Skip to content

Comments

Fix utms#728

Merged
elie222 merged 3 commits intomainfrom
fix/utms
Aug 29, 2025
Merged

Fix utms#728
elie222 merged 3 commits intomainfrom
fix/utms

Conversation

@elie222
Copy link
Owner

@elie222 elie222 commented Aug 29, 2025

Summary by CodeRabbit

  • Chores
    • Improved reliability of UTM attribution by persisting UTMs for signed-in users after visiting Onboarding and Welcome pages. No UI changes; runs post-request for smoother tracking across flows.
  • Refactor
    • Centralized UTM storage into a single helper and removed redundant logic from the Welcome Redirect flow, adding better error handling and scoped logging for robustness.

@coderabbitai
Copy link
Contributor

coderabbitai bot commented Aug 29, 2025

Warning

Rate limit exceeded

@elie222 has exceeded the limit for the number of commits or files that can be reviewed per hour. Please wait 14 minutes and 23 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbit review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

📥 Commits

Reviewing files that changed from the base of the PR and between 2374177 and 69d5c86.

📒 Files selected for processing (2)
  • apps/web/app/(landing)/welcome/utms.tsx (2 hunks)
  • version.txt (1 hunks)

Walkthrough

Adds post-request UTM persistence via Next.js after hooks to onboarding and welcome pages using a new helper fetchUserAndStoreUtms. Removes the previous after hook from welcome-redirect. Introduces a scoped logger and new helper in utms.tsx, and augments storeUtms with info logs and error handling.

Changes

Cohort / File(s) Summary
Post-request UTM persistence (added)
apps/web/app/(app)/[emailAccountId]/onboarding/page.tsx, apps/web/app/(landing)/welcome/page.tsx
Adds after hook that awaits auth(), and if a user exists, calls fetchUserAndStoreUtms(userId). Page rendering unchanged.
UTM helper and logging
apps/web/app/(landing)/welcome/utms.tsx
Adds createScopedLogger usage; introduces export fetchUserAndStoreUtms(userId) to fetch user and conditionally call storeUtms; enhances storeUtms with info logs and error handling.
Post-request UTM persistence (removed)
apps/web/app/(landing)/welcome-redirect/page.tsx
Removes after hook and related imports that previously stored UTMs post-render; core page logic unchanged.

Sequence Diagram(s)

sequenceDiagram
  autonumber
  participant Client
  participant Page as Page (onboarding/welcome)
  participant After as after() hook
  participant Auth as auth()
  participant UTM as fetchUserAndStoreUtms()
  participant DB as Database

  Client->>Page: Request page
  Page-->>Client: Render response
  Note over Page,After: Post-request phase

  rect rgba(200,235,255,0.25)
    Page->>After: Register after(async ...)
    After->>Auth: await auth()
    Auth-->>After: { user? }
    alt user present
      After->>UTM: fetchUserAndStoreUtms(user.id)
      UTM->>DB: Select user (utms)
      alt utms missing
        UTM->>DB: storeUtms(user.id)
        DB-->>UTM: persisted
      else utms present
        UTM-->>After: no-op
      end
    else no user
      After-->>Page: no-op
    end
  end

  Note over Client,Page: welcome-redirect no longer triggers after() UTM store
Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

I hop through routes where cookies gleam,
Post-request whispers nudge a stream.
UTMs tucked, with logs that sing,
A gentle after-hook on spring.
Redirect rests, its chores set free—
Stored trails await in history. 🐇✨

✨ Finishing Touches
  • 📝 Generate Docstrings
🧪 Generate unit tests
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch fix/utms

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share
🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

  • Review comments: Directly reply to a review comment made by CodeRabbit. Example:
    • I pushed a fix in commit <commit_id>, please review it.
    • Open a follow-up GitHub issue for this discussion.
  • Files and specific lines of code (under the "Files changed" tab): Tag @coderabbit in a new review comment at the desired location with your query.
  • PR comments: Tag @coderabbit in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
    • @coderabbit gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
    • @coderabbit read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.

Support

Need help? Create a ticket on our support page for assistance with any issues or questions.

CodeRabbit Commands (Invoked using PR/Issue comments)

Type @coderabbit help to get the list of available commands.

Other keywords and placeholders

  • Add @coderabbit ignore or @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
  • Add @coderabbit summary or @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
  • Add @coderabbit or @coderabbitai anywhere in the PR title to generate the title automatically.

Status, Documentation and Community

  • Visit our Status Page to check the current availability of CodeRabbit.
  • Visit our Documentation for detailed information on how to use CodeRabbit.
  • Join our Discord Community to get help, request features, and share feedback.
  • Follow us on X/Twitter for updates and announcements.

