Prepare Switchboard for public beta - #4
Conversation
|
Warning Review limit reached
Next review available in: 33 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (21)
📝 WalkthroughWalkthroughThe PR prepares the beta release, updates Prisma configuration, changes admin logout to a server action, restores form values after errors, updates generated CLI templates, and adds related tests and documentation. ChangesBeta release and admin workflow
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant AdminLayout
participant logout
participant SessionCookie
participant AdminLogin
AdminLayout->>logout: submit logout server action
logout->>SessionCookie: expire session cookie
logout->>AdminLogin: redirect to /admin/login
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9c01e461c5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| control.value = values[0] ?? ""; | ||
| } | ||
| } | ||
| }, [fields, state.error]); |
There was a problem hiding this comment.
When two consecutive saves return the same error string—common for repeated invalid JSON or uniqueness failures—the second state update leaves both dependencies unchanged, so this effect does not run again. React resets uncontrolled fields after the form action resolves, causing the user's non-password values to remain cleared after that second failure; trigger restoration from each submission/state result rather than only changes to state.error.
Useful? React with 👍 / 👎.
| }, | ||
| "overrides": { | ||
| "postcss": "^8.5.18", | ||
| "sharp": "^0.35.0" |
There was a problem hiding this comment.
The repository still documents Node.js 18 as supported, but this override resolves to Sharp 0.35.3, whose committed lockfile declares node: >=20.9.0. Consequently the documented Node 18 setup selects an unsupported native dependency and installations enforcing engine requirements cannot complete; either retain a Node-18-compatible Sharp release or raise the repository and example minimum Node version consistently.
Useful? React with 👍 / 👎.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 8
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@package.json`:
- Around line 29-31: Enforce the Next.js 15 Node.js minimum by adding
engines.node with ">=18.18.0" to the root package manifest, and update the
Node.js version requirements in CONTRIBUTING.md, README.md, and
packages/cli/README.md from 18 or newer to 18.18.0 or newer.
In `@packages/cli/package.json`:
- Around line 35-37: Update the publishConfig metadata in
packages/cli/package.json to include the beta dist-tag alongside the existing
public access setting, ensuring the 0.6.0-beta.2 package publishes under beta by
default.
In `@packages/cli/src/cli.js`:
- Line 11: Update createCli so the CLI version is sourced from the package
metadata rather than the hardcoded .version("0.6.0-beta.2") value, ensuring
--version stays synchronized with packages/cli/package.json; alternatively, add
coverage that compares --version output with the manifest version.
In `@packages/cli/templates/authFiles.js`:
- Line 297: Remove the generated GET logout route from the auth file generation
logic surrounding the expires configuration, and update the generation tests to
no longer expect or require that route. Preserve the new <form action={logout}>
flow and any remaining logout behavior.
In `@packages/cli/test/package-boundaries.test.js`:
- Around line 52-77: Extend the “package metadata is ready for the public beta”
test with an npm archive-content or packlist assertion that inspects the files
included for publication and verifies they match the allowed packageJson.files
boundaries. Keep the existing metadata assertions unchanged and ensure the check
catches unintended files nested under bin, src, or templates.
In `@src/app/admin/layout.tsx`:
- Around line 22-38: Add a unique aria-label to the top navigation element in
the admin layout, specifically the nav with className "sb-admin-nav", so it is
distinguishable from the sidebar navigation landmark while preserving the
existing links and structure.
In `@src/components/form/SmartForm.tsx`:
- Around line 31-58: Update the restoration useEffect in SmartForm to depend on
the full state object rather than state.error, ensuring it reruns for every
useActionState update even when identical errors recur; keep the existing form
value restoration logic unchanged.
In `@src/switchboard/auth-actions.ts`:
- Around line 47-55: The logout cookie-clearing behavior is inconsistent between
the Server Action and public admin logout routes. Update the cookie options in
src/switchboard/auth-actions.ts:47-55, src/app/admin/logout/route.ts:9-17,
examples/basic-next-prisma/src/switchboard/auth-actions.ts:47-55, and
examples/basic-next-prisma/src/app/admin/logout/route.ts:9-17 so every
SWITCHBOARD_SESSION_COOKIE clear uses sessionCookieOptions() together with an
expired date and zero maxAge, preserving the existing redirect/response
behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: f16ed854-8273-49d6-8e4c-a5b7d741b3bb
⛔ Files ignored due to path filters (2)
examples/basic-next-prisma/package-lock.jsonis excluded by!**/package-lock.jsonpackage-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (26)
.gitignoreCONTRIBUTING.mdREADME.mdexamples/basic-next-prisma/package.jsonexamples/basic-next-prisma/prisma.config.tsexamples/basic-next-prisma/src/app/admin/layout.tsxexamples/basic-next-prisma/src/app/admin/logout/route.tsexamples/basic-next-prisma/src/components/form/SmartForm.tsxexamples/basic-next-prisma/src/switchboard/auth-actions.tspackage.jsonpackages/cli/README.mdpackages/cli/package.jsonpackages/cli/src/cli.jspackages/cli/templates/adminLayout.jspackages/cli/templates/authFiles.jspackages/cli/templates/supportFiles.jspackages/cli/test/auth.test.jspackages/cli/test/init.test.jspackages/cli/test/package-boundaries.test.jsprisma.config.tssrc/app/admin/layout.tsxsrc/app/admin/logout/route.tssrc/components/form/SmartForm.tsxsrc/lib/prisma.tssrc/lib/rbac.tssrc/switchboard/auth-actions.ts
