feat(labs): The Farm experiment - #72
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2dc9315a67
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const session = await getSession(request, db); | ||
| if (!session) return new Response('Unauthorized', { status: 401 }); | ||
|
|
||
| const roomId = params.id; |
There was a problem hiding this comment.
This endpoint accepts any valid session token and immediately allows writes to whatever roomId is in the URL, but it never verifies that the caller is actually authorized for that room (the same omission exists in the GET handler). As a result, any authenticated user can post/read messages in locked rooms by calling this route directly, bypassing the gating logic exposed by /api/chat/rooms.
Useful? React with 👍 / 👎.
| const envSecret = import.meta.env.VIP_SERVER_SECRET as string | undefined; | ||
| if (envSecret) { | ||
| return Keypair.fromSecret(envSecret); |
There was a problem hiding this comment.
The VIP auth keypair is sourced only from import.meta.env, but in the Cloudflare runtime secrets are provided through runtime env bindings (as used elsewhere in this repo) rather than build-time import.meta.env. In production deployments where VIP_SERVER_SECRET is configured as a Worker secret, this code will still throw "VIP server secret is not configured," breaking challenge generation and verification.
Useful? React with 👍 / 👎.
| const primaryRpId = getSafeRpId(hostname); | ||
|
|
||
| // Clear any stale credentials before logging in | ||
| clearUserAuth(); |
There was a problem hiding this comment.
clearUserAuth is now asynchronous and resets the PasskeyKit singleton after a dynamic import, but this call is not awaited here. That introduces a race where login can grab/connect a kit instance and then clearUserAuth finishes later and nulls the singleton, leaving auth state marked connected while subsequent transaction flows see a disconnected/new instance.
Useful? React with 👍 / 👎.
1 participant
Adds The Farm experiment and all fork additions to Smol Labs.