@vercel
Copy link

vercel bot commented Aug 29, 2025

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Preview Updated (UTC)
inbox-zero Ready Ready Preview Aug 29, 2025 1:11pm

@claude
Copy link

claude bot commented Aug 29, 2025

Claude finished @elie222's task —— View job


PR Review: Fix UTMs

I've reviewed the UTM handling implementation across all 4 modified files. Here's my comprehensive feedback:

Tasks

  • Read repository guidelines (CLAUDE.md)
  • Analyze modified files and understand changes
  • Review code quality and best practices
  • Check for potential bugs and security issues
  • Assess performance considerations
  • Evaluate test coverage needs
  • Provide comprehensive feedback

📋 Summary

This PR implements UTM parameter tracking by storing UTM data from cookies into the user database. The changes add UTM collection calls to the onboarding and welcome pages, create a dedicated UTM handling module, and remove UTM-related code from the welcome-redirect page.

🎯 Code Quality & Best Practices

✅ Good Practices:

  • Clean separation of concerns with dedicated utms.tsx module
  • Proper error handling with try-catch and logging
  • Consistent use of Next.js after() for non-blocking operations
  • TypeScript types are properly maintained
  • Database operations use Prisma for type safety

⚠️ Areas for Improvement:

  • Missing input validation for UTM parameters
  • No length limits on stored UTM values
  • Consider adding JSDoc comments for the exported functions

🐛 Potential Bugs & Issues

🔴 Critical Issues:

  1. Data Integrity: No validation that UTM values contain expected data types or formats
  2. Database Constraints: UTM values could potentially exceed database field limits if very long values are stored

🟡 Minor Issues:

  • The utms.tsx:13 check !user.utms may not work as expected if utms is an empty object rather than null

🔒 Security Concerns

⚠️ Medium Risk:

  • Cookie Poisoning: UTM values are directly read from cookies without sanitization or validation
  • XSS Potential: If UTM data is later displayed in UI without proper escaping, it could lead to XSS
  • Database Injection: While Prisma provides protection, the lack of input validation is concerning

Recommendations:

// Add validation in utms.tsx
const validateUtmValue = (value: string | undefined): string | undefined => {
  if (!value || value.length > 255) return undefined;
  // Remove potentially dangerous characters
  return value.replace(/[<>\"']/g, '');
};

⚡ Performance Considerations

✅ Good Performance:

  • Uses after() to prevent blocking the main response
  • Database queries are minimal and focused
  • Proper conditional logic prevents unnecessary database updates

🔄 Potential Optimizations:

  • Consider batching UTM storage if multiple pages are hit in quick succession
  • Add caching to prevent redundant database queries for the same user

🧪 Test Coverage

❌ Missing Tests:

  • No unit tests for UTM extraction and storage logic
  • No integration tests for the end-to-end UTM flow
  • No error handling tests for database failures

Recommended Tests:

// Example test cases needed:
describe('UTM Storage', () => {
  it('should store valid UTM parameters')
  it('should handle missing UTM cookies gracefully')  
  it('should not overwrite existing UTM data')
  it('should sanitize malicious UTM values')
  it('should handle database errors gracefully')
})

📁 File-Specific Feedback

apps/web/app/(landing)/welcome/utms.tsx (lines 7-44)

  • Line 13: Consider checking if user.utms is null/undefined OR an empty object
  • Lines 24-28: Add validation before storing cookie values
  • Line 40: Consider using upsert instead of update for better safety

apps/web/app/(app)/[emailAccountId]/onboarding/page.tsx (lines 24-28)

  • Clean implementation using after() for non-blocking execution
  • Good error boundary with optional chaining

apps/web/app/(landing)/welcome/page.tsx (lines 28-32)

  • Identical pattern to onboarding page - good consistency

apps/web/app/(landing)/welcome-redirect/page.tsx (line 19)

  • Good that UTM field is still selected for potential future use

🎯 Recommendations

  1. High Priority: Add input validation and sanitization to prevent security issues
  2. Medium Priority: Add comprehensive test coverage
  3. Medium Priority: Consider adding JSDoc documentation
  4. Low Priority: Add database constraints for UTM field lengths

✅ Overall Assessment

The implementation is functionally correct and follows good architectural patterns. The main concerns are around input validation and test coverage. The security risks are manageable but should be addressed before production deployment.

Verdict: Approve with recommendations - The core functionality is solid, but addressing the validation concerns would make this production-ready.


Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (2)
apps/web/app/(landing)/welcome/utms.tsx (2)

30-36: Bug: Writing undefined into a Prisma JSON column.

Prisma JSON does not accept undefined. Coalesce to null (or omit keys) before update.

