Wire calendar source registry intent UI - #248
Conversation
|
Warning Review limit reached
More reviews will be available in 28 minutes and 11 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughThe pull request introduces server-authoritative calendar writeback source selection via a new GET endpoint, updates the frontend to fetch and display sources before posting intent, and hardens the Strix CI gate to reject GitHub Models routing while enforcing direct OpenAI Platform credentials. Documentation and governance rules are updated to reflect the new policy constraints. ChangesCalendar Writeback Source Selection
Strix CI Gate Hardening Against GitHub Models
Governance and Architecture Policy Updates
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
frontend/src/components/CalendarLayout.tsx (1)
75-89:⚠️ Potential issue | 🟠 Major | ⚡ Quick winBlock intent POSTs until source registry readiness is confirmed.
On Line 75, the guard only blocks when sources are
readyand missing. Duringloading/error, the code can still POST/api/calendar/writeback-intentwithouttarget_source_id, which breaks the source-first contract.🔧 Proposed fix
+ const isSourceRegistryReady = sourceLoadStatus === 'ready'; const requestWritebackIntent = useCallback(async (action: 'create' | 'update') => { - if (sourceLoadStatus === 'ready' && selectedWritebackSource === null) { + if (!isSourceRegistryReady) { + setWritebackResult(null); + setWritebackStatus(sourceLoadStatus === 'error' ? 'error' : 'loading'); + return; + } + if (selectedWritebackSource === null) { setWritebackResult(null); setWritebackStatus('no_source'); return; } @@ - }, [selectedWritebackSource, sourceLoadStatus]); + }, [isSourceRegistryReady, selectedWritebackSource, sourceLoadStatus]); @@ - disabled={isWritebackLoading} + disabled={isWritebackLoading || !isSourceRegistryReady} @@ - disabled={isWritebackLoading} + disabled={isWritebackLoading || !isSourceRegistryReady}As per coding guidelines: "Calendar and WebDAV writeback source selection must resolve through opaque
source_uidvalues, signed-session organization scope, and persisted writeback eligibility... missing eligibility must fail closed."Also applies to: 104-105, 187-196
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@frontend/src/components/CalendarLayout.tsx` around lines 75 - 89, The current flow attempts the writeback-intent POST even when source registry hasn't confirmed readiness; update the guard around the POST so it only proceeds when sourceLoadStatus === 'ready' and selectedWritebackSource is non-null (otherwise setWritebackStatus('no_source') and return), ensuring any paths that would call apiClient.post('/api/calendar/writeback-intent', ...) include a resolved selectedWritebackSource.target_source_id; apply the same “fail closed” check to the other occurrences noted (the blocks around the code handling lines referenced as 104-105 and 187-196) so writeback requests never go out without a confirmed source UID/target_source_id.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@frontend/src/components/CalendarLayout.tsx`:
- Around line 75-89: The current flow attempts the writeback-intent POST even
when source registry hasn't confirmed readiness; update the guard around the
POST so it only proceeds when sourceLoadStatus === 'ready' and
selectedWritebackSource is non-null (otherwise setWritebackStatus('no_source')
and return), ensuring any paths that would call
apiClient.post('/api/calendar/writeback-intent', ...) include a resolved
selectedWritebackSource.target_source_id; apply the same “fail closed” check to
the other occurrences noted (the blocks around the code handling lines
referenced as 104-105 and 187-196) so writeback requests never go out without a
confirmed source UID/target_source_id.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: b4b0c62b-bd7f-43fb-87fc-9a32b48da237
📒 Files selected for processing (14)
AGENTS.mdARCHITECTURE.mdREADME.mdbackend/api/calendar.pybackend/tests/test_calendar_api.pydocs/operations/source-of-truth-and-writeback-sovereignty.mddocs/plans/2026-05-27-calendar-writeback-intent-ui.mdfrontend/src/app/calendar/page.test.tsxfrontend/src/components/CalendarLayout.tsxfrontend/tests/e2e/dashboard-branding.spec.tsfrontend/tests/e2e/helpers.tsscripts/ci/strix_quick_gate.shscripts/ci/test_pr_governance_gate.shscripts/ci/test_strix_quick_gate.sh
|
PR governance metadata gate is not ready for
|
|
Current-head Strix evidence for
Local and remote substitute evidence tied to this PR:
Temporary merge handling: remove only required context |
|
Restored required status checks immediately after normal merge. Current master required contexts are strict |
1 participant
Summary
/api/calendar/writeback-sourcesand test server-authoritative CalDAV source registry readstarget_source_idvalues before posting writeback intentVerification
env -u NO_COLOR -u FORCE_COLOR npm test -- --run src/app/calendar/page.test.tsxPYTHONDONTWRITEBYTECODE=1 DISABLE_BACKGROUND_WORKERS=1 python3 -m pytest backend/tests/test_calendar_api.py backend/tests/test_release_governance.py -qenv -u NO_COLOR -u FORCE_COLOR npm run typecheckenv -u NO_COLOR -u FORCE_COLOR npm run lintenv -u NO_COLOR -u FORCE_COLOR NEXT_TELEMETRY_DISABLED=1 POSTCSS_WORKERS=1 DISABLE_POSTCSS_WORKERS=true NEXT_STATIC_GENERATION_MAX_CONCURRENCY=1 npm run buildenv -u NO_COLOR -u FORCE_COLOR LIVE_BASE_URL=http://127.0.0.1:18141 npm run test:e2e -- --project=desktop --project=mobile -g "calendar writeback|validates mobile hamburger composition"frontend/test-resultsbash scripts/ci/test_pr_governance_gate.shenv -u NO_COLOR -u FORCE_COLOR bash scripts/ci/test_strix_quick_gate.shSecurity/Governance
STRIX_OPENAI_API_KEY; no GitHub Models path, nomodels: read, and nogithub.tokenLLM key.🤖 Generated with Codex
Summary by CodeRabbit
New Features
Documentation
Tests