Skip to content

Fix process.env use#1495

Merged
prxt6529 merged 12 commits intomainfrom
process-env-fix
Sep 30, 2025
Merged

Fix process.env use#1495
prxt6529 merged 12 commits intomainfrom
process-env-fix

Conversation

@prxt6529
Copy link
Copy Markdown
Collaborator

@prxt6529 prxt6529 commented Sep 29, 2025

Summary by CodeRabbit

  • New Features

    • Two new public env vars for Farcaster (base URL and API key) exposed at build/dev time.
  • Bug Fixes

    • IPFS gateway and link origin checks now rely solely on configured public endpoints for safer external link handling.
  • Refactor

    • Configuration sourcing consolidated to public environment; formatting and null-safety guards standardized without API changes.
  • Chores

    • Package bumped to 1.0.0; build flow updated with base-build; lint and lint:quiet scripts added; builds ignore ESLint.
  • Style

    • Date picker modal styles updated for improved layout and theming.

Signed-off-by: prxt6529 <prxt@6529.io>
@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented Sep 29, 2025

Walkthrough

Environment sourcing shifted from process.env to publicEnv for Farcaster, IPFS, and link parsing; two Farcaster public env keys were added and exposed in Next.js; build scripts were restructured (added base-build, reintroduced lint and added lint:quiet); many files received formatting/type/null-safety tweaks; DatePicker header wrapper changed from Modal.Header to a plain div.

Changes

Cohort / File(s) Summary
Public env schema & Next config
config/env.schema.ts, next.config.mjs
Add FARCASTER_WARPCAST_API_BASE and FARCASTER_WARPCAST_API_KEY to public env schema; expose both in Next.js env; add eslint.ignoreDuringBuilds = true.
Farcaster route
app/api/farcaster/route.ts
Switch WARPCAST base URL sourcing to publicEnv.FARCASTER_WARPCAST_API_BASE (API key from publicEnv if available); import Farcaster URL helpers; formatting and return/error normalization only.
Pepe resolve route / IPFS gateway
app/api/pepe/resolve/route.ts
IPFS gateway fallback now uses publicEnv.IPFS_GATEWAY_ENDPOINT or https://ipfs.io/ipfs/ (removed process.env fallback); import reordering and formatting tweaks; core logic unchanged.
Link utilities
components/drops/view/part/dropPartMarkdown/linkUtils.tsx
renderExternalOrInternalLink now uses only publicEnv.BASE_ENDPOINT (removed process.env fallback); minor formatting and export ordering changes.
Seize link parser
helpers/SeizeLinkParser.ts
Allowed origins check simplified to the origin of publicEnv.BASE_ENDPOINT (removed process.env alternative); query/path logic unchanged.
Build scripts & package
package.json
Bump version to 1.0.0; add base-build; update build to run npm run lint:quiet && npm run base-build; reintroduce lint, add lint:quiet; update build:lint chaining.
DatePicker UI
components/datePickerModal/DatePickerModal.module.scss, components/datePickerModal/DatePickerModal.tsx
Substantial CSS adjustments; header wrapper changed from Modal.Header to plain div; import order tweaks.
Formatting / typing / small guards
multiple files: app/api/farcaster/route.ts, app/api/pepe/resolve/route.ts, components/drops/view/part/dropPartMarkdown/linkUtils.tsx, helpers/SeizeLinkParser.ts, ...
Multi-line formatting, expanded generic/type signatures, parentheses/return normalization, minor null-safety tweaks; no public API signature changes.

Sequence Diagram(s)

sequenceDiagram
  autonumber
  actor User
  participant Route as Farcaster Route
  participant Config as publicEnv
  participant Warpcast as Warpcast API

  User->>Route: HTTP request
  Route->>Config: Read FARCASTER_WARPCAST_API_BASE / FARCASTER_WARPCAST_API_KEY
  alt Base configured
    Route->>Warpcast: Request using configured base URL + key
    Warpcast-->>Route: Response
    Route-->>User: JSON result
  else Not configured
    Route->>Warpcast: Request using default/base logic
    Warpcast-->>Route: Response or error
    Route-->>User: Result or error
  end
  note over Route,Config: Env sourcing moved to publicEnv (process.env fallbacks removed)
Loading
sequenceDiagram
  autonumber
  actor Client
  participant Pepe as /api/pepe/resolve
  participant Env as publicEnv
  participant IPFS as IPFS Gateway

  Client->>Pepe: Resolve request
  Pepe->>Env: Read IPFS_GATEWAY_ENDPOINT
  alt Present
    Pepe->>IPFS: Fetch via configured gateway
  else Absent
    Pepe->>IPFS: Fetch via https://ipfs.io/ipfs/
  end
  IPFS-->>Pepe: Content/metadata
  Pepe-->>Client: Response
  note over Pepe: process.env fallback removed
Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Poem

I twitch my whiskers at envs made bright,
Public paths lead hops by morning light.
Two new keys nibble at the gate,
Lint hums softly—no need to wait.
A rabbit applauds the tidy flight 🥕

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title Check ✅ Passed The title succinctly captures the core refactor of replacing direct process.env references with the publicEnv pattern across the codebase, which is the primary change of this pull request.
Docstring Coverage ✅ Passed No functions found in the changes. Docstring coverage check skipped.
✨ Finishing touches
🧪 Generate unit tests
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch process-env-fix

Comment @coderabbitai help to get the list of available commands and usage tips.