-  const utms = {
-    utmCampaign: utmCampaign?.value,
-    utmMedium: utmMedium?.value,
-    utmSource: utmSource?.value,
-    utmTerm: utmTerm?.value,
-    affiliate: affiliate?.value,
-  };
+  const utms = {
+    utmCampaign: utmCampaign?.value ?? null,
+    utmMedium: utmMedium?.value ?? null,
+    utmSource: utmSource?.value ?? null,
+    utmTerm: utmTerm?.value ?? null,
+    affiliate: affiliate?.value ?? null,
+  } as const;
+
+  // Skip if no UTM cookies were present
+  const hasAnyUtm = Object.values(utms).some(
+    (v) => typeof v === "string" && v.length > 0,
+  );
+  if (!hasAnyUtm) {
+    logger.info("No UTM cookies present; skipping store", { userId });
+    return;
+  }

38-41: Make storage idempotent under concurrent after hooks.

Use updateMany with a guard so we only write when utms is still null, avoiding races from multiple pages.

-  await prisma.user.update({
-    where: { id: userId },
-    data: { utms },
-  });
+  await prisma.user.updateMany({
+    where: { id: userId, utms: null },
+    data: { utms },
+  });
♻️ Duplicate comments (1)
apps/web/app/(app)/[emailAccountId]/onboarding/page.tsx (1)

24-28: Same after-hook hardening as welcome page.

Centralize error handling inside fetchUserAndStoreUtms to avoid unhandled rejections.

🧹 Nitpick comments (4)
apps/web/app/(landing)/welcome/page.tsx (2)

22-24: Always pass a radix to parseInt.

Prevents accidental non‑decimal parsing and aligns with code in onboarding page.

-  const questionIndex = searchParams.question
-    ? Number.parseInt(searchParams.question)
-    : 0;
+  const questionIndex = searchParams.question
+    ? Number.parseInt(searchParams.question, 10)
+    : 0;

17-19: searchParams type: force should be string, not boolean.

Next App Router passes query params as strings. Align with onboarding page typing.

 export default async function WelcomePage(props: {
-  searchParams: Promise<{ question?: string; force?: boolean }>;
+  searchParams: Promise<{ question?: string; force?: string }>;
 }) {
apps/web/app/(landing)/welcome/utms.tsx (2)

21-22: Use a function-scoped logger with context.

Attaches userId once and avoids repeating it.

 export async function storeUtms(userId: string) {
-  logger.info("Storing utms", { userId });
+  const log = logger.with({ userId });
+  log.info("Storing utms");-  logger.info("Stored utms", { utms, userId });
+  log.info("Stored utms", { utms });
 }

Also applies to: 43-44


3-6: Minor: this module contains no JSX — consider .ts extension.

Renaming to utms.ts reduces noise in tooling and aligns with conventions.

📜 Review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

  • MCP integration is disabled by default for public repositories
  • Jira integration is disabled by default for public repositories
  • Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between 61c09ea and 2374177.

📒 Files selected for processing (4)
  • apps/web/app/(app)/[emailAccountId]/onboarding/page.tsx (2 hunks)
  • apps/web/app/(landing)/welcome-redirect/page.tsx (0 hunks)
  • apps/web/app/(landing)/welcome/page.tsx (2 hunks)
  • apps/web/app/(landing)/welcome/utms.tsx (2 hunks)
💤 Files with no reviewable changes (1)
  • apps/web/app/(landing)/welcome-redirect/page.tsx
🧰 Additional context used
📓 Path-based instructions (14)
apps/web/**/*.{ts,tsx}

📄 CodeRabbit inference engine (apps/web/CLAUDE.md)

apps/web/**/*.{ts,tsx}: Use TypeScript with strict null checks
Path aliases: Use @/ for imports from project root
Use proper error handling with try/catch blocks
Format code with Prettier
Leverage TypeScript inference for better DX

Files:

  • apps/web/app/(landing)/welcome/utms.tsx
  • apps/web/app/(app)/[emailAccountId]/onboarding/page.tsx
  • apps/web/app/(landing)/welcome/page.tsx
apps/web/app/**

📄 CodeRabbit inference engine (apps/web/CLAUDE.md)

NextJS app router structure with (app) directory

Files:

  • apps/web/app/(landing)/welcome/utms.tsx
  • apps/web/app/(app)/[emailAccountId]/onboarding/page.tsx
  • apps/web/app/(landing)/welcome/page.tsx
apps/web/**/*.tsx

📄 CodeRabbit inference engine (apps/web/CLAUDE.md)

apps/web/**/*.tsx: Follow tailwindcss patterns with prettier-plugin-tailwindcss
Prefer functional components with hooks
Use shadcn/ui components when available
Ensure responsive design with mobile-first approach
Follow consistent naming conventions (PascalCase for components)
Use LoadingContent component for async data
Use result?.serverError with toastError and toastSuccess
Use LoadingContent component to handle loading and error states consistently
Pass loading, error, and children props to LoadingContent

