fix(edge): CORS migration + forensic audit doc (substitui #133)#136
Merged
Conversation
…B-2) Both edge functions declared corsHeaders inline (without x-request-id), violating the project's CORS gate (check:edge-cors + check:no-inline-cors). Migration: - simulation-orchestrator: corsHeaders inline → buildPublicCorsHeaders() - sync-external-db: corsHeaders inline → buildPublicCorsHeaders() This restores observability: x-request-id can now be cross-referenced between browser logs and Sentry/server logs across preflight. Substitutes PR #126 B-2 finding. Other items of #126: - B-1 validateUrlFormat: ✅ already merged via #124 - B-3 toast leaks: rejected (baseline 176→179 would be regression) - useGlobalShortcuts hooks fix: ✅ already merged via #124 - T-FIX-3 GH Actions bump: ✅ already merged via #124 - AdminStandardRules PascalCase: ✅ already merged via #124 Helper used (verified existing in main): - supabase/functions/_shared/cors.ts:204 exports buildPublicCorsHeaders()
Adds AUDITORIA_BUGS_2026-05-23.md reconciling findings from 4 prior audits (2026-04-29, 05-07, 05-12, 05-13) against the current code state. Different focus from AUDITORIA-EXAUSTIVA-2026-05-23.md (#124, which is a 20-step plan) — this one is a P0/P1 forensic inventory with 7-pass analysis. Key findings documented: - 13 critical security issues from prior audits: 13/13 CLOSED - 9 currently-open bugs identified (B-1 through B-9) - 103 it.skip in P0/E2E tests (test coverage gap) - 1333 TS + 473 ESLint + 73 toast.error leaks in baselines - 0 npm audit vulnerabilities Resolution status of B-1 through B-3: - B-1 (validateUrlFormat): ✅ already fixed in #124 - B-2 (CORS inline simulation-orchestrator + sync-external-db): ✅ fixed in companion commit 507692b of this branch - B-3 through B-9: documented for follow-up Substitutes PR #126 docs delivery.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
This pull request has been ignored for the connected project Preview Branches by Supabase. |
WalkthroughRefatoração de CORS headers em duas funções Supabase (simulation-orchestrator e sync-external-db) para usar helper centralizado, eliminando duplicação de configuração. Novo relatório de auditoria documenta bugs abertos, métricas de segurança, cobertura desativada e recomendações priorizadas com resultados de gates locais. ChangesCORS Consolidation and Audit Documentation
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/AUDITORIA_BUGS_2026-05-23.md`:
- Around line 372-373: The table in docs/AUDITORIA_BUGS_2026-05-23.md has rows
with 3 pipe-separated cells (`| A3: console.warn/error droppped | ✅ FECHADO |
`vite.config.ts:34-35` |` and `| 5 vulnerabilidades npm | ✅ FECHADO | `npm
audit` retorna 0 vulnerabilidades em prod e dev |`) while the header defines
only 2 columns, causing an MD056 lint error; fix by either updating the table
header to three columns (add a third header cell and divider) or collapse those
rows to two cells (merge the status and location into one cell or remove the
extra cell) so the header and all rows consistently have the same column count.
- Line 85: Os blocos fenced (``` ... ```) neste documento estão sem
identificador de linguagem; atualize cada bloco de código removendo a fence
vazia e adicionando uma linguagem apropriada (por exemplo ```text, ```bash ou
```json conforme o conteúdo) para evitar MD040 e melhorar highlighting no
preview; procure todas as ocorrências das fences triplas (``` ) no arquivo e
substituir por fences com a tag de linguagem correspondente mantendo o conteúdo
interno inalterado.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 4bdc4f9a-a7b8-4a4f-8278-bcfca5453aa7
📒 Files selected for processing (3)
docs/AUDITORIA_BUGS_2026-05-23.mdsupabase/functions/simulation-orchestrator/index.tssupabase/functions/sync-external-db/index.ts
Contributor
There was a problem hiding this comment.
Pull request overview
This PR cherry-picks a small Edge Functions fix to eliminate inline CORS headers (to satisfy the repo’s CORS gates and restore x-request-id exposure), and adds a long-form forensic audit document meant to be a permanent reference snapshot of known issues/status.
Changes:
- Migrates
simulation-orchestratorandsync-external-dbfrom inlinecorsHeadersto_shared/cors.ts’sbuildPublicCorsHeaders(). - Adds
docs/AUDITORIA_BUGS_2026-05-23.mdconsolidating prior audit findings and current status.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 9 comments.
| File | Description |
|---|---|
supabase/functions/simulation-orchestrator/index.ts |
Replaces inline CORS header object with buildPublicCorsHeaders() helper. |
supabase/functions/sync-external-db/index.ts |
Replaces inline CORS header object with buildPublicCorsHeaders() helper. |
docs/AUDITORIA_BUGS_2026-05-23.md |
Adds a consolidated audit/status document; currently contains several statements that don’t match repo/PR reality and should be corrected. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
|
||
| Quando malformada, retorna `result = { ok: false, error: "URL_MALFORMED: …", error_kind: "config" }` antes do `pingX()`. Mensagem mostra os primeiros 40 chars da URL ofensora (sem expor JWT, que só está em `key`). | ||
|
|
||
| **Follow-up (não aplicado aqui):** teste unitário cobrindo (URL válida, URL do dashboard, trailing slash, path, vazia, sem https) — registrado como #B-1-FU. |
Comment on lines
+123
to
+124
| **Baseline (.toast-leaks-baseline.json):** 0 ocorrências. Esta é uma **regressão pós-baseline** — entre 2026-05-22 (data do baseline) e hoje (2026-05-23), 73 novos call sites apareceram. | ||
|
|
| | Críticos de segurança (auditorias 04→05/2026) | 3 + 3 + 3 + 4 = **13** | **0 abertos · 13 fechados** | | ||
| | Bugs em código aberto agora | — | **9** (com fonte verificável) | | ||
| | Cobertura P0 desligada (`it.skip`/`test.skip`) | — | **103 tests** (48 em `tests/p0/` + 55 em `e2e/`) | | ||
| | Dívida em baselines aceita (TSC + ESLint + toast) | — | **1.333 TS + 473 ESLint + 73 toast** | |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
3 issues found across 3 files
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
|
Deployment failed with the following error: |
This was referenced May 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Substitui PR #133 (fechado sem merge)
Branch
chore/pr126-cherry-pickfoi force-pushed sobre omainatual (a9a667ff) após o merge dos PRs intermediários #130 / #132 / #135. Os 3 arquivos abaixo continuam com valor único e não-redundante vsmain.O que entra (3 arquivos)
docs/AUDITORIA_BUGS_2026-05-23.mdsupabase/functions/simulation-orchestrator/index.tsbuildPublicCorsHeaders()supabase/functions/sync-external-db/index.tsbuildPublicCorsHeaders()Por quê
Os 2 edge functions declaravam
corsHeadersinline (semx-request-id), violando o gate de CORS do projeto (check:edge-cors+check:no-inline-cors). A migration restaura observabilidade —x-request-idcross-referenciável entre browser logs e Sentry/server logs no preflight.Confirmado via
git grepnomainatual:Helper
buildPublicCorsHeaders()existe emsupabase/functions/_shared/cors.ts:204.O que NÃO entra (descartado do PR #126 original)
validateUrlFormatTest plan
git diff origin/main...origin/chore/pr126-cherry-pickconfirma só 3 arquivosgit log origin/main..origin/chore/pr126-cherry-pickmostra 2 commits limpos sobrea9a667ffcheck:edge-cors+check:no-inline-corspassandoReferências
docs/redeploy/SESSAO-REBASE-PRS-2026-05-23.mdchore/pr126-cherry-pick@08681b01🤖 Cherry-pick cirúrgico via Claude — 3 arquivos validados sobre o
mainpós-#135.Summary by cubic
Migrated CORS in
simulation-orchestratorandsync-external-dbtobuildPublicCorsHeaders()to includex-request-idand pass CORS gates. Addeddocs/AUDITORIA_BUGS_2026-05-23.md, a forensic audit reconciling prior audits with current code and listing open items.Bug Fixes
buildPublicCorsHeaders()insupabase/functions/simulation-orchestrator/index.tsandsupabase/functions/sync-external-db/index.ts, satisfyingcheck:edge-corsandcheck:no-inline-corsand restoring preflight observability.Documentation
docs/AUDITORIA_BUGS_2026-05-23.md: notes 13/13 criticals closed, 0npm auditvulnerabilities, 9 open bugs, and coverage gaps (103 skipped P0/E2E tests) with next steps.Written for commit f343e28. Summary will update on new commits. Review in cubic
Summary by CodeRabbit
Notas da Versão
Documentação
Correções de Bugs
Otimizações