Signed-off-by: prxt6529 <prxt@6529.io>
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 5

🧹 Nitpick comments (4)
components/drops/view/part/dropPartMarkdown/linkUtils.tsx (1)

79-85: Make props read‑only per guidelines; minor cleanup.

  • Mark props as Readonly<...>.
  • Given schema guarantees BASE_ENDPOINT, the || "" fallback is likely unnecessary.

Suggested changes:

-const renderExternalOrInternalLink = (
-  href: string,
-  props: AnchorHTMLAttributes<HTMLAnchorElement> & ExtraProps
-) => {
-  const baseEndpoint = publicEnv.BASE_ENDPOINT || "";
+const renderExternalOrInternalLink = (
+  href: string,
+  props: Readonly<AnchorHTMLAttributes<HTMLAnchorElement> & ExtraProps>
+) => {
+  const baseEndpoint = publicEnv.BASE_ENDPOINT;

As per coding guidelines.

app/api/pepe/resolve/route.ts (1)

105-106: Clarify/normalize IPFS gateway format.

IPFS_GATEWAY_ENDPOINT likely should include “/ipfs”. If callers supply just the host (e.g., “https://cloudflare-ipfs.com”), URLs become “https://cloudflare-ipfs.com/” (often wrong).

Option A (document): In env schema/docs, state the value must end with “/ipfs”.
Option B (normalize at runtime):

-const IPFS_GATEWAY = trimTrailingSlashes(
-  publicEnv.IPFS_GATEWAY_ENDPOINT || "https://ipfs.io/ipfs/"
-);
+const rawGateway = publicEnv.IPFS_GATEWAY_ENDPOINT || "https://ipfs.io/ipfs/";
+const base = trimTrailingSlashes(rawGateway);
+const IPFS_GATEWAY = base.endsWith("/ipfs") ? base : `${base}/ipfs`;
app/api/farcaster/route.ts (2)

26-28: Verify public exposure of WARPCAST API key.

You’re sourcing FARCASTER_WARPCAST_API_KEY from publicEnv. Ensure this value isn’t bundled to the client or exposed via runtime config. If it is, treat it as non‑secret or move to a server‑only env and plumb it in on the server path only.

If needed, switch to a server‑only constant and keep publicEnv for base URL only. As per coding guidelines.


138-173: Use urlGuard’s fetchPublicJson instead of manual fetch/abort.

Align external calls with the shared network layer (timeouts, redirects, policy, UA) and drop local AbortController.

-const fetchWarpcastJson = async <T>(
-  path: string,
-  params: Record<string, string | undefined>
-): Promise<T | null> => {
-  const url = buildWarpcastUrl(path, params);
-  const { controller, cancel } = createAbortController(FETCH_TIMEOUT_MS);
-
-  try {
-    const response = await fetch(url, {
-      method: "GET",
-      headers: {
-        accept: "application/json",
-        "user-agent": USER_AGENT,
-      },
-      signal: controller.signal,
-    });
-
-    if (response.status === 404) {
-      return null;
-    }
-
-    if (!response.ok) {
-      throw new Error(`Warpcast request failed with status ${response.status}`);
-    }
-
-    return (await response.json()) as T;
-  } catch (error) {
-    if ((error as { name?: string }).name === "AbortError") {
-      throw new Error("Warpcast request aborted");
-    }
-
-    throw error instanceof Error ? error : new Error("Warpcast request failed");
-  } finally {
-    cancel();
-  }
-};
+const fetchWarpcastJson = async <T>(
+  path: string,
+  params: Record<string, string | undefined>
+): Promise<T | null> => {
+  const url = buildWarpcastUrl(path, params).toString();
+  try {
+    const data = await fetchPublicJson<T>(
+      url,
+      { headers: { accept: "application/json" } },
+      {
+        timeoutMs: FETCH_TIMEOUT_MS,
+        userAgent: USER_AGENT,
+        // policy not strictly needed for a fixed base, but keeps parity:
+        policy: PUBLIC_URL_POLICY,
+      }
+    );
+    return data;
+  } catch (error) {
+    // Map 404s to null if urlGuard bubbles them:
+    if (error instanceof UrlGuardError && error.statusCode === 404) {
+      return null;
+    }
+    throw error instanceof Error ? error : new Error("Warpcast request failed");
+  }
+};

As per coding guidelines.

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between bbb48d1 and 32bd910.

📒 Files selected for processing (7)
  • app/api/farcaster/route.ts (15 hunks)
  • app/api/pepe/resolve/route.ts (22 hunks)
  • components/drops/view/part/dropPartMarkdown/linkUtils.tsx (3 hunks)
  • config/env.schema.ts (1 hunks)
  • helpers/SeizeLinkParser.ts (1 hunks)
  • next.config.mjs (1 hunks)
  • package.json (1 hunks)
🧰 Additional context used
📓 Path-based instructions (6)
**/*.{ts,tsx}

📄 CodeRabbit inference engine (.cursorrules)

**/*.{ts,tsx}: Do not include any comments in the code
Use react-query for data fetching
Always add readonly before props

Use TypeScript for implementation code

Files:

  • components/drops/view/part/dropPartMarkdown/linkUtils.tsx
  • config/env.schema.ts
  • helpers/SeizeLinkParser.ts
  • app/api/farcaster/route.ts
  • app/api/pepe/resolve/route.ts
**/*.tsx

