dev

[RambokDev]

Summary by CodeRabbit

• New Features

  • Added optional configuration for customizing the backup storage folder.
  • Backup uploads, migrations, and storage channels now consistently use the configured folder.
  • Added validation to prevent unsafe or invalid backup paths.

• Bug Fixes

  • File upload hooks now accept backup paths using the configured folder while continuing to reject invalid formats.
  • Backup folder names are safely normalized and default to backups when unspecified.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 669ddd22-1cb9-4226-8769-5f8dc7690f3a

📥 Commits

Reviewing files that changed from the base of the PR and between f685f90 and e298387.

📒 Files selected for processing (1)

• src/utils/file-prefix.ts

📜 Recent review details

⏰ Context from checks skipped due to timeout. (1)

• GitHub Check: build-image

🔇 Additional comments (1)

src/utils/file-prefix.ts (1)

5-32: LGTM!

---

📝 Walkthrough

Walkthrough

Backup storage paths are now configurable through BACKUP_FOLDER_NAME, with normalization, validation, and a "backups" fallback. Storage uploads, migrations, channel metadata, and TUS file-path validation use the derived folder name.

Changes

Configurable backup folder

Layer / File(s)	Summary
Backup folder configuration .env.example, src/env.mjs, src/utils/file-prefix.ts, src/utils/text.ts	Adds optional environment configuration, safe path normalization and validation, a default folder name, and regular-expression escaping.
Storage and migration path propagation src/features/storages/..., src/features/migration/..., src/features/agents/...	Uses the derived folder name for stored backups, migrated copies, and returned storage-channel metadata.
TUS path validation app/api/tus/hooks/route.ts	Builds FILE_PATH_RE from the configured folder name while retaining invalid-path rejection with HTTP 400.

Estimated code review effort: 2 (Simple) | ~15 minutes

Possibly related PRs

• Portabase/portabase#355: Modifies TUS X-File-Path validation logic.
• Portabase/portabase#356: Updates backup namespace handling in storage channels and backup paths.

Poem

A bunny found a folder to name,
No longer hardcoded in the same.
Paths hop safely, regexes agree,
Backups bloom where they’re meant to be.
Thump, thump—configurability!

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check	❓ Inconclusive	The title is too generic and does not describe the actual change in the pull request.	Rename the PR to summarize the main change, such as adding configurable backup folder handling.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install timed out. The project may have too many dependencies for the sandbox.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/utils/file-prefix.ts`:
- Around line 4-15: Update getBackupFolderName to reject BACKUP_FOLDER_NAME
values containing traversal segments such as ".." and ensure the accepted value
remains a confined relative folder before backup paths are built. Preserve the
existing trimming, separator normalization, filtering, and "backups" fallback
for valid values, and ensure backupFolderName continues to derive from the
validated result.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: ffa8e5f5-cbe8-4748-9ebf-a7a89851e88c

📥 Commits

Reviewing files that changed from the base of the PR and between 1b4db43 and f685f90.

📒 Files selected for processing (9)

• .env.example
• app/api/tus/hooks/route.ts
• src/env.mjs
• src/features/agents/utils/status/storage-channels.helpers.ts
• src/features/migration/actions/migration.action.ts
• src/features/storages/utils/storages.helpers.ts
• src/utils/common.ts
• src/utils/file-prefix.ts
• src/utils/text.ts

📜 Review details

⏰ Context from checks skipped due to timeout. (1)

• GitHub Check: build-image

🧰 Additional context used

🪛 ast-grep (0.44.1)

app/api/tus/hooks/route.ts

[warning] 12-14: Regular expression constructed from variable input detected. This can lead to Regular Expression Denial of Service (ReDoS) attacks if the variable contains malicious patterns. Use libraries like 'recheck' to validate regex safety or use static patterns.
Context: new RegExp(
^${backupFolderName}/\\d{4}-\\d{2}-\\d{2}/[A-Za-z0-9._-]+$,
)
Note: [CWE-1333] Inefficient Regular Expression Complexity

(regexp-from-variable)

🔇 Additional comments (8)

src/env.mjs (1)

69-70: LGTM!

Also applies to: 159-159

src/utils/text.ts (1)

68-72: LGTM!

.env.example (1)

76-79: LGTM!

src/utils/common.ts (1)

9-9: LGTM!

src/features/storages/utils/storages.helpers.ts (1)

1-1: LGTM!

Also applies to: 18-18, 60-60

src/features/migration/actions/migration.action.ts (1)

12-12: LGTM!

Also applies to: 94-94

src/features/agents/utils/status/storage-channels.helpers.ts (1)

1-11: LGTM!

Also applies to: 30-31, 42-42, 61-61

app/api/tus/hooks/route.ts (1)

9-15: LGTM!

Also applies to: 36-43