Repository navigation
feat: add attestation identity relay - #37
Conversation
Add the Convex-side attestation store and internal relay routes for challenge issuance, opaque attestation resolution, coupling proofs, payment anchors, and blocked-identity unlock gating. Wire attestation into the production regression surface and external integration gate, and cover the seeded coupling job path with a closed-service seed relay test. Verified with bun audit, bun run lint, bun run typecheck, bun run test:convex, bun run test:external-integrations, bun run test:ci, targeted Convex attestation/coupling tests, and the production regression loop test.
|
@coderabbitai review |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (3)
📜 Recent review details⏰ Context from checks skipped due to timeout. (1)
🧰 Additional context used📓 Path-based instructions (2)**/*.{ts,tsx,js,jsx}⚙️ CodeRabbit configuration file
Files:
**/*test*⚙️ CodeRabbit configuration file
Files:
🔇 Additional comments (4)
📝 WalkthroughWalkthroughThis PR adds attestation storage, identity review, HTTP relay endpoints, coupling-seed derivation, protected-unlock gating, and regression and realtest coverage. ChangesAttestation and coupling flow
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Caution Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional.
❌ Failed checks (6 errors, 1 warning)
✅ Passed checks (14 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
|
✅ Action performedReview finished.
|
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
creator-assistant-dashboard | 861b530 | Commit Preview URL Branch Preview URL |
Jun 25 2026, 06:58 PM |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 40ada9ca79
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 9
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 48d9fb50-81d8-404b-81f8-290c7cdf86d1
⛔ Files ignored due to path filters (1)
convex/_generated/api.d.tsis excluded by!**/_generated/**
📒 Files selected for processing (9)
convex/attestation.realtest.tsconvex/attestation.tsconvex/couplingJobAndReveal.realtest.tsconvex/http.tsconvex/schema.tsconvex/tsconfig.tsbuildinfoconvex/yucpLicenses.tsops/production-regression-loop.test.tsops/production-regression-loop.ts
📜 Review details
⏰ Context from checks skipped due to timeout. (1)
- GitHub Check: Workers Builds: creator-assistant-dashboard
🧰 Additional context used
📓 Path-based instructions (2)
**/*.{ts,tsx,js,jsx}
⚙️ CodeRabbit configuration file
**/*.{ts,tsx,js,jsx}: Act as a strict TypeScript and JavaScript security auditor.
Aggressively flag:
- SSRF, injection, XSS, prototype pollution, insecure redirects, unsafe dynamic imports, eval-like APIs, and shell command construction
- API routes, server actions, RPC handlers, middleware, loaders, actions, edge functions, and webhooks without explicit authentication, authorization, CSRF protection where applicable, tenant isolation, and input validation
- unsafe JSON parsing, schema gaps, mass assignment, confused-deputy issues, trusting client-controlled IDs or roles, and unsafe use of headers or cookies
- tokens, secrets, private config, server-only env vars, API keys, tenant data, PII, or internal endpoints exposed to client bundles, hydration payloads, browser storage, source maps, analytics, logs, errors, or public assets
- logging of request headers, cookies, tokens, user payloads, PII, tenant IDs, raw errors, or internal stack traces
- non-robust workloads in Node runtimes, including missing abort signals, missing timeouts, unbounded promises, unbounded queues, unbounded response bodies, and event-loop blocking work
Files:
ops/production-regression-loop.test.tsconvex/couplingJobAndReveal.realtest.tsconvex/attestation.realtest.tsops/production-regression-loop.tsconvex/http.tsconvex/yucpLicenses.tsconvex/schema.tsconvex/attestation.ts
**/*test*
⚙️ CodeRabbit configuration file
**/*test*: Security still matters in tests.
Flag real-looking credentials, copied production tokens, unsafe fixtures with live endpoints, disabled TLS verification without isolation, frontend snapshots containing sensitive data, test logs that reveal secrets or PII, and tests that normalize insecure patterns.
Test-only bypasses must be isolated, obvious, and impossible to activate in production.