📄 CodeRabbit inference engine (.cursorrules)

**/*.tsx: Use FontAwesome for icons
Use TailwindCSS for styling

Use React functional components with hooks

Files:

  • components/drops/view/part/dropPartMarkdown/linkUtils.tsx
{app,pages}/**/*.{ts,tsx}

📄 CodeRabbit inference engine (.cursorrules)

Use NextJS features that match the current version

Files:

  • app/api/farcaster/route.ts
  • app/api/pepe/resolve/route.ts
app/api/**/*.{ts,tsx,js,jsx}

📄 CodeRabbit inference engine (app/api/AGENTS.md)

app/api/**/*.{ts,tsx,js,jsx}: Never call fetch directly with user-controlled or scraped URLs in API code; use @/lib/security/urlGuard helpers (parsePublicUrl, assertPublicUrl, fetchPublicUrl, fetchPublicJson) so every hop is validated
When custom headers or timeouts are needed for external requests, pass them via urlGuard helper options instead of rolling a custom wrapper

Files:

  • app/api/farcaster/route.ts
  • app/api/pepe/resolve/route.ts
app/api/**/route.{ts,js}

📄 CodeRabbit inference engine (app/api/AGENTS.md)

app/api/**/route.{ts,js}: Catch UrlGuardError explicitly in route handlers if returning a tailored response; otherwise allow it to propagate so the correct status code surfaces
Export HTTP verb handlers (e.g., GET) from route.ts files
Keep route.ts logic in small internal functions when it grows beyond ~200 lines
For edge caching behavior, prefer export const dynamic = "force-dynamic" or revalidate constants rather than inline headers
Follow project default responses (NextResponse.json) and reuse existing util modules instead of duplicating logic

Files:

  • app/api/farcaster/route.ts
  • app/api/pepe/resolve/route.ts
app/api/**/*.ts

📄 CodeRabbit inference engine (app/api/AGENTS.md)

Use TypeScript types for request parameters and responses; avoid any unless a third-party payload has no shape guarantees

Files:

  • app/api/farcaster/route.ts
  • app/api/pepe/resolve/route.ts
🧠 Learnings (4)
📚 Learning: 2025-09-28T12:33:30.941Z
Learnt from: CR
PR: 6529-Collections/6529seize-frontend#0
File: __tests__/AGENTS.md:0-0
Timestamp: 2025-09-28T12:33:30.941Z
Learning: Run `npm run test:cov:changed` for changed-file tests and coverage; use `npm run test` for full suite; ensure `npm run lint` and `npm run type-check` pass

Applied to files:

  • package.json
📚 Learning: 2025-09-28T12:33:56.322Z
Learnt from: CR
PR: 6529-Collections/6529seize-frontend#0
File: app/api/AGENTS.md:0-0
Timestamp: 2025-09-28T12:33:56.322Z
Learning: Applies to app/api/**/*.{ts,tsx,js,jsx} : Never call fetch directly with user-controlled or scraped URLs in API code; use @/lib/security/urlGuard helpers (parsePublicUrl, assertPublicUrl, fetchPublicUrl, fetchPublicJson) so every hop is validated

Applied to files:

  • app/api/farcaster/route.ts
  • app/api/pepe/resolve/route.ts
📚 Learning: 2025-09-28T12:33:56.322Z
Learnt from: CR
PR: 6529-Collections/6529seize-frontend#0
File: app/api/AGENTS.md:0-0
Timestamp: 2025-09-28T12:33:56.322Z
Learning: Applies to app/api/**/route.{ts,js} : Catch UrlGuardError explicitly in route handlers if returning a tailored response; otherwise allow it to propagate so the correct status code surfaces

Applied to files:

  • app/api/farcaster/route.ts
📚 Learning: 2025-09-28T12:33:56.322Z
Learnt from: CR
PR: 6529-Collections/6529seize-frontend#0
File: app/api/AGENTS.md:0-0
Timestamp: 2025-09-28T12:33:56.322Z
Learning: Applies to app/api/**/*.{ts,tsx,js,jsx} : When custom headers or timeouts are needed for external requests, pass them via urlGuard helper options instead of rolling a custom wrapper

Applied to files:

  • app/api/farcaster/route.ts
🧬 Code graph analysis (4)
components/drops/view/part/dropPartMarkdown/linkUtils.tsx (2)
lib/url/domains.ts (1)
  • matchesDomainOrSubdomain (1-13)
next.config.mjs (2)
  • publicEnv (174-174)
  • publicEnv (232-232)
helpers/SeizeLinkParser.ts (1)
next.config.mjs (2)
  • publicEnv (174-174)
  • publicEnv (232-232)
app/api/farcaster/route.ts (2)
next.config.mjs (2)
  • publicEnv (174-174)
  • publicEnv (232-232)
types/farcaster.types.ts (3)
  • FarcasterProfilePreview (45-54)
  • FarcasterChannelPreview (56-68)
  • FarcasterFramePreview (70-80)
app/api/pepe/resolve/route.ts (3)
next.config.mjs (2)
  • publicEnv (174-174)
  • publicEnv (232-232)
lib/security/urlGuard.ts (1)
  • fetchPublicUrl (333-463)
components/waves/pepe/PepeCard.tsx (1)
  • PepeKind (5-5)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
  • GitHub Check: Analyze (javascript-typescript)
🔇 Additional comments (4)
components/drops/view/part/dropPartMarkdown/linkUtils.tsx (1)

56-72: LGTM: clearer domain checks with helper.

package.json (1)

11-12: Verified: no stale --no-lint or build:lint references outside package.json

app/api/farcaster/route.ts (1)

42-53: Good: Explicit urlGuard policy for frame/HTML fetches.