Files:

  • apps/web/app/(landing)/welcome/utms.tsx
  • apps/web/app/(app)/[emailAccountId]/onboarding/page.tsx
  • apps/web/app/(landing)/welcome/page.tsx
!{.cursor/rules/*.mdc}

📄 CodeRabbit inference engine (.cursor/rules/cursor-rules.mdc)

Never place rule files in the project root, in subdirectories outside .cursor/rules, or in any other location

Files:

  • apps/web/app/(landing)/welcome/utms.tsx
  • apps/web/app/(app)/[emailAccountId]/onboarding/page.tsx
  • apps/web/app/(landing)/welcome/page.tsx
**/*.tsx

📄 CodeRabbit inference engine (.cursor/rules/form-handling.mdc)

**/*.tsx: Use React Hook Form with Zod for validation
Validate form inputs before submission
Show validation errors inline next to form fields

Files:

  • apps/web/app/(landing)/welcome/utms.tsx
  • apps/web/app/(app)/[emailAccountId]/onboarding/page.tsx
  • apps/web/app/(landing)/welcome/page.tsx
**/*.{ts,tsx}

📄 CodeRabbit inference engine (.cursor/rules/logging.mdc)

**/*.{ts,tsx}: Use createScopedLogger for logging in backend TypeScript files
Typically add the logger initialization at the top of the file when using createScopedLogger
Only use .with() on a logger instance within a specific function, not for a global logger

Import Prisma in the project using import prisma from "@/utils/prisma";

**/*.{ts,tsx}: Don't use TypeScript enums.
Don't use TypeScript const enum.
Don't use the TypeScript directive @ts-ignore.
Don't use primitive type aliases or misleading types.
Don't use empty type parameters in type aliases and interfaces.
Don't use any or unknown as type constraints.
Don't use implicit any type on variable declarations.
Don't let variables evolve into any type through reassignments.
Don't use non-null assertions with the ! postfix operator.
Don't misuse the non-null assertion operator (!) in TypeScript files.
Don't use user-defined types.
Use as const instead of literal types and type annotations.
Use export type for types.
Use import type for types.
Don't declare empty interfaces.
Don't merge interfaces and classes unsafely.
Don't use overload signatures that aren't next to each other.
Use the namespace keyword instead of the module keyword to declare TypeScript namespaces.
Don't use TypeScript namespaces.
Don't export imported variables.
Don't add type annotations to variables, parameters, and class properties that are initialized with literal expressions.
Don't use parameter properties in class constructors.
Use either T[] or Array consistently.
Initialize each enum member value explicitly.
Make sure all enum members are literal values.

Files:

  • apps/web/app/(landing)/welcome/utms.tsx
  • apps/web/app/(app)/[emailAccountId]/onboarding/page.tsx
  • apps/web/app/(landing)/welcome/page.tsx
apps/web/app/**/*.tsx

📄 CodeRabbit inference engine (.cursor/rules/project-structure.mdc)

Components with onClick must be client components with use client directive

Files:

  • apps/web/app/(landing)/welcome/utms.tsx
  • apps/web/app/(app)/[emailAccountId]/onboarding/page.tsx
  • apps/web/app/(landing)/welcome/page.tsx
**/*.{js,jsx,ts,tsx}

📄 CodeRabbit inference engine (.cursor/rules/ultracite.mdc)

**/*.{js,jsx,ts,tsx}: Don't use elements in Next.js projects.
Don't use elements in Next.js projects.
Don't use namespace imports.
Don't access namespace imports dynamically.
Don't use global eval().
Don't use console.
Don't use debugger.
Don't use var.
Don't use with statements in non-strict contexts.
Don't use the arguments object.
Don't use consecutive spaces in regular expression literals.
Don't use the comma operator.
Don't use unnecessary boolean casts.
Don't use unnecessary callbacks with flatMap.
Use for...of statements instead of Array.forEach.
Don't create classes that only have static members (like a static namespace).
Don't use this and super in static contexts.
Don't use unnecessary catch clauses.
Don't use unnecessary constructors.
Don't use unnecessary continue statements.
Don't export empty modules that don't change anything.
Don't use unnecessary escape sequences in regular expression literals.
Don't use unnecessary labels.
Don't use unnecessary nested block statements.
Don't rename imports, exports, and destructured assignments to the same name.
Don't use unnecessary string or template literal concatenation.
Don't use String.raw in template literals when there are no escape sequences.
Don't use useless case statements in switch statements.
Don't use ternary operators when simpler alternatives exist.
Don't use useless this aliasing.
Don't initialize variables to undefined.
Don't use the void operators (they're not familiar).
Use arrow functions instead of function expressions.
Use Date.now() to get milliseconds since the Unix Epoch.
Use .flatMap() instead of map().flat() when possible.
Use literal property access instead of computed property access.
Don't use parseInt() or Number.parseInt() when binary, octal, or hexadecimal literals work.
Use concise optional chaining instead of chained logical expressions.
Use regular expression literals instead of the RegExp constructor when possible.
Don't use number literal object member names th...

Files:

  • apps/web/app/(landing)/welcome/utms.tsx
  • apps/web/app/(app)/[emailAccountId]/onboarding/page.tsx
  • apps/web/app/(landing)/welcome/page.tsx
!pages/_document.{js,jsx,ts,tsx}

📄 CodeRabbit inference engine (.cursor/rules/ultracite.mdc)

!pages/_document.{js,jsx,ts,tsx}: Don't import next/document outside of pages/_document.jsx in Next.js projects.
Don't import next/document outside of pages/_document.jsx in Next.js projects.

Files:

  • apps/web/app/(landing)/welcome/utms.tsx
  • apps/web/app/(app)/[emailAccountId]/onboarding/page.tsx
  • apps/web/app/(landing)/welcome/page.tsx
**/*.{jsx,tsx}

📄 CodeRabbit inference engine (.cursor/rules/ultracite.mdc)

**/*.{jsx,tsx}: Don't destructure props inside JSX components in Solid projects.
Don't use both children and dangerouslySetInnerHTML props on the same element.
Don't use Array index in keys.
Don't assign to React component props.
Don't define React components inside other components.
Don't use event handlers on non-interactive elements.
Don't assign JSX properties multiple times.
Don't add extra closing tags for components without children.
Use <>...</> instead of ....
Don't insert comments as text nodes.
Don't use the return value of React.render.
Make sure all dependencies are correctly specified in React hooks.
Make sure all React hooks are called from the top level of component functions.
Don't use unnecessary fragments.
Don't pass children as props.
Use semantic elements instead of role attributes in JSX.

Files:

  • apps/web/app/(landing)/welcome/utms.tsx
  • apps/web/app/(app)/[emailAccountId]/onboarding/page.tsx
  • apps/web/app/(landing)/welcome/page.tsx
**/*.{html,jsx,tsx}

📄 CodeRabbit inference engine (.cursor/rules/ultracite.mdc)

**/*.{html,jsx,tsx}: Don't use or elements.
Don't use accessKey attribute on any HTML element.
Don't set aria-hidden="true" on focusable elements.
Don't add ARIA roles, states, and properties to elements that don't support them.
Only use the scope prop on elements.
Don't assign non-interactive ARIA roles to interactive HTML elements.
Make sure label elements have text content and are associated with an input.
Don't assign interactive ARIA roles to non-interactive HTML elements.
Don't assign tabIndex to non-interactive HTML elements.
Don't use positive integers for tabIndex property.
Don't include "image", "picture", or "photo" in img alt prop.
Don't use explicit role property that's the same as the implicit/default role.
Make static elements with click handlers use a valid role attribute.
Always include a title element for SVG elements.
Give all elements requiring alt text meaningful information for screen readers.
Make sure anchors have content that's accessible to screen readers.
Assign tabIndex to non-interactive HTML elements with aria-activedescendant.
Include all required ARIA attributes for elements with ARIA roles.
Make sure ARIA properties are valid for the element's supported roles.
Always include a type attribute for button elements.
Make elements with interactive roles and handlers focusable.
Give heading elements content that's accessible to screen readers (not hidden with aria-hidden).
Always include a lang attribute on the html element.
Always include a title attribute for iframe elements.
Accompany onClick with at least one of: onKeyUp, onKeyDown, or onKeyPress.
Accompany onMouseOver/onMouseOut with onFocus/onBlur.
Include caption tracks for audio and video elements.
Make sure all anchors are valid and navigable.
Ensure all ARIA properties (aria-*) are valid.
Use valid, non-abstract ARIA roles for elements with ARIA roles.
Use valid ARIA state and property values.
Use valid values for the autocomplete attribute on input eleme...