Files:
ops/production-regression-loop.test.tsconvex/couplingJobAndReveal.realtest.tsconvex/attestation.realtest.tsconvex/attestation.ts
🔇 Additional comments (3)
convex/schema.ts (1)
3161-3166: LGTM!convex/attestation.realtest.ts (1)
1-293: LGTM!convex/http.ts (1)
1911-1915: 🎯 Functional CorrectnessNo duplicate declarations to remove — the two
let bodydeclarations are in separate route handlers, andanchorsonly appears once in the record payload.> Likely an incorrect or invalid review comment.
Address review feedback by checking every attestation row for a license subject, moving block records when identity nodes merge, and keeping nodes blocked while any active block remains. Adds regressions for reused license subjects, merged block records, and multi-block appeal state. Verified with bun audit, bun run lint, bun run typecheck, bun run test:convex, bun run test:external-integrations, and bun run test:ci.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8dcf0e82ee
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
convex/attestation.ts (1)
54-64: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winRecompute survivor block status from the moved block records.
Lines 54-60 move block rows to
intoId, but lines 62-64 only preserve blocking when either node status was already'blocked'. IffromIdhas an active block row while its node status is stale/'active', the active block is moved and the survivor remains unblocked, so unlock gating can return false.Proposed fix
const blocks = await ctx.db .query('blocked_identities') .withIndex('by_identity_node', (q) => q.eq('identityNodeId', fromId)) .collect(); + const existingIntoBlocks = await ctx.db + .query('blocked_identities') + .withIndex('by_identity_node', (q) => q.eq('identityNodeId', intoId)) + .collect(); + const hasActiveBlock = + blocks.some((block) => block.status === 'active') || + existingIntoBlocks.some((block) => block.status === 'active'); for (const block of blocks) { await ctx.db.patch(block._id, { identityNodeId: intoId, updatedAt: now }); } await ctx.db.patch(fromId, { status: 'active', mergedFromNodeId: intoId, updatedAt: now }); - if (fromNode?.status === 'blocked' || intoNode?.status === 'blocked') { + if (fromNode?.status === 'blocked' || intoNode?.status === 'blocked' || hasActiveBlock) { await ctx.db.patch(intoId, { status: 'blocked', updatedAt: now }); }As per path instructions,
**/*.{ts,tsx,js,jsx}: Act as a strict TypeScript and JavaScript security auditor.Source: Path instructions
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: a8c01f2e-79f5-407e-956e-348c54a0bca0
📒 Files selected for processing (2)
convex/attestation.realtest.tsconvex/attestation.ts
📜 Review details
⏰ Context from checks skipped due to timeout. (4)
- GitHub Check: Type Check
- GitHub Check: Test
- GitHub Check: Workers Builds: creator-assistant-dashboard
- GitHub Check: Analyze (javascript-typescript)
🧰 Additional context used
📓 Path-based instructions (2)
**/*.{ts,tsx,js,jsx}
⚙️ CodeRabbit configuration file
**/*.{ts,tsx,js,jsx}: Act as a strict TypeScript and JavaScript security auditor.
Aggressively flag:
- SSRF, injection, XSS, prototype pollution, insecure redirects, unsafe dynamic imports, eval-like APIs, and shell command construction
- API routes, server actions, RPC handlers, middleware, loaders, actions, edge functions, and webhooks without explicit authentication, authorization, CSRF protection where applicable, tenant isolation, and input validation
- unsafe JSON parsing, schema gaps, mass assignment, confused-deputy issues, trusting client-controlled IDs or roles, and unsafe use of headers or cookies
- tokens, secrets, private config, server-only env vars, API keys, tenant data, PII, or internal endpoints exposed to client bundles, hydration payloads, browser storage, source maps, analytics, logs, errors, or public assets
- logging of request headers, cookies, tokens, user payloads, PII, tenant IDs, raw errors, or internal stack traces
- non-robust workloads in Node runtimes, including missing abort signals, missing timeouts, unbounded promises, unbounded queues, unbounded response bodies, and event-loop blocking work
Files:
convex/attestation.realtest.tsconvex/attestation.ts
**/*test*
⚙️ CodeRabbit configuration file
**/*test*: Security still matters in tests.
Flag real-looking credentials, copied production tokens, unsafe fixtures with live endpoints, disabled TLS verification without isolation, frontend snapshots containing sensitive data, test logs that reveal secrets or PII, and tests that normalize insecure patterns.