Explicit blockedHosts/blockedHostSuffixes align with our SSRF guardrails. No action needed.

If there’s a shared policy in @/lib/security/urlGuard (e.g., DEFAULT_PUBLIC_POLICY), consider reusing it to centralize updates. As per coding guidelines.

app/api/pepe/resolve/route.ts (1)

755-762: Ignore outdated ordering suggestion
The TokenScan API returns market history in descending timestamp order (newest first), so data[0] already yields the latest entry.

Likely an incorrect or invalid review comment.

Comment thread app/api/pepe/resolve/route.ts
Comment thread app/api/pepe/resolve/route.ts
Comment thread config/env.schema.ts
Comment thread helpers/SeizeLinkParser.ts Outdated
Comment thread next.config.mjs
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
components/drops/view/part/dropPartMarkdown/linkUtils.tsx (1)

83-96: Relative links are misclassified as external; tighten detection

current: treats any href not starting with BASE_ENDPOINT as external, so "/foo" opens in a new tab and gets rel=nofollow. Also type of isExternalLink becomes string | boolean when BASE_ENDPOINT is "", which is brittle.

Apply:

-  const baseEndpoint = publicEnv.BASE_ENDPOINT || "";
-  const isExternalLink = baseEndpoint && !href.startsWith(baseEndpoint);
+  const baseEndpoint = publicEnv.BASE_ENDPOINT ?? "";
+  const url = parseUrl(href);
+  const isAbsoluteHttp =
+    !!url && (url.protocol === "http:" || url.protocol === "https:");
+  const isExternalLink: boolean =
+    isAbsoluteHttp && (!baseEndpoint || url.origin !== baseEndpoint);

   const { onClick, ...restProps } = props;
   const anchorProps: AnchorHTMLAttributes<HTMLAnchorElement> & ExtraProps = {
     ...restProps,
     href,
   };

-  if (isExternalLink) {
+  if (isExternalLink) {
     anchorProps.rel = "noopener noreferrer nofollow";
     anchorProps.target = "_blank";
-  } else if (baseEndpoint) {
-    anchorProps.href = href.replace(baseEndpoint, "");
+  } else if (baseEndpoint && url && url.origin === baseEndpoint) {
+    anchorProps.href = `${url.pathname}${url.search}${url.hash}`;
   }

This treats relative links as internal, externalizes only absolute off-origin URLs, and avoids string-typed conditionals.

🧹 Nitpick comments (4)
app/api/pepe/resolve/route.ts (1)

104-107: IPFS gateway default OK; consider honoring project-wide IPFS setting

Now only publicEnv.IPFS_GATEWAY_ENDPOINT or ipfs.io is used. If the app relies on a custom gateway in non-public env, ensure it’s exposed via publicEnv; otherwise expect more ipfs.io rate-limiting.

app/api/farcaster/route.ts (1)

138-173: Unify external fetch with urlGuard helpers for timeouts/headers

You hand-roll AbortController and fetch; project guidance prefers urlGuard options for external requests to centralize policy, timeouts, and user-agent handling.

Example change:

-import { publicEnv } from "@/config/env";
+import { publicEnv } from "@/config/env";
+import { fetchPublicJson } from "@/lib/security/urlGuard";
@@
-const fetchWarpcastJson = async <T>(
+const fetchWarpcastJson = async <T>(
   path: string,
   params: Record<string, string | undefined>
 ): Promise<T | null> => {
   const url = buildWarpcastUrl(path, params);
-  const { controller, cancel } = createAbortController(FETCH_TIMEOUT_MS);
-
   try {
-    const response = await fetch(url, {
-      method: "GET",
-      headers: {
-        accept: "application/json",
-        "user-agent": USER_AGENT,
-      },
-      signal: controller.signal,
-    });
+    const response = await fetchPublicJson<T>(
+      url.toString(),
+      { headers: { accept: "application/json" } },
+      { timeoutMs: FETCH_TIMEOUT_MS, userAgent: USER_AGENT }
+    );
 
-    if (response.status === 404) {
-      return null;
-    }
-
-    if (!response.ok) {
-      throw new Error(`Warpcast request failed with status ${response.status}`);
-    }
-
-    return (await response.json()) as T;
+    return response;
   } catch (error) {
     if ((error as { name?: string }).name === "AbortError") {
       throw new Error("Warpcast request aborted");
     }
-    throw error instanceof Error ? error : new Error("Warpcast request failed");
+    throw error instanceof Error ? error : new Error("Warpcast request failed");
-  } finally {
-    cancel();
   }
 };

This also removes the need for createAbortController.

package.json (1)

11-11: Confirm ESLint-on-build and consolidate duplicate scripts

  • Removing --no-lint means npm run build now runs ESLint (no ignoreDuringBuilds override) and will fail on lint errors.
  • build and build:lint are identical; merge or remove one to avoid confusion.
config/env.schema.ts (1)

81-85: Guideline: comments in .ts/.tsx

The new comment block is fine for readability, but our guidelines say no comments in TS/TSX. Consider removing or moving notes to docs if enforcing that rule here. As per coding guidelines.