Files:

  • apps/web/app/(landing)/welcome/utms.tsx
  • apps/web/app/(app)/[emailAccountId]/onboarding/page.tsx
  • apps/web/app/(landing)/welcome/page.tsx
apps/web/app/(app)/*/**

📄 CodeRabbit inference engine (.cursor/rules/page-structure.mdc)

Components for the page are either put in page.tsx, or in the apps/web/app/(app)/PAGE_NAME folder

Files:

  • apps/web/app/(app)/[emailAccountId]/onboarding/page.tsx
apps/web/app/(app)/*/**/*.tsx

📄 CodeRabbit inference engine (.cursor/rules/page-structure.mdc)

If you need to use onClick in a component, that component is a client component and file must start with 'use client'

Files:

  • apps/web/app/(app)/[emailAccountId]/onboarding/page.tsx
apps/web/app/(app)/*/**/**/*.tsx

📄 CodeRabbit inference engine (.cursor/rules/page-structure.mdc)

If we're in a deeply nested component we will use swr to fetch via API

Files:

  • apps/web/app/(app)/[emailAccountId]/onboarding/page.tsx
🧠 Learnings (8)
📓 Common learnings
Learnt from: CR
PR: elie222/inbox-zero#0
File: .cursor/rules/llm.mdc:0-0
Timestamp: 2025-08-17T16:57:25.834Z
Learning: Applies to apps/web/utils/usage.ts : Implement usage tracking and monitoring in apps/web/utils/usage.ts
📚 Learning: 2025-08-17T16:57:25.834Z
Learnt from: CR
PR: elie222/inbox-zero#0
File: .cursor/rules/llm.mdc:0-0
Timestamp: 2025-08-17T16:57:25.834Z
Learning: Applies to apps/web/utils/usage.ts : Implement usage tracking and monitoring in apps/web/utils/usage.ts

Applied to files:

  • apps/web/app/(landing)/welcome/utms.tsx
📚 Learning: 2025-08-17T16:57:25.834Z
Learnt from: CR
PR: elie222/inbox-zero#0
File: .cursor/rules/llm.mdc:0-0
Timestamp: 2025-08-17T16:57:25.834Z
Learning: Applies to apps/web/utils/{ai,llms}/**/*.ts : Use descriptive scoped loggers per feature and log inputs/outputs with appropriate levels and context

Applied to files:

  • apps/web/app/(landing)/welcome/utms.tsx
📚 Learning: 2025-06-05T09:49:12.168Z
Learnt from: elie222
PR: elie222/inbox-zero#485
File: apps/web/app/(landing)/login/page.tsx:41-43
Timestamp: 2025-06-05T09:49:12.168Z
Learning: In Next.js App Router, components that use the `useSearchParams` hook require a Suspense boundary to handle the asynchronous nature of search parameter access. The Suspense wrapper is necessary and should not be removed when a component uses useSearchParams.

Applied to files:

  • apps/web/app/(app)/[emailAccountId]/onboarding/page.tsx
  • apps/web/app/(landing)/welcome/page.tsx
📚 Learning: 2025-07-18T15:04:30.467Z
Learnt from: CR
PR: elie222/inbox-zero#0
File: apps/web/CLAUDE.md:0-0
Timestamp: 2025-07-18T15:04:30.467Z
Learning: Applies to apps/web/**/*.tsx : Use LoadingContent component for async data

Applied to files:

  • apps/web/app/(app)/[emailAccountId]/onboarding/page.tsx
📚 Learning: 2025-08-10T22:03:30.507Z
Learnt from: elie222
PR: elie222/inbox-zero#667
File: apps/web/app/(app)/[emailAccountId]/onboarding/page.tsx:18-25
Timestamp: 2025-08-10T22:03:30.507Z
Learning: In Next.js 15, both `params` and `searchParams` passed to page components in the App Router are Promises that need to be awaited. They should be typed as `Promise<{...}>` and accessed using `await` in server components or React's `use()` hook in client components. This is different from Next.js 14 where they were plain objects.

Applied to files:

  • apps/web/app/(app)/[emailAccountId]/onboarding/page.tsx
  • apps/web/app/(landing)/welcome/page.tsx
📚 Learning: 2025-07-20T09:00:16.505Z
Learnt from: CR
PR: elie222/inbox-zero#0
File: .cursor/rules/project-structure.mdc:0-0
Timestamp: 2025-07-20T09:00:16.505Z
Learning: Applies to apps/web/app/(app)/*/page.tsx : Pages are Server components for direct data loading

Applied to files:

  • apps/web/app/(landing)/welcome/page.tsx
📚 Learning: 2025-07-18T15:07:00.269Z
Learnt from: CR
PR: elie222/inbox-zero#0
File: .cursor/rules/page-structure.mdc:0-0
Timestamp: 2025-07-18T15:07:00.269Z
Learning: Applies to apps/web/app/(app)/*/page.tsx : Pages are Server components so you can load data into them directly

Applied to files:

  • apps/web/app/(landing)/welcome/page.tsx
🧬 Code graph analysis (3)
apps/web/app/(landing)/welcome/utms.tsx (1)
apps/web/utils/logger.ts (1)
  • createScopedLogger (17-65)
apps/web/app/(app)/[emailAccountId]/onboarding/page.tsx (2)
apps/web/utils/auth.ts (1)
  • auth (473-474)
apps/web/app/(landing)/welcome/utms.tsx (1)
  • fetchUserAndStoreUtms (7-18)
apps/web/app/(landing)/welcome/page.tsx (2)
apps/web/utils/auth.ts (1)
  • auth (473-474)
apps/web/app/(landing)/welcome/utms.tsx (1)
  • fetchUserAndStoreUtms (7-18)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
  • GitHub Check: Analyze (javascript-typescript)

@claude
Copy link

claude bot commented Aug 29, 2025

Claude finished @elie222's task —— View job


PR Review: Fix UTMs

I've reviewed the UTM handling implementation across all 4 modified files. Here's my comprehensive feedback:

Tasks

  • Read repository guidelines (CLAUDE.md)
  • Analyze modified files and understand changes
  • Review code quality and best practices
  • Check for potential bugs and security issues
  • Assess performance considerations
  • Evaluate test coverage needs
  • Provide comprehensive feedback

📋 Summary

This PR implements UTM parameter tracking by storing UTM data from cookies into the user database. The changes add UTM collection calls to the onboarding and welcome pages, create a dedicated UTM handling module, and remove UTM-related code from the welcome-redirect page.

🎯 Code Quality & Best Practices

✅ Good Practices:

  • Clean separation of concerns with dedicated utms.tsx module
  • Proper error handling with try-catch and logging
  • Consistent use of Next.js after() for non-blocking operations
  • TypeScript types are properly maintained
  • Database operations use Prisma for type safety

⚠️ Areas for Improvement:

  • Missing input validation for UTM parameters
  • No length limits on stored UTM values
  • Consider adding JSDoc comments for the exported functions

🐛 Potential Bugs & Issues

🔴 Critical Issues:

  1. Data Integrity: No validation that UTM values contain expected data types or formats
  2. Database Constraints: UTM values could potentially exceed database field limits if very long values are stored

🟡 Minor Issues:

  • The utms.tsx:13 check !user.utms may not work as expected if utms is an empty object rather than null

🔒 Security Concerns

⚠️ Medium Risk:

  • Cookie Poisoning: UTM values are directly read from cookies without sanitization or validation
  • XSS Potential: If UTM data is later displayed in UI without proper escaping, it could lead to XSS
  • Database Injection: While Prisma provides protection, the lack of input validation is concerning

Recommendations:

// Add validation in utms.tsx
const validateUtmValue = (value: string | undefined): string | undefined => {
  if (!value || value.length > 255) return undefined;
  // Remove potentially dangerous characters
  return value.replace(/[<>\"']/g, '');
};

⚡ Performance Considerations

✅ Good Performance:

  • Uses after() to prevent blocking the main response
  • Database queries are minimal and focused
  • Proper conditional logic prevents unnecessary database updates

🔄 Potential Optimizations:

  • Consider batching UTM storage if multiple pages are hit in quick succession
  • Add caching to prevent redundant database queries for the same user

🧪 Test Coverage

❌ Missing Tests:

  • No unit tests for UTM extraction and storage logic
  • No integration tests for the end-to-end UTM flow
  • No error handling tests for database failures

Recommended Tests:

// Example test cases needed:
describe('UTM Storage', () => {
  it('should store valid UTM parameters')
  it('should handle missing UTM cookies gracefully')  
  it('should not overwrite existing UTM data')
  it('should sanitize malicious UTM values')
  it('should handle database errors gracefully')
})

📁 File-Specific Feedback

apps/web/app/(landing)/welcome/utms.tsx (lines 7-44)

  • Line 13: Consider checking if user.utms is null/undefined OR an empty object
  • Lines 24-28: Add validation before storing cookie values
  • Line 40: Consider using upsert instead of update for better safety

apps/web/app/(app)/[emailAccountId]/onboarding/page.tsx (lines 24-28)

  • Clean implementation using after() for non-blocking execution
  • Good error boundary with optional chaining

apps/web/app/(landing)/welcome/page.tsx (lines 28-32)

  • Identical pattern to onboarding page - good consistency

apps/web/app/(landing)/welcome-redirect/page.tsx (line 19)

  • Good that UTM field is still selected for potential future use

🎯 Recommendations

  1. High Priority: Add input validation and sanitization to prevent security issues
  2. Medium Priority: Add comprehensive test coverage
  3. Medium Priority: Consider adding JSDoc documentation
  4. Low Priority: Add database constraints for UTM field lengths

✅ Overall Assessment

The implementation is functionally correct and follows good architectural patterns. The main concerns are around input validation and test coverage. The security risks are manageable but should be addressed before production deployment.

Verdict: Approve with recommendations - The core functionality is solid, but addressing the validation concerns would make this production-ready.


@claude
Copy link

claude bot commented Aug 29, 2025

Claude finished @elie222's task —— View job


PR Review: Fix UTMs

I've reviewed the UTM handling implementation across all 4 modified files. Here's my comprehensive feedback:

Tasks

  • Read repository guidelines (CLAUDE.md)
  • Analyze modified files and understand changes
  • Review code quality and best practices
  • Check for potential bugs and security issues
  • Assess performance considerations
  • Evaluate test coverage needs
  • Provide comprehensive feedback

📋 Summary

This PR implements UTM parameter tracking by storing UTM data from cookies into the user database. The changes add UTM collection calls to the onboarding and welcome pages, create a dedicated UTM handling module, and remove UTM-related code from the welcome-redirect page.

🎯 Code Quality & Best Practices

✅ Good Practices:

  • Clean separation of concerns with dedicated utms.tsx module
  • Proper error handling with try-catch and logging
  • Consistent use of Next.js after() for non-blocking operations
  • TypeScript types are properly maintained
  • Database operations use Prisma for type safety

⚠️ Areas for Improvement:

  • Missing input validation for UTM parameters
  • No length limits on stored UTM values
  • Consider adding JSDoc comments for the exported functions

🐛 Potential Bugs & Issues

🔴 Critical Issues:

  1. Data Integrity: No validation that UTM values contain expected data types or formats
  2. Database Constraints: UTM values could potentially exceed database field limits if very long values are stored

🟡 Minor Issues:

  • The utms.tsx:13 check !user.utms may not work as expected if utms is an empty object rather than null

🔒 Security Concerns

⚠️ Medium Risk:

  • Cookie Poisoning: UTM values are directly read from cookies without sanitization or validation
  • XSS Potential: If UTM data is later displayed in UI without proper escaping, it could lead to XSS
  • Database Injection: While Prisma provides protection, the lack of input validation is concerning

Recommendations:

// Add validation in utms.tsx
const validateUtmValue = (value: string | undefined): string | undefined => {
  if (!value || value.length > 255) return undefined;
  // Remove potentially dangerous characters
  return value.replace(/[<>\"']/g, '');
};

⚡ Performance Considerations

✅ Good Performance:

  • Uses after() to prevent blocking the main response
  • Database queries are minimal and focused
  • Proper conditional logic prevents unnecessary database updates

🔄 Potential Optimizations:

  • Consider batching UTM storage if multiple pages are hit in quick succession
  • Add caching to prevent redundant database queries for the same user

🧪 Test Coverage

❌ Missing Tests:

  • No unit tests for UTM extraction and storage logic
  • No integration tests for the end-to-end UTM flow
  • No error handling tests for database failures

Recommended Tests:

// Example test cases needed:
describe('UTM Storage', () => {
  it('should store valid UTM parameters')
  it('should handle missing UTM cookies gracefully')  
  it('should not overwrite existing UTM data')
  it('should sanitize malicious UTM values')
  it('should handle database errors gracefully')
})

📁 File-Specific Feedback

apps/web/app/(landing)/welcome/utms.tsx (lines 7-44)

  • Line 13: Consider checking if user.utms is null/undefined OR an empty object
  • Lines 24-28: Add validation before storing cookie values
  • Line 40: Consider using upsert instead of update for better safety

apps/web/app/(app)/[emailAccountId]/onboarding/page.tsx (lines 24-28)

  • Clean implementation using after() for non-blocking execution
  • Good error boundary with optional chaining

apps/web/app/(landing)/welcome/page.tsx (lines 28-32)

  • Identical pattern to onboarding page - good consistency

apps/web/app/(landing)/welcome-redirect/page.tsx (line 19)

  • Good that UTM field is still selected for potential future use

🎯 Recommendations

  1. High Priority: Add input validation and sanitization to prevent security issues
  2. Medium Priority: Add comprehensive test coverage
  3. Medium Priority: Consider adding JSDoc documentation
  4. Low Priority: Add database constraints for UTM field lengths

✅ Overall Assessment

The implementation is functionally correct and follows good architectural patterns. The main concerns are around input validation and test coverage. The security risks are manageable but should be addressed before production deployment.

Verdict: Approve with recommendations - The core functionality is solid, but addressing the validation concerns would make this production-ready.


@elie222 elie222 merged commit 31d5f8f into main Aug 29, 2025
13 checks passed
@elie222 elie222 deleted the fix/utms branch December 18, 2025 23:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant