infinite;
+  animation: pro-sort-1 6s ease-in-out infinite;
 }
 .pro-sorting-tile-3 {
-  animation: proSort2 6s ease-in-out infinite;
+  animation: pro-sort-2 6s ease-in-out infinite;
 }
 .pro-sorting-tile-4 {
-  animation: proSort3 6s ease-in-out infinite;
+  animation: pro-sort-3 6s ease-in-out infinite;
 }
 .pro-sorting-tile-5 {
-  animation: proSort4 6s ease-in-out infinite;
+  animation: pro-sort-4 6s ease-in-out infinite;
 }
 .pro-sorting-tile-6 {
-  animation: proSort5 6s ease-in-out infinite;
+  animation: pro-sort-5 6s ease-in-out infinite;
 }
 
 @media (prefers-reduced-motion: reduce) {

src/pages/ProComingSoonPage.jsx

@@ -4,7 +4,7 @@
  * See LICENSE for details.
  */
 
-import { useEffect, useState } from 'react';
+import { useEffect, useRef, useState } from 'react';
 import { useSearchParams } from 'react-router-dom';
 import {
   Columns,
@@ -67,13 +67,16 @@ function ProComingSoonPage() {
   })();
 
   const [email, setEmail] = useState(defaultEmail);
+  const emailEditedRef = useRef(false);
   const [submitState, setSubmitState] = useState('idle');
   const [position, setPosition] = useState(null);
   const [errorKey, setErrorKey] = useState(null);
   const [waitlistCount, setWaitlistCount] = useState(0);
 
   useEffect(() => {
-    setEmail(defaultEmail);
+    if (!emailEditedRef.current) {
+      setEmail(defaultEmail);
+    }
   }, [defaultEmail]);
 
   useEffect(() => {
@@ -260,7 +263,10 @@ function ProComingSoonPage() {
                     autoComplete="email"
                     required
                     value={email}
-                    onChange={event => setEmail(event.target.value)}
+                    onChange={event => {
+                      emailEditedRef.current = true;
+                      setEmail(event.target.value);
+                    }}
                     placeholder={t('pro.form.emailPlaceholder')}
                     aria-describedby={
                       errorKey ? 'pro-waitlist-email-error' : undefined

src/pages/ProComingSoonPage.test.jsx

@@ -116,6 +116,26 @@ describe('ProComingSoonPage', () => {
     });
   });
 
+  it('does not clobber email after user starts typing', async () => {
+    const { useAuth } = await import('@/hooks/useAuth.js');
+    useAuth.mockReturnValue({
+      user: { id: 'u1', email: 'initial@example.com' },
+      profile: null,
+    });
+
+    renderPage('/pro');
+
+    const input = screen.getByLabelText(/email address/i);
+    expect(input).toHaveValue('initial@example.com');
+
+    fireEvent.change(input, { target: { value: 'typed@example.com' } });
+    expect(input).toHaveValue('typed@example.com');
+
+    await waitFor(() => {
+      expect(input).toHaveValue('typed@example.com');
+    });
+  });
+
   it('hides waitlist count when below threshold', async () => {
     vi.mocked(getWaitlistPublicCount).mockResolvedValue(30);
 

src/pages/ProfileSettingsPage.jsx

@@ -501,6 +501,7 @@ function ProfileSettingsPage() {
                         damping: 25,
                       }}
                       onClick={e => e.stopPropagation()}
+                      autoFocus
                     >
                       <h2 className="text-xl font-bold text-text-primary mb-3">
                         {t('profile.deleteAccount')}

src/pages/ProfileSettingsPage.test.jsx

@@ -191,6 +191,33 @@ describe('ProfileSettingsPage', () => {
     });
   });
 
+  it('Escape key dismisses delete modal', async () => {
+    getProfileMock.mockResolvedValue({
+      display_name: 'Ada',
+      avatar_url: null,
+      avatar_preference: 'google',
+      plan: 'free',
+      email: 'ada@example.com',
+    });
+
+    renderPage();
+
+    await waitFor(() => {
+      expect(screen.getByLabelText(/display name/i)).toBeInTheDocument();
+    });
+
+    fireEvent.click(screen.getByRole('button', { name: /delete account/i }));
+
+    const dialog = await screen.findByRole('dialog');
+    expect(dialog).toBeInTheDocument();
+
+    fireEvent.keyDown(dialog, { key: 'Escape' });
+
+    await waitFor(() => {
+      expect(screen.queryByRole('dialog')).not.toBeInTheDocument();
+    });
+  });
+
   it('deletes account after typing DELETE confirmation via modal', async () => {
     getProfileMock.mockResolvedValue({
       display_name: 'Ada',