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between bbb48d1 and eba4ca5.

📒 Files selected for processing (7)
  • app/api/farcaster/route.ts (15 hunks)
  • app/api/pepe/resolve/route.ts (22 hunks)
  • components/drops/view/part/dropPartMarkdown/linkUtils.tsx (3 hunks)
  • config/env.schema.ts (1 hunks)
  • helpers/SeizeLinkParser.ts (1 hunks)
  • next.config.mjs (1 hunks)
  • package.json (1 hunks)
🧰 Additional context used
📓 Path-based instructions (6)
**/*.{ts,tsx}

📄 CodeRabbit inference engine (.cursorrules)

**/*.{ts,tsx}: Do not include any comments in the code
Use react-query for data fetching
Always add readonly before props

Use TypeScript for implementation code

Files:

  • components/drops/view/part/dropPartMarkdown/linkUtils.tsx
  • config/env.schema.ts
  • app/api/farcaster/route.ts
  • app/api/pepe/resolve/route.ts
  • helpers/SeizeLinkParser.ts
**/*.tsx

📄 CodeRabbit inference engine (.cursorrules)

**/*.tsx: Use FontAwesome for icons
Use TailwindCSS for styling

Use React functional components with hooks

Files:

  • components/drops/view/part/dropPartMarkdown/linkUtils.tsx
{app,pages}/**/*.{ts,tsx}

📄 CodeRabbit inference engine (.cursorrules)

Use NextJS features that match the current version

Files:

  • app/api/farcaster/route.ts
  • app/api/pepe/resolve/route.ts
app/api/**/*.{ts,tsx,js,jsx}

📄 CodeRabbit inference engine (app/api/AGENTS.md)

app/api/**/*.{ts,tsx,js,jsx}: Never call fetch directly with user-controlled or scraped URLs in API code; use @/lib/security/urlGuard helpers (parsePublicUrl, assertPublicUrl, fetchPublicUrl, fetchPublicJson) so every hop is validated
When custom headers or timeouts are needed for external requests, pass them via urlGuard helper options instead of rolling a custom wrapper

Files:

  • app/api/farcaster/route.ts
  • app/api/pepe/resolve/route.ts
app/api/**/route.{ts,js}

📄 CodeRabbit inference engine (app/api/AGENTS.md)

app/api/**/route.{ts,js}: Catch UrlGuardError explicitly in route handlers if returning a tailored response; otherwise allow it to propagate so the correct status code surfaces
Export HTTP verb handlers (e.g., GET) from route.ts files
Keep route.ts logic in small internal functions when it grows beyond ~200 lines
For edge caching behavior, prefer export const dynamic = "force-dynamic" or revalidate constants rather than inline headers
Follow project default responses (NextResponse.json) and reuse existing util modules instead of duplicating logic

Files:

  • app/api/farcaster/route.ts
  • app/api/pepe/resolve/route.ts
app/api/**/*.ts

📄 CodeRabbit inference engine (app/api/AGENTS.md)

Use TypeScript types for request parameters and responses; avoid any unless a third-party payload has no shape guarantees

Files:

  • app/api/farcaster/route.ts
  • app/api/pepe/resolve/route.ts
🧠 Learnings (6)
📚 Learning: 2025-09-28T12:33:56.322Z
Learnt from: CR
PR: 6529-Collections/6529seize-frontend#0
File: app/api/AGENTS.md:0-0
Timestamp: 2025-09-28T12:33:56.322Z
Learning: Applies to app/api/**/route.{ts,js} : Catch UrlGuardError explicitly in route handlers if returning a tailored response; otherwise allow it to propagate so the correct status code surfaces

Applied to files:

  • app/api/farcaster/route.ts
  • app/api/pepe/resolve/route.ts
📚 Learning: 2025-09-28T12:33:56.322Z
Learnt from: CR
PR: 6529-Collections/6529seize-frontend#0
File: app/api/AGENTS.md:0-0
Timestamp: 2025-09-28T12:33:56.322Z
Learning: Applies to app/api/**/*.{ts,tsx,js,jsx} : When custom headers or timeouts are needed for external requests, pass them via urlGuard helper options instead of rolling a custom wrapper

Applied to files:

  • app/api/farcaster/route.ts
📚 Learning: 2025-09-28T12:33:56.322Z
Learnt from: CR
PR: 6529-Collections/6529seize-frontend#0
File: app/api/AGENTS.md:0-0
Timestamp: 2025-09-28T12:33:56.322Z
Learning: Applies to app/api/**/route.{ts,js} : Follow project default responses (NextResponse.json) and reuse existing util modules instead of duplicating logic

Applied to files:

  • app/api/pepe/resolve/route.ts
📚 Learning: 2025-09-28T12:33:56.322Z
Learnt from: CR
PR: 6529-Collections/6529seize-frontend#0
File: app/api/AGENTS.md:0-0
Timestamp: 2025-09-28T12:33:56.322Z
Learning: Applies to app/api/**/*.{ts,tsx,js,jsx} : Never call fetch directly with user-controlled or scraped URLs in API code; use @/lib/security/urlGuard helpers (parsePublicUrl, assertPublicUrl, fetchPublicUrl, fetchPublicJson) so every hop is validated

Applied to files:

  • app/api/pepe/resolve/route.ts
📚 Learning: 2025-09-28T12:33:56.322Z
Learnt from: CR
PR: 6529-Collections/6529seize-frontend#0
File: app/api/AGENTS.md:0-0
Timestamp: 2025-09-28T12:33:56.322Z
Learning: All changes must pass npm run test, npm run lint, and npm run type-check (or test:cov:changed when appropriate)

Applied to files:

  • package.json
📚 Learning: 2025-09-28T12:33:30.941Z
Learnt from: CR
PR: 6529-Collections/6529seize-frontend#0
File: __tests__/AGENTS.md:0-0
Timestamp: 2025-09-28T12:33:30.941Z
Learning: Run `npm run test:cov:changed` for changed-file tests and coverage; use `npm run test` for full suite; ensure `npm run lint` and `npm run type-check` pass

Applied to files:

  • package.json
🧬 Code graph analysis (4)
components/drops/view/part/dropPartMarkdown/linkUtils.tsx (2)
lib/url/domains.ts (1)
  • matchesDomainOrSubdomain (1-13)
next.config.mjs (2)
  • publicEnv (174-174)
  • publicEnv (232-232)
app/api/farcaster/route.ts (1)
next.config.mjs (2)
  • publicEnv (174-174)
  • publicEnv (232-232)
app/api/pepe/resolve/route.ts (3)
next.config.mjs (2)
  • publicEnv (174-174)
  • publicEnv (232-232)
lib/security/urlGuard.ts (1)
  • fetchPublicUrl (333-463)
components/waves/pepe/PepeCard.tsx (1)
  • PepeKind (5-5)
helpers/SeizeLinkParser.ts (1)
next.config.mjs (2)
  • publicEnv (174-174)
  • publicEnv (232-232)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
  • GitHub Check: Analyze (javascript-typescript)
🔇 Additional comments (3)
components/drops/view/part/dropPartMarkdown/linkUtils.tsx (1)

83-85: Ensure BASE_ENDPOINT is always present in publicEnv

With the process.env fallback removed, an empty BASE_ENDPOINT makes internal/external resolution ambiguous. Verify that next.config.mjs always bakes BASE_ENDPOINT into publicEnv in all environments (dev, preview, prod). If not guaranteed, consider a safe runtime fallback.

app/api/farcaster/route.ts (1)

25-33: Env wiring looks good

Switch to publicEnv for WARPCAST base/key is consistent with the PR objective.

Please confirm FARCASTER_WARPCAST_API_BASE and KEY are exposed in next.config.mjs baked runtime across all envs.

helpers/SeizeLinkParser.ts (1)

29-33: Ignore origin fallback suggestion: BASE_ENDPOINT is always required and validated

BASE_ENDPOINT is declared as a required URL in config/env.schema.ts and will fail startup if unset or invalid, ensuring it’s non-empty in all environments. No extra fallback for window.location.origin is needed.

Likely an incorrect or invalid review comment.

Comment thread app/api/pepe/resolve/route.ts
Comment thread app/api/pepe/resolve/route.ts
Comment thread next.config.mjs
Signed-off-by: prxt6529 <prxt@6529.io>
Signed-off-by: prxt6529 <prxt@6529.io>
Signed-off-by: prxt6529 <prxt@6529.io>
Signed-off-by: prxt6529 <prxt@6529.io>
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 6c6d7dd and c92668c.

📒 Files selected for processing (1)
  • package.json (2 hunks)
🧰 Additional context used
🧠 Learnings (3)
📚 Learning: 2025-09-28T12:33:56.322Z
Learnt from: CR
PR: 6529-Collections/6529seize-frontend#0
File: app/api/AGENTS.md:0-0
Timestamp: 2025-09-28T12:33:56.322Z
Learning: All changes must pass npm run test, npm run lint, and npm run type-check (or test:cov:changed when appropriate)

Applied to files:

  • package.json
📚 Learning: 2025-09-28T12:33:30.941Z
Learnt from: CR
PR: 6529-Collections/6529seize-frontend#0
File: __tests__/AGENTS.md:0-0
Timestamp: 2025-09-28T12:33:30.941Z
Learning: Run `npm run test:cov:changed` for changed-file tests and coverage; use `npm run test` for full suite; ensure `npm run lint` and `npm run type-check` pass

Applied to files:

  • package.json
📚 Learning: 2025-09-28T12:32:36.068Z
Learnt from: CR
PR: 6529-Collections/6529seize-frontend#0
File: AGENTS.md:0-0
Timestamp: 2025-09-28T12:32:36.068Z
Learning: Before completing any task, ensure npm run test, npm run lint, and npm run type-check all succeed; you may use npm run test:cov:changed for small changes; docs-only changes need not run tests

Applied to files:

  • package.json

Comment thread package.json Outdated
Signed-off-by: prxt6529 <prxt@6529.io>
Signed-off-by: prxt6529 <prxt@6529.io>
Signed-off-by: prxt6529 <prxt@6529.io>
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between f97f981 and 94beccf.