Test-only bypasses must be isolated, obvious, and impossible to activate in production.
Files:
convex/attestation.realtest.tsconvex/attestation.ts
🔇 Additional comments (2)
convex/attestation.ts (1)
263-276: LGTM!Also applies to: 410-426
convex/attestation.realtest.ts (1)
44-70: LGTM!Also applies to: 121-131, 158-192, 296-325
Validate attestation relay payloads before mutation, bind consumed nonces back to submitted correlation IDs, and keep internal identifiers out of relay responses. Make identity resolution deterministic by using durable anchors for node selection, preserving soft anchors as labels, and resolving reused license subjects through their latest attestation. Harden coupling seed derivation with blank-secret fallback, bounded responses, redirect rejection, and AbortController timeouts. Add regressions for relay validation, block-aware unlock denial, soft-anchor non-merges, and latest-node payment/proof linking.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 89a57b6a4c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
Actionable comments posted: 6
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
convex/yucpLicenses.ts (1)
1247-1250: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winUse a null-prototype map for relay-controlled asset keys.
assetPathultimately comes from request/relay data. With{}, keys liketoStringor__proto__can resolve inherited properties and make the later seed lookup treat a non-seed value as present. Use a null-prototype object orMap, and only accept seeds for requested paths.Suggested fix
- const data = JSON.parse(text) as { seeds?: { assetPath: string; seedHex: string }[] }; + const data = JSON.parse(text) as { seeds?: { assetPath?: unknown; seedHex?: unknown }[] }; if (!Array.isArray(data?.seeds)) { return null; } - const map: Record<string, string> = {}; + const requestedAssetPaths = new Set(assetPaths); + const map: Record<string, string> = Object.create(null); for (const seed of data.seeds) { - if (seed?.assetPath && /^[0-9a-f]{64}$/i.test(seed?.seedHex ?? '')) { - map[seed.assetPath] = seed.seedHex.toLowerCase(); + const assetPath = seed?.assetPath; + const seedHex = seed?.seedHex; + if ( + typeof assetPath === 'string' && + requestedAssetPaths.has(assetPath) && + typeof seedHex === 'string' && + /^[0-9a-f]{64}$/i.test(seedHex) + ) { + map[assetPath] = seedHex.toLowerCase(); } }As per path instructions,
**/*.{ts,tsx,js,jsx}reviews must aggressively flag prototype-pollution risks and unsafe client-controlled keys.Source: Path instructions
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 5d255592-665f-4a73-b305-48bbf8f5409d
📒 Files selected for processing (7)
convex/attestation.realtest.tsconvex/attestation.tsconvex/couplingJobAndReveal.realtest.tsconvex/http.tsconvex/httpSurface.behavior.test.tsconvex/protectedUnlock.realtest.tsconvex/yucpLicenses.ts
📜 Review details
⏰ Context from checks skipped due to timeout. (1)
- GitHub Check: Workers Builds: creator-assistant-dashboard
🧰 Additional context used
📓 Path-based instructions (2)
**/*.{ts,tsx,js,jsx}
⚙️ CodeRabbit configuration file
**/*.{ts,tsx,js,jsx}: Act as a strict TypeScript and JavaScript security auditor.
Aggressively flag:
- SSRF, injection, XSS, prototype pollution, insecure redirects, unsafe dynamic imports, eval-like APIs, and shell command construction
- API routes, server actions, RPC handlers, middleware, loaders, actions, edge functions, and webhooks without explicit authentication, authorization, CSRF protection where applicable, tenant isolation, and input validation
- unsafe JSON parsing, schema gaps, mass assignment, confused-deputy issues, trusting client-controlled IDs or roles, and unsafe use of headers or cookies
- tokens, secrets, private config, server-only env vars, API keys, tenant data, PII, or internal endpoints exposed to client bundles, hydration payloads, browser storage, source maps, analytics, logs, errors, or public assets
- logging of request headers, cookies, tokens, user payloads, PII, tenant IDs, raw errors, or internal stack traces
- non-robust workloads in Node runtimes, including missing abort signals, missing timeouts, unbounded promises, unbounded queues, unbounded response bodies, and event-loop blocking work
Files:
convex/protectedUnlock.realtest.tsconvex/couplingJobAndReveal.realtest.tsconvex/httpSurface.behavior.test.tsconvex/yucpLicenses.tsconvex/attestation.realtest.tsconvex/http.tsconvex/attestation.ts
**/*test*
⚙️ CodeRabbit configuration file
**/*test*: Security still matters in tests.
Flag real-looking credentials, copied production tokens, unsafe fixtures with live endpoints, disabled TLS verification without isolation, frontend snapshots containing sensitive data, test logs that reveal secrets or PII, and tests that normalize insecure patterns.
Test-only bypasses must be isolated, obvious, and impossible to activate in production.
Files:
convex/protectedUnlock.realtest.tsconvex/couplingJobAndReveal.realtest.tsconvex/httpSurface.behavior.test.tsconvex/attestation.realtest.tsconvex/attestation.ts
🔇 Additional comments (6)
convex/protectedUnlock.realtest.ts (2)
4-4: LGTM!Also applies to: 20-20, 83-83
96-126: LGTM!Also applies to: 169-190
convex/attestation.ts (1)
20-20: LGTM!Also applies to: 195-209, 227-237, 316-316, 379-380, 432-444
convex/attestation.realtest.ts (1)
44-62: LGTM!Also applies to: 153-166, 331-344, 420-438
convex/http.ts (1)
1875-2172: LGTM!Also applies to: 2210-2235, 2250-2272, 2288-2300
convex/httpSurface.behavior.test.ts (1)
57-63: LGTM!Also applies to: 114-123, 148-148, 323-498
Require a license subject to have a recorded attestation before protected unlock issuance so new licenses cannot bypass hardware and payment block inheritance. Prefer YUCP_COUPLING_SERVICE_SHARED_SECRET over the legacy coupling secret during seed relay rotation, matching the API env resolver. Keep identity merge survivors blocked when active block records are moved during node absorption, even if the absorbed node status was stale.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f0e09a47ae
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Use a licenseSubject and createdAt index for latest-attestation lookups so payment anchors and coupling proofs avoid unbounded scans. Reject non-loopback HTTP coupling seed relay endpoints before sending bearer credentials and read relay responses through a bounded stream reader. Restore optional HTTP surface test secrets by deleting env vars that were originally unset.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9a111718b2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Require protected unlocks to have an attestation for the same machine fingerprint hash as the unlock token so a helper-machine attestation cannot satisfy a different machine. Persist coupling-proof license subjects and relink pending proofs when a later attestation resolves the subject to an identity node. Repoint linked coupling proofs during identity-node merges so forensic records follow the surviving node.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6566d121b3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
convex/attestation.ts (1)
314-330: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winConstrain block checks to the matching machine when provided.
Line 318 computes
currentMachineAttested, but Lines 321-327 still scan all attestations for the license. A blocked node from another machine using the same license can make this unlock return{ blocked: true, attested: true }even whenmachineFingerprintHashdoes not match. Queryby_license_subject_machinewhen available and derive both fields from that scoped set.As per path instructions, “RPC handlers … [need] tenant isolation, and input validation.”
Proposed fix
- const attestations = await ctx.db - .query('machine_attestations') - .withIndex('by_license_subject', (q) => q.eq('licenseSubject', args.licenseSubject)) - .collect(); - const currentMachineAttested = args.machineFingerprintHash - ? attestations.some((att) => att.machineFingerprintHash === args.machineFingerprintHash) - : attestations.length > 0; + const attestations = args.machineFingerprintHash + ? await ctx.db + .query('machine_attestations') + .withIndex('by_license_subject_machine', (q) => + q + .eq('licenseSubject', args.licenseSubject) + .eq('machineFingerprintHash', args.machineFingerprintHash) + ) + .collect() + : await ctx.db + .query('machine_attestations') + .withIndex('by_license_subject', (q) => q.eq('licenseSubject', args.licenseSubject)) + .collect(); + const currentMachineAttested = attestations.length > 0;Source: Path instructions
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 261c75d3-c030-453c-8586-c242a114480e
📒 Files selected for processing (7)
convex/attestation.realtest.tsconvex/attestation.tsconvex/http.tsconvex/protectedBlobArchitecture.realtest.tsconvex/protectedUnlock.realtest.tsconvex/schema.tsconvex/yucpLicenses.ts
📜 Review details
⏰ Context from checks skipped due to timeout. (1)
- GitHub Check: Lint
🧰 Additional context used
📓 Path-based instructions (2)
**/*.{ts,tsx,js,jsx}
⚙️ CodeRabbit configuration file
**/*.{ts,tsx,js,jsx}: Act as a strict TypeScript and JavaScript security auditor.
Aggressively flag:
- SSRF, injection, XSS, prototype pollution, insecure redirects, unsafe dynamic imports, eval-like APIs, and shell command construction
- API routes, server actions, RPC handlers, middleware, loaders, actions, edge functions, and webhooks without explicit authentication, authorization, CSRF protection where applicable, tenant isolation, and input validation
- unsafe JSON parsing, schema gaps, mass assignment, confused-deputy issues, trusting client-controlled IDs or roles, and unsafe use of headers or cookies
- tokens, secrets, private config, server-only env vars, API keys, tenant data, PII, or internal endpoints exposed to client bundles, hydration payloads, browser storage, source maps, analytics, logs, errors, or public assets
- logging of request headers, cookies, tokens, user payloads, PII, tenant IDs, raw errors, or internal stack traces
- non-robust workloads in Node runtimes, including missing abort signals, missing timeouts, unbounded promises, unbounded queues, unbounded response bodies, and event-loop blocking work
Files:
convex/protectedBlobArchitecture.realtest.tsconvex/http.tsconvex/protectedUnlock.realtest.tsconvex/attestation.realtest.tsconvex/schema.tsconvex/yucpLicenses.tsconvex/attestation.ts
**/*test*
⚙️ CodeRabbit configuration file
**/*test*: Security still matters in tests.
Flag real-looking credentials, copied production tokens, unsafe fixtures with live endpoints, disabled TLS verification without isolation, frontend snapshots containing sensitive data, test logs that reveal secrets or PII, and tests that normalize insecure patterns.
Test-only bypasses must be isolated, obvious, and impossible to activate in production.
Files:
convex/protectedBlobArchitecture.realtest.tsconvex/protectedUnlock.realtest.tsconvex/attestation.realtest.tsconvex/attestation.ts
🔇 Additional comments (5)
convex/schema.ts (1)
2666-2683: LGTM!Also applies to: 2769-2777
convex/yucpLicenses.ts (1)
1518-1518: LGTM!Also applies to: 1538-1551
convex/attestation.realtest.ts (1)
470-489: LGTM!convex/protectedUnlock.realtest.ts (1)
26-29: LGTM!Also applies to: 82-92, 111-111, 126-126, 169-190
convex/protectedBlobArchitecture.realtest.ts (1)
176-176: LGTM!
Scope protected-unlock block evaluation to the attestation rows for the current machine fingerprint when a machine hash is provided, so a block on another machine using the same license does not deny a clean current-machine unlock. Add a regression covering a clean current machine with a blocked different machine on the same license subject.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9af5849feb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Preserve private coupling-service base paths when deriving seeds so reverse-proxy prefixes are not dropped. Relink delayed coupling proofs by the submitted correlation id and matching license subject instead of claiming every pending proof for the same license. Require attestation relay records to include the machine fingerprint hash so protected unlocks can satisfy the same-machine attestation gate.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 50b4b209a8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
convex/yucpLicenses.ts (1)
1296-1302: 🔒 Security & Privacy | 🟠 MajorUse an own-key map for coupling seeds
assetPathis untrusted, andRecord<string, string> = {}lets inherited keys likeconstructor,toString, or__proto__read as truthy values when no seed exists. Switch this toMapor a null-prototype object withhasOwnchecks.convex/yucpLicenses.ts:1296-1302, 1407-1415Source: Path instructions
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: d9b2e872-4d8a-4799-b425-b19391bb3d7c
📒 Files selected for processing (7)
convex/attestation.realtest.tsconvex/attestation.tsconvex/couplingJobAndReveal.realtest.tsconvex/http.tsconvex/httpSurface.behavior.test.tsconvex/protectedUnlock.realtest.tsconvex/yucpLicenses.ts
📜 Review details
⏰ Context from checks skipped due to timeout. (2)
- GitHub Check: Workers Builds: creator-assistant-dashboard
- GitHub Check: Analyze (javascript-typescript)
🧰 Additional context used
📓 Path-based instructions (2)
**/*.{ts,tsx,js,jsx}
⚙️ CodeRabbit configuration file
**/*.{ts,tsx,js,jsx}: Act as a strict TypeScript and JavaScript security auditor.
Aggressively flag:
- SSRF, injection, XSS, prototype pollution, insecure redirects, unsafe dynamic imports, eval-like APIs, and shell command construction
- API routes, server actions, RPC handlers, middleware, loaders, actions, edge functions, and webhooks without explicit authentication, authorization, CSRF protection where applicable, tenant isolation, and input validation
- unsafe JSON parsing, schema gaps, mass assignment, confused-deputy issues, trusting client-controlled IDs or roles, and unsafe use of headers or cookies
- tokens, secrets, private config, server-only env vars, API keys, tenant data, PII, or internal endpoints exposed to client bundles, hydration payloads, browser storage, source maps, analytics, logs, errors, or public assets
- logging of request headers, cookies, tokens, user payloads, PII, tenant IDs, raw errors, or internal stack traces
- non-robust workloads in Node runtimes, including missing abort signals, missing timeouts, unbounded promises, unbounded queues, unbounded response bodies, and event-loop blocking work
Files:
convex/yucpLicenses.tsconvex/httpSurface.behavior.test.tsconvex/protectedUnlock.realtest.tsconvex/couplingJobAndReveal.realtest.tsconvex/attestation.realtest.tsconvex/http.tsconvex/attestation.ts
**/*test*
⚙️ CodeRabbit configuration file
**/*test*: Security still matters in tests.
Flag real-looking credentials, copied production tokens, unsafe fixtures with live endpoints, disabled TLS verification without isolation, frontend snapshots containing sensitive data, test logs that reveal secrets or PII, and tests that normalize insecure patterns.
Test-only bypasses must be isolated, obvious, and impossible to activate in production.
Files:
convex/httpSurface.behavior.test.tsconvex/protectedUnlock.realtest.tsconvex/couplingJobAndReveal.realtest.tsconvex/attestation.realtest.tsconvex/attestation.ts
🔇 Additional comments (7)
convex/attestation.ts (1)
103-118: LGTM!Also applies to: 296-301, 320-343
convex/yucpLicenses.ts (1)
1268-1268: LGTM!Also applies to: 1340-1340, 1518-1551
convex/attestation.realtest.ts (1)
486-522: LGTM!convex/couplingJobAndReveal.realtest.ts (1)
384-398: Reinstate auth and method assertions in this inline relay mock.This stub only checks the URL. If the action stops sending
POSTor drops the bearer secret, this regression still passes and re-normalizes the insecure relay path the suite already tightened elsewhere. Reuse the stricter helper or assertmethodandAuthorizationhere too. As per path instructions, "Security still matters in tests" and flag "tests that normalize insecure patterns".Source: Path instructions
convex/http.ts (1)
1912-1912: LGTM!Also applies to: 2034-2114
convex/httpSurface.behavior.test.ts (1)
401-401: LGTM!Also applies to: 416-454
convex/protectedUnlock.realtest.ts (1)
116-151: LGTM!Also applies to: 263-286
Add bearer-protected internal HTTP routes for closed-service identity block creation and review so confirmed leaked-trace evidence can reach the block ledger in production. Return the created block id from the internal flag mutation so the review route can promote or reverse the pending record without manual database edits. Cover both routes in the Convex HTTP surface regression tests.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 29a57c54e9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
Actionable comments posted: 1
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 99f0e497-d17c-4b6e-9b83-4a84750b001b
📒 Files selected for processing (3)
convex/attestation.tsconvex/http.tsconvex/httpSurface.behavior.test.ts
📜 Review details
⏰ Context from checks skipped due to timeout. (3)
- GitHub Check: Test
- GitHub Check: Type Check
- GitHub Check: Workers Builds: creator-assistant-dashboard
🧰 Additional context used
📓 Path-based instructions (2)
**/*.{ts,tsx,js,jsx}
⚙️ CodeRabbit configuration file
**/*.{ts,tsx,js,jsx}: Act as a strict TypeScript and JavaScript security auditor.
Aggressively flag:
- SSRF, injection, XSS, prototype pollution, insecure redirects, unsafe dynamic imports, eval-like APIs, and shell command construction
- API routes, server actions, RPC handlers, middleware, loaders, actions, edge functions, and webhooks without explicit authentication, authorization, CSRF protection where applicable, tenant isolation, and input validation
- unsafe JSON parsing, schema gaps, mass assignment, confused-deputy issues, trusting client-controlled IDs or roles, and unsafe use of headers or cookies
- tokens, secrets, private config, server-only env vars, API keys, tenant data, PII, or internal endpoints exposed to client bundles, hydration payloads, browser storage, source maps, analytics, logs, errors, or public assets
- logging of request headers, cookies, tokens, user payloads, PII, tenant IDs, raw errors, or internal stack traces
- non-robust workloads in Node runtimes, including missing abort signals, missing timeouts, unbounded promises, unbounded queues, unbounded response bodies, and event-loop blocking work
Files:
convex/http.tsconvex/httpSurface.behavior.test.tsconvex/attestation.ts
**/*test*
⚙️ CodeRabbit configuration file
**/*test*: Security still matters in tests.
Flag real-looking credentials, copied production tokens, unsafe fixtures with live endpoints, disabled TLS verification without isolation, frontend snapshots containing sensitive data, test logs that reveal secrets or PII, and tests that normalize insecure patterns.
Test-only bypasses must be isolated, obvious, and impossible to activate in production.
Files:
convex/httpSurface.behavior.test.tsconvex/attestation.ts
🔇 Additional comments (2)
convex/http.ts (1)
51-56: LGTM!Also applies to: 71-71, 1953-1962, 2197-2252, 2386-2447
convex/httpSurface.behavior.test.ts (1)
63-64: LGTM!Also applies to: 555-627
Reject identity block flags for missing identity nodes so the block ledger cannot accumulate orphaned review records. Require at least two durable anchors before an identity block review can promote a node to active blocking status. Update attestation and protected-unlock regressions so successful promotions use block-eligible identities and single-anchor nodes stay unblocked.
github-project-automation
Bot
moved this from Backlog
to Done
in Creator Assistant Roadmap
1 participant
Summary
Verification
bun auditbun run lintbun run typecheckbun run test:convexbun run test:external-integrationsbun run test:cibun x vitest run --config convex/vitest.config.ts convex/couplingJobAndReveal.realtest.ts convex/attestation.realtest.tsbun test ops/production-regression-loop.test.tsSummary by CodeRabbit