Conversation
Change isHCaptchaEnabled to allow hCaptcha on production as well as staging, but only if a hCaptcha site key is configured. The function now checks getEnvironment() (lowercased) and requires getHCaptchaSiteKey() to be truthy; the comment was updated to match the new behavior.
Replace the single-provider Google auth component with a new SocialAuthSection that supports Google, GitHub, LinkedIn and X. Extend oauth-session with supported provider types, helpers to resolve redirect URLs, and localStorage helpers to track the last-used provider. Update the login page to use the new social component, display an error banner for oauth failures, and clean the URL after showing the error. Add a redirect from /user/login to /login in next.config and update NEXT_PUBLIC_API_URL in the example env to the vertex staging API. Remove the old google-auth-section component.
Use user's last active module for social auth redirect (falls back to /admin/networks for admin or /home) and import getLastActiveModule in SocialAuthSection. Change middleware authorized callback to always return true. Update API proxy destination from staging-analytics.airqo.net to staging-vertex.airqo.net in both next.config files and add a redirect from /user/home to /home in next.config.mjs.
Extend isHCaptchaEnabled to also return true in development when an hCaptcha site key is present. Previously hCaptcha was only enabled for staging and production, which prevented local/dev testing; this change allows developers to test hCaptcha locally if the site key is configured.
Include PERMISSIONS.NETWORK.VIEW in the role's permission array in src/vertex/core/permissions/constants.ts so the system-wide role (canOverrideOrganization: false) is granted network view access.
Introduce a containerized local environment for the internal "The Mariana" documentation using BookStack. Adds docker-compose.yml (BookStack + MariaDB), .env.example with recommended defaults (APP_URL, DB creds, APP_PUBLIC=false), .gitignore to protect .env and persisted data (config/, db_data/), and a README with setup, access, security guidance, IA conventions, and persistence notes. Intended for local development on port 6875; remember to copy .env.example -> .env and update default credentials and secrets before use.
Introduce a new Helm chart for AirQo internal docs (The Mariana). Adds Chart.yaml, template helpers, deployments for app (BookStack) and DB (MariaDB), services, and PVCs. Includes environment-specific values files for production and staging with image defaults (linuxserver/bookstack, linuxserver/mariadb), resource and autoscaling settings, nodeSelector/affinity, unique NodePorts, configmap references, DB env vars, and 5Gi persistent storage for both app and DB.
Rebrand internal docs from "The Mariana" to "Mariana Deep" across .env.example, README, docker-compose.yml, and Chart.yaml. Standardize MariaDB usage by switching to the official mariadb:10.6 image, changing the DB data mount to /var/lib/mysql, switching to a named Docker volume (bookstack_db_data) and adding the volume block in docker-compose. Mirror the image/tag change in Helm values and adjust the k8s deployment volume mount. Also add db_data_v2/ to .gitignore.
Delete k8s/values-stage.yaml and update src/internal-docs/README.md to remove staging references and the staging Helm command. The README now states Helm charts deploy to the production cluster and retains the production deploy command (-f k8s/values-prod.yaml -n production). This cleans up stale staging configuration and documentation.
Introduce a Kubernetes Secret for sensitive BookStack environment variables and stop storing secrets in the ConfigMap. Added templates/secret.yaml and removed APP_KEY, DB_PASS, MYSQL_PASSWORD and MYSQL_ROOT_PASSWORD from the ConfigMap; deployments for app and db now load secrets via secretRef. Update MariaDB readiness/liveness checks to use 127.0.0.1 and authenticate with MYSQL_ROOT_PASSWORD. Bumped Helm Chart appVersion and updated docs/.env example to use the newer `docker compose up -d` command. This improves security by requiring secret injection via CI/CD or cluster secrets.
Feat: Initial Setup & Kubernetes Infrastructure for Mariana Deep (Internal Docs)
|
| GitGuardian id | GitGuardian status | Secret | Commit | Filename | |
|---|---|---|---|---|---|
| 33762647 | Triggered | Laravel APP_KEY | 0fe4bcd | src/internal-docs/.env.example | View secret |
🛠 Guidelines to remediate hardcoded secrets
- Understand the implications of revoking this secret by investigating where it is used in your code.
- Replace and store your secret safely. Learn here the best practices.
- Revoke and rotate this secret.
- If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.
To avoid such incidents in the future consider
- following these best practices for managing and storing secrets including API keys and other credentials
- install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.
🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.
Contributor
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Capture the initial OAuth hash and prevent UI unblocking during client-side token handoff: use a ref (isHandlingOAuthRef) to record if the URL initially contains a token, add a shouldUnblock flag so setIsBootstrapping(false) is skipped when the browser is redirected, and only clear the ref when safe. Also add waitForSession to the effect deps and use the ref for the initial loading guard. In middleware, relax server-side authorization for OAuth callback requests (allow when search param 'success' is present) so the client can process the token hash while still enforcing protection client-side if the token is invalid.
Refine TokenHandoffHandler to avoid unnecessary full-page reloads when the client is already on the redirect destination. The handler now compares the current pathname to the redirect target and uses client-side router.replace for same-path redirects (allowing the UI to unblock), while preserving window.location.replace for cross-page redirects and keeping the UI blocked to prevent flashing. Also update changelog to mention the optimized redirect logic.
Fetch and sync organization onboarding checklist state from the server and persist updates. - Add API helpers: updateGroupOnboardingApi and getGroupDetailsApi to organizations API. - Update types: add onboarding_checklist to Group and User types. - Extend userSlice with updateActiveGroupOnboarding to update active group and userGroups state. - Revamp WelcomePage: fetch up-to-date group details, separate local (personal) and org checklist state, compute visuallyCompletedSteps, and handle marking/dismissing steps via API calls. Updates also update query cache and dispatch redux updates. Auto-complete logic for steps now accounts for org vs personal scope. - Misc: import/use useAppDispatch and react-query useQuery for group details. This enables backend-driven onboarding checklist for org workspaces while preserving local storage behavior for personal scope.
Replace createSecureApiClient with secureApiProxy in groupsApi and export a groupsApi object for callers. In the Welcome page, switch to importing groupsApi and destructure updateGroupOnboardingApi/getGroupDetailsApi. Add permission, device and cohort hooks to auto-detect existing devices/cohorts and surface those steps as completed (visually and persisted for personal scopes). Change auto-step syncing to sequential calls with error handling, unify how updated onboarding_checklist is read from API responses, and update the react-query cache accordingly. Remove duplicated logic, update effect dependencies, and add a delayed dismiss of the checklist after workspace setup completes.
Introduce useGroupDetails and useUpdateGroupOnboarding hooks (useQuery/useMutation wrappers) in useGroups.ts and refactor the authenticated Home/Welcome page to use them. Replace direct groupsApi calls and a raw useQuery with the new hooks, import Group type, wire mutateAsync for onboarding updates, tighten setQueryData typing, and add the mutation to the effect deps. This centralizes group-related react-query logic and removes unused imports.
…ial-auth feat: Multi-provider social auth, proxy updates, and RBAC fixes (vertex app)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.