⛔ Files ignored due to path filters (1)
  • package-lock.json is excluded by !**/package-lock.json
📒 Files selected for processing (2)
  • next.config.mjs (3 hunks)
  • package.json (2 hunks)
🧰 Additional context used
🧠 Learnings (1)
📚 Learning: 2025-09-28T12:33:30.941Z
Learnt from: CR
PR: 6529-Collections/6529seize-frontend#0
File: __tests__/AGENTS.md:0-0
Timestamp: 2025-09-28T12:33:30.941Z
Learning: Run `npm run test:cov:changed` for changed-file tests and coverage; use `npm run test` for full suite; ensure `npm run lint` and `npm run type-check` pass

Applied to files:

  • package.json
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
  • GitHub Check: Analyze (javascript-typescript)
🔇 Additional comments (1)
next.config.mjs (1)

221-222: Stop exposing FARCASTER_WARPCAST_API_KEY to the client bundle.

Adding FARCASTER_WARPCAST_API_KEY to env ships it with every client build, so anyone can read the key in the browser. Keep only non-sensitive values here and load the API key from a server-only source (process.env or a server env schema) inside the API route instead.

-        FARCASTER_WARPCAST_API_BASE: publicEnv.FARCASTER_WARPCAST_API_BASE,
-        FARCASTER_WARPCAST_API_KEY: publicEnv.FARCASTER_WARPCAST_API_KEY,
+        FARCASTER_WARPCAST_API_BASE: publicEnv.FARCASTER_WARPCAST_API_BASE,

Comment thread package.json
Signed-off-by: prxt6529 <prxt@6529.io>
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 0

🧹 Nitpick comments (1)
components/datePickerModal/DatePickerModal.module.scss (1)

5-34: Consolidate repeated modal background color

rgb(40, 40, 40) is hard-coded (and marked !important) in the header, body, and footer. If we ever adjust the modal theme, we’ll have to touch three declarations. Please consider introducing or reusing a single SCSS token/mixin so the modal background can be tweaked in one place.

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 94beccf and 482f522.

📒 Files selected for processing (1)
  • components/datePickerModal/DatePickerModal.module.scss (2 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
  • GitHub Check: Analyze (javascript-typescript)

Signed-off-by: prxt6529 <prxt@6529.io>
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
components/datePickerModal/DatePickerModal.tsx (1)

48-57: Prevent Invalid Date and compare actual dates

applyDate can call onApplyDate with empty strings (Invalid Date) and compares strings lexicographically.

   function applyDate() {
-    if (fromDate && toDate) {
-      if (fromDate > toDate) {
-        setError("The start date must be before the end date.");
-        return;
-      }
-    }
-    props.onApplyDate?.(new Date(fromDate), new Date(toDate));
-    props.onHide();
+    if (!fromDate || !toDate) {
+      setError("Please select a start and end date.");
+      return;
+    }
+    const from = new Date(fromDate);
+    const to = new Date(toDate);
+    if (isNaN(from.getTime()) || isNaN(to.getTime())) {
+      setError("Please enter valid dates.");
+      return;
+    }
+    if (from.getTime() > to.getTime()) {
+      setError("The start date must be before the end date.");
+      return;
+    }
+    props.onApplyDate?.(from, to);
+    props.onHide();
   }
🧹 Nitpick comments (5)
components/datePickerModal/DatePickerModal.tsx (5)

30-37: Normalize date state to 'YYYY-MM-DD' to avoid timezone drift

State mixes full ISO strings and 'YYYY-MM-DD', and value props re-ISO the state, which can shift dates across timezones.

   useEffect(() => {
-    if (props.initial_from_date)
-      setFromDate(props.initial_from_date.toISOString());
+    if (props.initial_from_date) {
+      setFromDate(props.initial_from_date.toISOString().slice(0, 10));
+    } else {
+      setFromDate("");
+    }
   }, [props.initial_from_date]);

   useEffect(() => {
-    if (props.initial_to_date) setToDate(props.initial_to_date.toISOString());
+    if (props.initial_to_date) {
+      setToDate(props.initial_to_date.toISOString().slice(0, 10));
+    } else {
+      setToDate("");
+    }
   }, [props.initial_to_date]);
-                    <Form.Control
-                      value={
-                        fromDate &&
-                        new Date(fromDate)?.toISOString().slice(0, 10)
-                      }
+                    <Form.Control
+                      value={fromDate}
                       max={new Date().toISOString().slice(0, 10)}
-                    <Form.Control
-                      value={
-                        toDate && new Date(toDate)?.toISOString().slice(0, 10)
-                      }
+                    <Form.Control
+                      value={toDate}
                       max={new Date().toISOString().slice(0, 10)}

Optional: compute a local-time “today” for max to avoid off-by-one near midnight:
new Date(Date.now() - new Date().getTimezoneOffset() * 60000).toISOString().slice(0, 10).

Also applies to: 100-107, 143-147


62-69: Validate non-negative block heights

Blocks should be ≥ 0; add a guard before the range check.

     if (isNaN(fromBlockInt) || isNaN(toBlockInt)) {
       setError("Please enter a valid start and end block.");
       return;
     }
+    if (fromBlockInt < 0 || toBlockInt < 0) {
+      setError("Block numbers must be non-negative.");
+      return;
+    }
     if (fromBlockInt > toBlockInt) {
       setError("The start block must be before the end block.");
       return;
     }

7-7: Styling stack deviates from Tailwind guideline

This component uses SCSS + Bootstrap classes. Our guidelines prefer TailwindCSS in .tsx files. Consider migrating styles when practical; not blocking this PR.