💤 Files with no reviewable changes (1)
- src/lib/prisma.ts
| "@prisma/client": "^6.19.3", | ||
| "next": "15.5.22", | ||
| "prisma": "^6.19.3", |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
jq '.engines // {}' package.json
rg -n -C 2 \
'Node\.js|node-version|engines|18\.[0-9]+' \
. --hidden \
-g 'package.json' \
-g '*.md' \
-g '*.yml' \
-g '*.yaml' \
-g '.nvmrc' \
-g '!node_modules/**' || trueRepository: black-candle-technologies/switchboard
Length of output: 971
🌐 Web query:
Next.js 15 requires Node.js 18.18.0 or newer official documentation
💡 Result:
Yes, it is correct that Next.js 15 requires Node.js 18.18.0 or newer. This requirement was officially introduced with the release of Next.js 15 to ensure compatibility with modern framework features and dependencies [1][2]. While some documentation pages may recommend higher versions like Node.js 20.9 for optimal stability or LTS support [3], the hard minimum requirement enforced by the framework is version 18.18.0 [1][4][5]. If you attempt to run a Next.js 15 application with a version of Node.js older than 18.18.0, you will encounter a version mismatch error [2]. To manage this requirement effectively: - Verify your current version by running node -v [2]. - Use a version manager such as nvm or volta to upgrade to a supported version [2]. - Explicitly define the required version in your package.json file to ensure consistency across development and CI/CD environments [2]: { "engines": { "node": ">=18.18.0" } }
Citations:
- 1: https://nextjs.org/blog/next-15
- 2: https://www.iloveblogs.blog/post/nextjs-15-minimum-nodejs-version-18180
- 3: https://nextjs.org/docs/app/getting-started/installation
- 4: https://npmx.dev/package/next/v/15.5.16
- 5: https://npmx.dev/package/next/v/15.1.12
Enforce the Next.js 15 Node.js floor across the project.
Next.js 15 requires Node.js 18.18.0 or newer, and the root manifest does not set engines.node. Update the remaining Node.js 18 or newer requirements in CONTRIBUTING.md, README.md, and packages/cli/README.md, and add a CI/runtime engine guard such as package.json engines.node: ">=18.18.0".
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@package.json` around lines 29 - 31, Enforce the Next.js 15 Node.js minimum by
adding engines.node with ">=18.18.0" to the root package manifest, and update
the Node.js version requirements in CONTRIBUTING.md, README.md, and
packages/cli/README.md from 18 or newer to 18.18.0 or newer.
| export async function logout() { | ||
| const cookieStore = await cookies(); | ||
| cookieStore.set(SWITCHBOARD_SESSION_COOKIE, "", { | ||
| ...sessionCookieOptions(), | ||
| expires: new Date(0), | ||
| maxAge: 0, | ||
| }); | ||
| redirect("/admin/login"); | ||
| } |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== relevant files =="
printf '%s\n' $(git ls-files | rg '^src/(switchboard/auth-actions\.ts|switchboard/auth\.ts|app/admin/logout/route\.ts)|examples/basic-next-prisma/src/(switchboard/auth-actions\.ts|app/admin/logout/route\.ts)$' || true)
echo
echo "== logout/action usages =="
rg -n "logout|formAction|type=\"submit\"|submit\\(\"logout\"\\)|/admin/logout|admin/logout|logout\\(\\)" src examples/basic -S || true
echo
echo "== auth-action snippets =="
for f in src/switchboard/auth-actions.ts examples/basic-next-prisma/src/switchboard/auth-actions.ts src/app/admin/logout/route.ts examples/basic-next-prisma/src/app/admin/logout/route.ts; do
if [ -f "$f" ]; then
echo "--- $f"
cat -n "$f" | sed -n '1,120p'
fi
done
echo
echo "== session cookie options definitions =="
rg -n "function sessionCookieOptions|const sessionCookieOptions|SWITCHBOARD_SESSION_COOKIE|clearSessionCookie" . -S || trueRepository: black-candle-technologies/switchboard
Length of output: 8953
Consolidate logout cookie clearing so admin/logout routes still use the shared cookie settings.
The admin logout Server Action now clears SWITCHBOARD_SESSION_COOKIE with expires: new Date(0) and maxAge: 0, but the /admin/logout GET routes still clear it with sessionCookieOptions() only. If this route exists as a public logout link endpoint, the route must also clear the expired cookie so the action cannot succeed while the route leaves the old session active.
🧰 Tools
🪛 React Doctor (0.9.1)
[error] 47-47: Server action "logout" performs unauthenticated privileged server work (cookies().set()), so anyone can trigger it directly.
Check auth before changing server state or invoking billable services because exported server actions can be called directly by unauthenticated clients.
(server-auth-actions)
📍 Affects 4 files
src/switchboard/auth-actions.ts#L47-L55(this comment)src/app/admin/logout/route.ts#L9-L17examples/basic-next-prisma/src/switchboard/auth-actions.ts#L47-L55examples/basic-next-prisma/src/app/admin/logout/route.ts#L9-L17
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/switchboard/auth-actions.ts` around lines 47 - 55, The logout
cookie-clearing behavior is inconsistent between the Server Action and public
admin logout routes. Update the cookie options in
src/switchboard/auth-actions.ts:47-55, src/app/admin/logout/route.ts:9-17,
examples/basic-next-prisma/src/switchboard/auth-actions.ts:47-55, and
examples/basic-next-prisma/src/app/admin/logout/route.ts:9-17 so every
SWITCHBOARD_SESSION_COOKIE clear uses sessionCookieOptions() together with an
expired date and zero maxAge, preserving the existing redirect/response
behavior.
1 participant
Hardens Switchboard for public use with secure dependency updates, reliable authentication and form behavior, a responsive admin UI, and expanded release verification.
Summary by CodeRabbit