As per coding guidelines.


83-83: Avoid inline wrappers for simple handlers

Pass props.onHide directly to avoid recreating closures.

-    <Modal show={props.show} onHide={() => props.onHide()} aria-labelledby="date-picker-title">
+    <Modal show={props.show} onHide={props.onHide} aria-labelledby="date-picker-title">
-                <Button
-                  className="seize-btn-link"
-                  onClick={() => props.onHide()}>
+                <Button
+                  className="seize-btn-link"
+                  onClick={props.onHide}>

Also applies to: 194-196


3-3: Future-proof icon name (optional)

If/when upgrading Font Awesome, consider faCircleXmark (v6) instead of legacy faTimesCircle.

Based on learnings.

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 482f522 and 2284047.

📒 Files selected for processing (1)
  • components/datePickerModal/DatePickerModal.tsx (2 hunks)
🧰 Additional context used
📓 Path-based instructions (2)
**/*.{ts,tsx}

📄 CodeRabbit inference engine (.cursorrules)

**/*.{ts,tsx}: Do not include any comments in the code
Use react-query for data fetching
Always add readonly before props

Use TypeScript for implementation code

Files:

  • components/datePickerModal/DatePickerModal.tsx
**/*.tsx

📄 CodeRabbit inference engine (.cursorrules)

**/*.tsx: Use FontAwesome for icons
Use TailwindCSS for styling

Use React functional components with hooks

Files:

  • components/datePickerModal/DatePickerModal.tsx
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
  • GitHub Check: Analyze (javascript-typescript)
🔇 Additional comments (1)
components/datePickerModal/DatePickerModal.tsx (1)

3-7: Import reordering looks fine

FontAwesome first, then react-bootstrap and styles is OK; no side-effect concerns here.

Comment thread components/datePickerModal/DatePickerModal.tsx
Signed-off-by: prxt6529 <prxt@6529.io>
@sonarqubecloud
Copy link
Copy Markdown

Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 0

🧹 Nitpick comments (2)
package.json (2)

11-11: Avoid direct use of base-build.

base-build skips npm prebuild/postbuild if invoked directly. Consider renaming to _base-build and documenting “do not call directly”; keep build/build:lint as the public entry points.

-"base-build": "cross-env NODE_OPTIONS=--max-old-space-size=7680 next build",
+"_base-build": "cross-env NODE_OPTIONS=--max-old-space-size=7680 next build",
-"build": "npm run lint:quiet && npm run base-build",
+"build": "npm run lint:quiet && npm run _base-build",
-"build:lint": "npm run prebuild && npm run lint && npm run base-build && npm run postbuild",
+"build:lint": "npm run prebuild && npm run lint && npm run _base-build && npm run postbuild",

31-32: Unify lint tooling for fixes.

lint uses next lint while lint:fix uses raw eslint. For consistency, consider using next lint --fix.

-"lint:fix": "npx eslint . --ext .ts,.tsx,.js,.jsx --fix"
+"lint:fix": "next lint --fix"
📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 2284047 and a53c5f8.

📒 Files selected for processing (1)
  • package.json (2 hunks)
🧰 Additional context used
🧠 Learnings (1)
📚 Learning: 2025-09-28T12:33:30.941Z
Learnt from: CR
PR: 6529-Collections/6529seize-frontend#0
File: __tests__/AGENTS.md:0-0
Timestamp: 2025-09-28T12:33:30.941Z
Learning: Run `npm run test:cov:changed` for changed-file tests and coverage; use `npm run test` for full suite; ensure `npm run lint` and `npm run type-check` pass

Applied to files:

  • package.json
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
  • GitHub Check: Analyze (javascript-typescript)
🔇 Additional comments (2)
package.json (2)

3-3: Version bump to 1.0.0: housekeeping.

Confirm CHANGELOG/release notes and Git tag align with semver-major, and that any breaking changes are documented.


12-13: Lifecycle hooks retained.

  • Ensure your CI pipeline installs dependencies (e.g. npm ci) before running npm run build/lint/test so that tsc, next, and jest binaries are available.
  • Add generated/ to .eslintignore to prevent linting generated files.
⛔ Skipped due to learnings
Learnt from: CR
PR: 6529-Collections/6529seize-frontend#0
File: app/api/AGENTS.md:0-0
Timestamp: 2025-09-28T12:33:56.322Z
Learning: All changes must pass npm run test, npm run lint, and npm run type-check (or test:cov:changed when appropriate)
Learnt from: CR
PR: 6529-Collections/6529seize-frontend#0
File: AGENTS.md:0-0
Timestamp: 2025-09-28T12:32:36.068Z
Learning: Before completing any task, ensure npm run test, npm run lint, and npm run type-check all succeed; you may use npm run test:cov:changed for small changes; docs-only changes need not run tests
Learnt from: CR
PR: 6529-Collections/6529seize-frontend#0
File: __tests__/AGENTS.md:0-0
Timestamp: 2025-09-28T12:33:30.941Z
Learning: Run `npm run test:cov:changed` for changed-file tests and coverage; use `npm run test` for full suite; ensure `npm run lint` and `npm run type-check` pass

@prxt6529 prxt6529 merged commit 0cc63ab into main Sep 30, 2025
9 checks passed
@prxt6529 prxt6529 deleted the process-env-fix branch September 30, 2025 06:54
This was referenced Oct 13, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants