Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Note Other AI code review bot(s) detectedCodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review. WalkthroughUpdates the privacy policy content, adds a normalized SHA-256 hashing utility, introduces privacy-aware recursive redaction/hashing in the logger, propagates email provider into action context, simplifies a webhook logger call, and bumps the version. Changes
Sequence Diagram(s)sequenceDiagram
participant App as Application Code
participant Logger as Scoped Logger
participant Processor as hashSensitiveFields
participant Sink as Axiom/Console
Note over Logger,Processor: Privacy-aware logging pipeline (server hashes sensitive strings)
App->>Logger: log(level, payload)
Logger->>Processor: transform(payload)
Processor-->>Logger: transformedPayload
Logger->>Sink: emit(transformedPayload)
sequenceDiagram
participant Caller as ActionClient
participant Safe as safe-action
participant Next as next(ctx)
Note over Safe: provider is extracted and injected into ctx and logger
Caller->>Safe: invoke(emailAccount, ctx)
Safe->>Safe: logger = logger.with({ provider: emailAccount.account.provider, ... })
Safe->>Next: next({ ...ctx, provider: emailAccount.account.provider, emailAccount })
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20–30 minutes
Possibly related PRs
Poem
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
apps/web/app/(landing)/privacy/content.mdx (1)
9-9: Optional: Minor wording refinements for conciseness.A few minor wordiness improvements could enhance readability (all optional):
- Line 9: "aims to give you information on how" → consider "aims to inform you how" or "explains how"
- Line 15: "address rights with respect to such data" → consider "address your rights concerning such data"
- Line 29: "agree to all of the changes" → consider "agree to all changes"
- Line 92: "In order to provide" → consider "To provide"
These refinements are cosmetic and the current phrasing is legally sound; prioritize only if polishing for brand voice.
Also applies to: 15-15, 29-29, 92-92
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (6)
apps/web/app/(landing)/privacy/content.mdx(1 hunks)apps/web/app/api/google/webhook/process-label-removed-event.ts(1 hunks)apps/web/utils/actions/safe-action.ts(1 hunks)apps/web/utils/hash.ts(1 hunks)apps/web/utils/logger.ts(4 hunks)version.txt(1 hunks)
🧰 Additional context used
📓 Path-based instructions (12)
!{.cursor/rules/*.mdc}
📄 CodeRabbit inference engine (.cursor/rules/cursor-rules.mdc)
Never place rule files in the project root, in subdirectories outside .cursor/rules, or in any other location
Files:
version.txtapps/web/utils/logger.tsapps/web/app/(landing)/privacy/content.mdxapps/web/app/api/google/webhook/process-label-removed-event.tsapps/web/utils/hash.tsapps/web/utils/actions/safe-action.ts
!pages/_document.{js,jsx,ts,tsx}
📄 CodeRabbit inference engine (.cursor/rules/ultracite.mdc)
!pages/_document.{js,jsx,ts,tsx}: Don't import next/document outside of pages/_document.jsx in Next.js projects.
Don't import next/document outside of pages/_document.jsx in Next.js projects.
Files:
version.txtapps/web/utils/logger.tsapps/web/app/(landing)/privacy/content.mdxapps/web/app/api/google/webhook/process-label-removed-event.tsapps/web/utils/hash.tsapps/web/utils/actions/safe-action.ts
apps/web/**/*.{ts,tsx}
📄 CodeRabbit inference engine (apps/web/CLAUDE.md)
apps/web/**/*.{ts,tsx}: Use TypeScript with strict null checks
Path aliases: Use@/for imports from project root
Use proper error handling with try/catch blocks
Format code with Prettier
Leverage TypeScript inference for better DX
Files:
apps/web/utils/logger.tsapps/web/app/api/google/webhook/process-label-removed-event.tsapps/web/utils/hash.tsapps/web/utils/actions/safe-action.ts
**/*.ts
📄 CodeRabbit inference engine (.cursor/rules/form-handling.mdc)
**/*.ts: The same validation should be done in the server action too
Define validation schemas using Zod
Files:
apps/web/utils/logger.tsapps/web/app/api/google/webhook/process-label-removed-event.tsapps/web/utils/hash.tsapps/web/utils/actions/safe-action.ts
**/*.{ts,tsx}
📄 CodeRabbit inference engine (.cursor/rules/logging.mdc)
**/*.{ts,tsx}: UsecreateScopedLoggerfor logging in backend TypeScript files
Typically add the logger initialization at the top of the file when usingcreateScopedLogger
Only use.with()on a logger instance within a specific function, not for a global loggerImport Prisma in the project using
import prisma from "@/utils/prisma";
**/*.{ts,tsx}: Don't use TypeScript enums.
Don't use TypeScript const enum.
Don't use the TypeScript directive @ts-ignore.
Don't use primitive type aliases or misleading types.
Don't use empty type parameters in type aliases and interfaces.
Don't use any or unknown as type constraints.
Don't use implicit any type on variable declarations.
Don't let variables evolve into any type through reassignments.
Don't use non-null assertions with the ! postfix operator.
Don't misuse the non-null assertion operator (!) in TypeScript files.
Don't use user-defined types.
Use as const instead of literal types and type annotations.
Use export type for types.
Use import type for types.
Don't declare empty interfaces.
Don't merge interfaces and classes unsafely.
Don't use overload signatures that aren't next to each other.
Use the namespace keyword instead of the module keyword to declare TypeScript namespaces.
Don't use TypeScript namespaces.
Don't export imported variables.
Don't add type annotations to variables, parameters, and class properties that are initialized with literal expressions.
Don't use parameter properties in class constructors.
Use either T[] or Array consistently.
Initialize each enum member value explicitly.
Make sure all enum members are literal values.
Files:
apps/web/utils/logger.tsapps/web/app/api/google/webhook/process-label-removed-event.tsapps/web/utils/hash.tsapps/web/utils/actions/safe-action.ts
apps/web/utils/**
📄 CodeRabbit inference engine (.cursor/rules/project-structure.mdc)
Create utility functions in
utils/folder for reusable logic
Files:
apps/web/utils/logger.tsapps/web/utils/hash.tsapps/web/utils/actions/safe-action.ts
apps/web/utils/**/*.ts
📄 CodeRabbit inference engine (.cursor/rules/project-structure.mdc)
apps/web/utils/**/*.ts: Use lodash utilities for common operations (arrays, objects, strings)
Import specific lodash functions to minimize bundle size
Files:
apps/web/utils/logger.tsapps/web/utils/hash.tsapps/web/utils/actions/safe-action.ts
**/*.{js,jsx,ts,tsx}
📄 CodeRabbit inference engine (.cursor/rules/ultracite.mdc)
**/*.{js,jsx,ts,tsx}: Don't useelements in Next.js projects.
Don't use elements in Next.js projects.
Don't use namespace imports.
Don't access namespace imports dynamically.
Don't use global eval().
Don't use console.
Don't use debugger.
Don't use var.
Don't use with statements in non-strict contexts.
Don't use the arguments object.
Don't use consecutive spaces in regular expression literals.
Don't use the comma operator.
Don't use unnecessary boolean casts.
Don't use unnecessary callbacks with flatMap.
Use for...of statements instead of Array.forEach.
Don't create classes that only have static members (like a static namespace).
Don't use this and super in static contexts.
Don't use unnecessary catch clauses.
Don't use unnecessary constructors.
Don't use unnecessary continue statements.
Don't export empty modules that don't change anything.
Don't use unnecessary escape sequences in regular expression literals.
Don't use unnecessary labels.
Don't use unnecessary nested block statements.
Don't rename imports, exports, and destructured assignments to the same name.
Don't use unnecessary string or template literal concatenation.
Don't use String.raw in template literals when there are no escape sequences.
Don't use useless case statements in switch statements.
Don't use ternary operators when simpler alternatives exist.
Don't use useless this aliasing.
Don't initialize variables to undefined.
Don't use the void operators (they're not familiar).
Use arrow functions instead of function expressions.
Use Date.now() to get milliseconds since the Unix Epoch.
Use .flatMap() instead of map().flat() when possible.
Use literal property access instead of computed property access.
Don't use parseInt() or Number.parseInt() when binary, octal, or hexadecimal literals work.
Use concise optional chaining instead of chained logical expressions.
Use regular expression literals instead of the RegExp constructor when possible.
Don't use number literal object member names th...
Files:
apps/web/utils/logger.tsapps/web/app/api/google/webhook/process-label-removed-event.tsapps/web/utils/hash.tsapps/web/utils/actions/safe-action.ts
apps/web/app/**
📄 CodeRabbit inference engine (apps/web/CLAUDE.md)
NextJS app router structure with (app) directory
Files:
apps/web/app/(landing)/privacy/content.mdxapps/web/app/api/google/webhook/process-label-removed-event.ts
apps/web/app/api/**/*.{ts,js}
📄 CodeRabbit inference engine (.cursor/rules/security-audit.mdc)
apps/web/app/api/**/*.{ts,js}: All API route handlers in 'apps/web/app/api/' must use authentication middleware: withAuth, withEmailAccount, or withError (with custom authentication logic).
All Prisma queries in API routes must include user/account filtering (e.g., emailAccountId or userId in WHERE clauses) to prevent unauthorized data access.
All parameters used in API routes must be validated before use; do not use parameters from 'params' or request bodies directly in queries without validation.
Request bodies in API routes should use Zod schemas for validation.
API routes should only return necessary fields using Prisma's 'select' and must not include sensitive data in error messages.
Error messages in API routes must not reveal internal details; use generic errors and SafeError for user-facing errors.
All QStash endpoints (API routes called via publishToQstash or publishToQstashQueue) must use verifySignatureAppRouter to verify request authenticity.
All cron endpoints in API routes must use hasCronSecret or hasPostCronSecret for authentication.
Do not hardcode weak or plaintext secrets in API route files; secrets must not be directly assigned as string literals.
Review all new withError usage in API routes to ensure custom authentication is implemented where required.
Files:
apps/web/app/api/google/webhook/process-label-removed-event.ts
apps/web/utils/actions/**/*.ts
📄 CodeRabbit inference engine (apps/web/CLAUDE.md)
apps/web/utils/actions/**/*.ts: Use server actions for all mutations (create/update/delete operations)
next-safe-actionprovides centralized error handling
Use Zod schemas for validation on both client and server
UserevalidatePathin server actions for cache invalidation
apps/web/utils/actions/**/*.ts: Use server actions (withnext-safe-action) for all mutations (create/update/delete operations); do NOT use POST API routes for mutations.
UserevalidatePathin server actions to invalidate cache after mutations.
Files:
apps/web/utils/actions/safe-action.ts
apps/web/utils/actions/*.ts
📄 CodeRabbit inference engine (.cursor/rules/server-actions.mdc)
apps/web/utils/actions/*.ts: Implement all server actions using thenext-safe-actionlibrary for type safety, input validation, context management, and error handling. Refer toapps/web/utils/actions/safe-action.tsfor client definitions (actionClient,actionClientUser,adminActionClient).
UseactionClientUserwhen only authenticated user context (userId) is needed.
UseactionClientwhen both authenticated user context and a specificemailAccountIdare needed. TheemailAccountIdmust be bound when calling the action from the client.
UseadminActionClientfor actions restricted to admin users.
Access necessary context (likeuserId,emailAccountId, etc.) provided by the safe action client via thectxobject in the.action()handler.
Server Actions are strictly for mutations (operations that change data, e.g., creating, updating, deleting). Do NOT use Server Actions for data fetching (GET operations). For data fetching, use dedicated GET API Routes combined with SWR Hooks.
UseSafeErrorfor expected/handled errors within actions if needed.next-safe-actionprovides centralized error handling.
Use the.metadata({ name: "actionName" })method to provide a meaningful name for monitoring. Sentry instrumentation is automatically applied viawithServerActionInstrumentationwithin the safe action clients.
If an action modifies data displayed elsewhere, userevalidatePathorrevalidateTagfromnext/cachewithin the action handler as needed.Server action files must start with
use server
Files:
apps/web/utils/actions/safe-action.ts
🧠 Learnings (17)
📚 Learning: 2025-09-17T22:05:28.646Z
Learnt from: CR
Repo: elie222/inbox-zero PR: 0
File: .cursor/rules/llm.mdc:0-0
Timestamp: 2025-09-17T22:05:28.646Z
Learning: Applies to apps/web/utils/ai/**/*.{ts,tsx} : Use descriptive scoped loggers for each feature
Applied to files:
apps/web/utils/logger.tsapps/web/app/api/google/webhook/process-label-removed-event.ts
📚 Learning: 2025-09-17T22:05:28.646Z
Learnt from: CR
Repo: elie222/inbox-zero PR: 0
File: .cursor/rules/llm.mdc:0-0
Timestamp: 2025-09-17T22:05:28.646Z
Learning: Applies to apps/web/utils/ai/**/*.{ts,tsx} : Log inputs and outputs with appropriate log levels and include relevant context
Applied to files:
apps/web/utils/logger.ts
📚 Learning: 2025-07-18T15:06:47.625Z
Learnt from: CR
Repo: elie222/inbox-zero PR: 0
File: .cursor/rules/logging.mdc:0-0
Timestamp: 2025-07-18T15:06:47.625Z
Learning: Applies to **/*.{ts,tsx} : Typically add the logger initialization at the top of the file when using `createScopedLogger`
Applied to files:
apps/web/utils/logger.ts
📚 Learning: 2025-07-18T15:06:47.625Z
Learnt from: CR
Repo: elie222/inbox-zero PR: 0
File: .cursor/rules/logging.mdc:0-0
Timestamp: 2025-07-18T15:06:47.625Z
Learning: Applies to **/*.{ts,tsx} : Use `createScopedLogger` for logging in backend TypeScript files
Applied to files:
apps/web/utils/logger.ts
📚 Learning: 2025-07-18T15:06:47.625Z
Learnt from: CR
Repo: elie222/inbox-zero PR: 0
File: .cursor/rules/logging.mdc:0-0
Timestamp: 2025-07-18T15:06:47.625Z
Learning: Applies to **/*.{ts,tsx} : Only use `.with()` on a logger instance within a specific function, not for a global logger
Applied to files:
apps/web/utils/logger.ts
📚 Learning: 2025-07-20T09:03:06.318Z
Learnt from: CR
Repo: elie222/inbox-zero PR: 0
File: .cursor/rules/ultracite.mdc:0-0
Timestamp: 2025-07-20T09:03:06.318Z
Learning: Applies to **/*.{js,jsx,ts,tsx} : Don't use unnecessary labels.
Applied to files:
apps/web/app/api/google/webhook/process-label-removed-event.ts
📚 Learning: 2025-07-18T17:27:58.249Z
Learnt from: CR
Repo: elie222/inbox-zero PR: 0
File: .cursor/rules/server-actions.mdc:0-0
Timestamp: 2025-07-18T17:27:58.249Z
Learning: Applies to apps/web/utils/actions/*.ts : Use `actionClient` when both authenticated user context and a specific `emailAccountId` are needed. The `emailAccountId` must be bound when calling the action from the client.
Applied to files:
apps/web/app/api/google/webhook/process-label-removed-event.tsapps/web/utils/actions/safe-action.ts
📚 Learning: 2025-09-17T22:05:28.646Z
Learnt from: CR
Repo: elie222/inbox-zero PR: 0
File: .cursor/rules/llm.mdc:0-0
Timestamp: 2025-09-17T22:05:28.646Z
Learning: Applies to apps/web/utils/{ai,llms}/**/*.{ts,tsx} : Keep related AI functions co-located and extract common patterns into utilities; document complex AI logic with clear comments
Applied to files:
apps/web/utils/hash.ts
📚 Learning: 2025-07-18T17:27:58.249Z
Learnt from: CR
Repo: elie222/inbox-zero PR: 0
File: .cursor/rules/server-actions.mdc:0-0
Timestamp: 2025-07-18T17:27:58.249Z
Learning: Applies to apps/web/utils/actions/*.ts : Access necessary context (like `userId`, `emailAccountId`, etc.) provided by the safe action client via the `ctx` object in the `.action()` handler.
Applied to files:
apps/web/utils/actions/safe-action.ts
📚 Learning: 2025-07-18T17:27:58.249Z
Learnt from: CR
Repo: elie222/inbox-zero PR: 0
File: .cursor/rules/server-actions.mdc:0-0
Timestamp: 2025-07-18T17:27:58.249Z
Learning: Applies to apps/web/utils/actions/*.ts : Implement all server actions using the `next-safe-action` library for type safety, input validation, context management, and error handling. Refer to `apps/web/utils/actions/safe-action.ts` for client definitions (`actionClient`, `actionClientUser`, `adminActionClient`).
Applied to files:
apps/web/utils/actions/safe-action.ts
📚 Learning: 2025-07-18T17:27:58.249Z
Learnt from: CR
Repo: elie222/inbox-zero PR: 0
File: .cursor/rules/server-actions.mdc:0-0
Timestamp: 2025-07-18T17:27:58.249Z
Learning: Applies to apps/web/utils/actions/*.ts : Use `actionClientUser` when only authenticated user context (`userId`) is needed.
Applied to files:
apps/web/utils/actions/safe-action.ts
📚 Learning: 2025-07-18T15:04:30.467Z
Learnt from: CR
Repo: elie222/inbox-zero PR: 0
File: apps/web/CLAUDE.md:0-0
Timestamp: 2025-07-18T15:04:30.467Z
Learning: Applies to apps/web/app/api/**/route.ts : Use `withEmailAccount` for email-account-level operations
Applied to files:
apps/web/utils/actions/safe-action.ts
📚 Learning: 2025-07-18T17:27:58.249Z
Learnt from: CR
Repo: elie222/inbox-zero PR: 0
File: .cursor/rules/server-actions.mdc:0-0
Timestamp: 2025-07-18T17:27:58.249Z
Learning: Applies to apps/web/utils/actions/*.ts : Use `adminActionClient` for actions restricted to admin users.
Applied to files:
apps/web/utils/actions/safe-action.ts
📚 Learning: 2025-07-18T15:04:30.467Z
Learnt from: CR
Repo: elie222/inbox-zero PR: 0
File: apps/web/CLAUDE.md:0-0
Timestamp: 2025-07-18T15:04:30.467Z
Learning: Applies to apps/web/utils/actions/**/*.ts : `next-safe-action` provides centralized error handling
Applied to files:
apps/web/utils/actions/safe-action.ts
📚 Learning: 2025-07-18T17:27:58.249Z
Learnt from: CR
Repo: elie222/inbox-zero PR: 0
File: .cursor/rules/server-actions.mdc:0-0
Timestamp: 2025-07-18T17:27:58.249Z
Learning: Applies to apps/web/utils/actions/*.ts : Use `SafeError` for expected/handled errors within actions if needed. `next-safe-action` provides centralized error handling.
Applied to files:
apps/web/utils/actions/safe-action.ts
📚 Learning: 2025-07-18T15:05:16.146Z
Learnt from: CR
Repo: elie222/inbox-zero PR: 0
File: .cursor/rules/fullstack-workflow.mdc:0-0
Timestamp: 2025-07-18T15:05:16.146Z
Learning: Applies to apps/web/utils/actions/**/*.ts : Use server actions (with `next-safe-action`) for all mutations (create/update/delete operations); do NOT use POST API routes for mutations.
Applied to files:
apps/web/utils/actions/safe-action.ts
📚 Learning: 2025-07-18T17:27:46.389Z
Learnt from: CR
Repo: elie222/inbox-zero PR: 0
File: .cursor/rules/security.mdc:0-0
Timestamp: 2025-07-18T17:27:46.389Z
Learning: Applies to **/api/**/route.ts : Use `withEmailAccount` middleware for API routes that operate on a specific email account (i.e., use or require `emailAccountId`).
Applied to files:
apps/web/utils/actions/safe-action.ts
🧬 Code graph analysis (2)
apps/web/utils/logger.ts (3)
apps/web/utils/error.ts (1)
formatError(51-61)apps/web/env.ts (1)
env(16-242)apps/web/utils/hash.ts (1)
hash(6-12)
apps/web/app/api/google/webhook/process-label-removed-event.ts (1)
apps/web/app/api/outlook/webhook/logger.ts (1)
logger(3-3)
🪛 LanguageTool
apps/web/app/(landing)/privacy/content.mdx
[style] ~9-~9: Consider using a different verb to strengthen your wording.
Context: ...acy Policy This privacy policy aims to give you information on how Inbox Zero colle...
(GIVE_INFORMATION)
[style] ~15-~15: ‘with respect to’ might be wordy. Consider a shorter alternative.
Context: ...in the first instance to address rights with respect to such data. ### 1.3 Contact Details **...
(EN_WORDINESS_PREMIUM_WITH_RESPECT_TO)
[style] ~29-~29: Consider removing “of” to be more concise
Context: ...ve been posted, that means you agree to all of the changes. It is important that the per...
(ALL_OF_THE)
[style] ~36-~36: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...a in a manner that could identify you. We may collect, use, store, and transfer d...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
[style] ~92-~92: Consider a more concise word here.
Context: ...ls ### 5.1 Data Shared with AI Models In order to provide email categorization, response ...
(IN_ORDER_TO_PREMIUM)
[style] ~181-~181: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...personal data that we hold about you. - Request erasure of your personal data. - Object...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)
- GitHub Check: cubic · AI code reviewer
- GitHub Check: Jit Security
- GitHub Check: test
- GitHub Check: Analyze (javascript-typescript)
🔇 Additional comments (5)
apps/web/app/(landing)/privacy/content.mdx (5)
1-32: Well-structured privacy policy header with clear controller/processor roles.The reorganized structure into numbered sections is clearer and more professional. The explicit distinction between Inbox Zero acting as a data controller vs. data processor (lines 11-15) is legally important and well-articulated. Contact details and last-updated information are appropriately positioned.
33-67: Strong transparency on data categories and retention.The "What We Store and What We Don't" section (lines 55-67) is a valuable clarity improvement. Explicitly stating that full email content is not permanently stored while detailing what is retained (sender info, metadata, temporary summaries) helps users understand data handling practices clearly.
79-103: Solid legal basis and transparent AI data sharing policies.The legal basis section correctly covers GDPR processing grounds. The AI data sharing section (5.1–5.2) with explicit "Zero Data Retention" (line 101–103) clearly communicates that AI providers cannot train on customer data and don't retain it beyond abuse monitoring. This is transparent and appropriate for the service's privacy positioning.
114-146: Comprehensive email provider API compliance sections.The dedicated Google API Services (lines 116–130) and Microsoft Graph API (lines 132–146) sections are well-structured with clear do/don't lists. Explicitly stating that email data is not used for advertising, shared beyond policy scope, or stored on servers directly addresses common privacy concerns for email automation services.
148-190: Comprehensive legal compliance coverage for international transfers, security, and user rights.The international transfers section (lines 148–157) appropriately mentions Standard Contractual Clauses and EU-US Data Privacy Framework. The legal rights section (lines 175–190) comprehensively enumerates GDPR rights, references the ICO guidance, commits to one-month response timelines, and explains identity verification for security. This aligns well with regulatory expectations.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
2 issues found across 6 files
Prompt for AI agents (all 2 issues)
Understand the root cause of the following 2 issues and fix them.
<file name="apps/web/utils/hash.ts">
<violation number="1" location="apps/web/utils/hash.ts:11">
Avoid casting the hashed string back to the original generic type; it breaks type safety because the hashed value no longer matches the input type.</violation>
</file>
<file name="apps/web/utils/logger.ts">
<violation number="1" location="apps/web/utils/logger.ts:191">
hashSensitiveFields treats Error/Date instances as plain objects, so logs now lose their message/values when those are processed. Please skip non-plain objects so existing error logging keeps working.</violation>
</file>
React with 👍 or 👎 to teach cubic. Mention @cubic-dev-ai to give feedback, ask questions, or re-run the review.
apps/web/utils/logger.ts
Outdated
| return obj.map((item) => hashSensitiveFields(item, depth + 1)) as T; | ||
| } | ||
|
|
||
| if (typeof obj === "object") { |
There was a problem hiding this comment.
hashSensitiveFields treats Error/Date instances as plain objects, so logs now lose their message/values when those are processed. Please skip non-plain objects so existing error logging keeps working.
Prompt for AI agents
Address the following comment on apps/web/utils/logger.ts at line 191:
<comment>hashSensitiveFields treats Error/Date instances as plain objects, so logs now lose their message/values when those are processed. Please skip non-plain objects so existing error logging keeps working.</comment>
<file context>
@@ -143,3 +150,70 @@ function processErrorsInObject(obj: unknown): unknown {
+ return obj.map((item) => hashSensitiveFields(item, depth + 1)) as T;
+ }
+
+ if (typeof obj === "object") {
+ const processed: Record<string, unknown> = {};
+ for (const [key, value] of Object.entries(obj)) {
</file context>
✅ Addressed in d00845c
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (3)
apps/web/utils/logger.ts (3)
207-209: Consider using a type-safe import pattern instead of dynamic require.While the dynamic require avoids client-side bundling, it lacks TypeScript type safety. If the
hashfunction signature changes, this could fail at runtime without compile-time detection.Consider importing at the module level with a conditional check:
+import { hash } from "@/utils/hash"; + /** biome-ignore-all lint/suspicious/noConsole: we use console.log for development logs */ import { log } from "next-axiom";Then simplify line 209:
) { - // Dynamic import to avoid bundling crypto on client - const { hash } = require("@/utils/hash"); - processed[key] = hash(value); + processed[key] = hash(value); }The bundler's tree-shaking and the server-side check on line 205 should prevent the crypto dependency from reaching the client bundle.
179-182: Optional: Consider explicit circular reference handling.The current depth-based approach (MAX_DEPTH = 10) prevents infinite recursion, which is a reasonable safeguard. However, explicit circular reference tracking with a WeakSet would be more robust and preserve more data in edge cases.
Example enhancement:
function hashSensitiveFields<T>( obj: T, depth = 0, seen = new WeakSet() ): T { const MAX_DEPTH = 10; if (depth > MAX_DEPTH) return obj; // ... null/undefined/array checks ... if (isPlainObject(obj)) { if (seen.has(obj)) return "[Circular]" as T; seen.add(obj); // ... rest of processing ... } return obj; }This is optional since circular references are uncommon in log data.
154-160: Optional: Consider additional email-related sensitive fields.The current set covers common cases, but email communications often include other fields that contain PII.
Consider adding:
const SENSITIVE_FIELD_NAMES = new Set([ "email", "from", "sender", "to", "userEmail", + "cc", + "bcc", + "replyTo", + "recipients", ]);This is optional depending on which email fields your application actually logs.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
apps/web/utils/hash.ts(1 hunks)apps/web/utils/logger.ts(3 hunks)
🚧 Files skipped from review as they are similar to previous changes (1)
- apps/web/utils/hash.ts
🧰 Additional context used
📓 Path-based instructions (8)
apps/web/**/*.{ts,tsx}
📄 CodeRabbit inference engine (apps/web/CLAUDE.md)
apps/web/**/*.{ts,tsx}: Use TypeScript with strict null checks
Path aliases: Use@/for imports from project root
Use proper error handling with try/catch blocks
Format code with Prettier
Leverage TypeScript inference for better DX
Files:
apps/web/utils/logger.ts
!{.cursor/rules/*.mdc}
📄 CodeRabbit inference engine (.cursor/rules/cursor-rules.mdc)
Never place rule files in the project root, in subdirectories outside .cursor/rules, or in any other location
Files:
apps/web/utils/logger.ts
**/*.ts
📄 CodeRabbit inference engine (.cursor/rules/form-handling.mdc)
**/*.ts: The same validation should be done in the server action too
Define validation schemas using Zod
Files:
apps/web/utils/logger.ts
**/*.{ts,tsx}
📄 CodeRabbit inference engine (.cursor/rules/logging.mdc)
**/*.{ts,tsx}: UsecreateScopedLoggerfor logging in backend TypeScript files
Typically add the logger initialization at the top of the file when usingcreateScopedLogger
Only use.with()on a logger instance within a specific function, not for a global loggerImport Prisma in the project using
import prisma from "@/utils/prisma";
**/*.{ts,tsx}: Don't use TypeScript enums.
Don't use TypeScript const enum.
Don't use the TypeScript directive @ts-ignore.
Don't use primitive type aliases or misleading types.
Don't use empty type parameters in type aliases and interfaces.
Don't use any or unknown as type constraints.
Don't use implicit any type on variable declarations.
Don't let variables evolve into any type through reassignments.
Don't use non-null assertions with the ! postfix operator.
Don't misuse the non-null assertion operator (!) in TypeScript files.
Don't use user-defined types.
Use as const instead of literal types and type annotations.
Use export type for types.
Use import type for types.
Don't declare empty interfaces.
Don't merge interfaces and classes unsafely.
Don't use overload signatures that aren't next to each other.
Use the namespace keyword instead of the module keyword to declare TypeScript namespaces.
Don't use TypeScript namespaces.
Don't export imported variables.
Don't add type annotations to variables, parameters, and class properties that are initialized with literal expressions.
Don't use parameter properties in class constructors.
Use either T[] or Array consistently.
Initialize each enum member value explicitly.
Make sure all enum members are literal values.
Files:
apps/web/utils/logger.ts
apps/web/utils/**
📄 CodeRabbit inference engine (.cursor/rules/project-structure.mdc)
Create utility functions in
utils/folder for reusable logic
Files:
apps/web/utils/logger.ts
apps/web/utils/**/*.ts
📄 CodeRabbit inference engine (.cursor/rules/project-structure.mdc)
apps/web/utils/**/*.ts: Use lodash utilities for common operations (arrays, objects, strings)
Import specific lodash functions to minimize bundle size
Files:
apps/web/utils/logger.ts
**/*.{js,jsx,ts,tsx}
📄 CodeRabbit inference engine (.cursor/rules/ultracite.mdc)
**/*.{js,jsx,ts,tsx}: Don't useelements in Next.js projects.
Don't use elements in Next.js projects.
Don't use namespace imports.
Don't access namespace imports dynamically.
Don't use global eval().
Don't use console.
Don't use debugger.
Don't use var.
Don't use with statements in non-strict contexts.
Don't use the arguments object.
Don't use consecutive spaces in regular expression literals.
Don't use the comma operator.
Don't use unnecessary boolean casts.
Don't use unnecessary callbacks with flatMap.
Use for...of statements instead of Array.forEach.
Don't create classes that only have static members (like a static namespace).
Don't use this and super in static contexts.
Don't use unnecessary catch clauses.
Don't use unnecessary constructors.
Don't use unnecessary continue statements.
Don't export empty modules that don't change anything.
Don't use unnecessary escape sequences in regular expression literals.
Don't use unnecessary labels.
Don't use unnecessary nested block statements.
Don't rename imports, exports, and destructured assignments to the same name.
Don't use unnecessary string or template literal concatenation.
Don't use String.raw in template literals when there are no escape sequences.
Don't use useless case statements in switch statements.
Don't use ternary operators when simpler alternatives exist.
Don't use useless this aliasing.
Don't initialize variables to undefined.
Don't use the void operators (they're not familiar).
Use arrow functions instead of function expressions.
Use Date.now() to get milliseconds since the Unix Epoch.
Use .flatMap() instead of map().flat() when possible.
Use literal property access instead of computed property access.
Don't use parseInt() or Number.parseInt() when binary, octal, or hexadecimal literals work.
Use concise optional chaining instead of chained logical expressions.
Use regular expression literals instead of the RegExp constructor when possible.
Don't use number literal object member names th...
Files:
apps/web/utils/logger.ts
!pages/_document.{js,jsx,ts,tsx}
📄 CodeRabbit inference engine (.cursor/rules/ultracite.mdc)
!pages/_document.{js,jsx,ts,tsx}: Don't import next/document outside of pages/_document.jsx in Next.js projects.
Don't import next/document outside of pages/_document.jsx in Next.js projects.
Files:
apps/web/utils/logger.ts
🧠 Learnings (13)
📚 Learning: 2025-09-17T22:05:28.646Z
Learnt from: CR
Repo: elie222/inbox-zero PR: 0
File: .cursor/rules/llm.mdc:0-0
Timestamp: 2025-09-17T22:05:28.646Z
Learning: Applies to apps/web/utils/ai/**/*.{ts,tsx} : Use descriptive scoped loggers for each feature
Applied to files:
apps/web/utils/logger.ts
📚 Learning: 2025-09-17T22:05:28.646Z
Learnt from: CR
Repo: elie222/inbox-zero PR: 0
File: .cursor/rules/llm.mdc:0-0
Timestamp: 2025-09-17T22:05:28.646Z
Learning: Applies to apps/web/utils/ai/**/*.{ts,tsx} : Log inputs and outputs with appropriate log levels and include relevant context
Applied to files:
apps/web/utils/logger.ts
📚 Learning: 2025-07-18T15:06:47.625Z
Learnt from: CR
Repo: elie222/inbox-zero PR: 0
File: .cursor/rules/logging.mdc:0-0
Timestamp: 2025-07-18T15:06:47.625Z
Learning: Applies to **/*.{ts,tsx} : Use `createScopedLogger` for logging in backend TypeScript files
Applied to files:
apps/web/utils/logger.ts
📚 Learning: 2025-09-17T22:05:28.646Z
Learnt from: CR
Repo: elie222/inbox-zero PR: 0
File: .cursor/rules/llm.mdc:0-0
Timestamp: 2025-09-17T22:05:28.646Z
Learning: Applies to apps/web/utils/{ai,llms}/**/*.{ts,tsx} : Keep related AI functions co-located and extract common patterns into utilities; document complex AI logic with clear comments
Applied to files:
apps/web/utils/logger.ts
📚 Learning: 2025-09-17T22:05:28.646Z
Learnt from: CR
Repo: elie222/inbox-zero PR: 0
File: .cursor/rules/llm.mdc:0-0
Timestamp: 2025-09-17T22:05:28.646Z
Learning: Applies to apps/web/utils/ai/**/*.{ts,tsx} : Use proper error types and logging for failures
Applied to files:
apps/web/utils/logger.ts
📚 Learning: 2025-09-17T22:05:28.646Z
Learnt from: CR
Repo: elie222/inbox-zero PR: 0
File: .cursor/rules/llm.mdc:0-0
Timestamp: 2025-09-17T22:05:28.646Z
Learning: Applies to apps/web/utils/ai/**/*.{ts,tsx} : Format prompt data consistently across similar functions
Applied to files:
apps/web/utils/logger.ts
📚 Learning: 2025-09-17T22:05:28.646Z
Learnt from: CR
Repo: elie222/inbox-zero PR: 0
File: .cursor/rules/llm.mdc:0-0
Timestamp: 2025-09-17T22:05:28.646Z
Learning: Applies to apps/web/utils/ai/**/*.{ts,tsx} : Make Zod schemas as specific as possible to guide LLM output
Applied to files:
apps/web/utils/logger.ts
📚 Learning: 2025-09-17T22:05:28.646Z
Learnt from: CR
Repo: elie222/inbox-zero PR: 0
File: .cursor/rules/llm.mdc:0-0
Timestamp: 2025-09-17T22:05:28.646Z
Learning: Applies to apps/web/utils/ai/**/*.{ts,tsx} : LLM feature functions should follow the provided TypeScript pattern (separate system/user prompts, use createGenerateObject, Zod schema validation, early validation, return result.object)
Applied to files:
apps/web/utils/logger.ts
📚 Learning: 2025-09-17T22:05:28.646Z
Learnt from: CR
Repo: elie222/inbox-zero PR: 0
File: .cursor/rules/llm.mdc:0-0
Timestamp: 2025-09-17T22:05:28.646Z
Learning: Applies to apps/web/utils/ai/**/*.{ts,tsx} : Implement fallbacks for AI failures
Applied to files:
apps/web/utils/logger.ts
📚 Learning: 2025-09-17T22:05:28.646Z
Learnt from: CR
Repo: elie222/inbox-zero PR: 0
File: .cursor/rules/llm.mdc:0-0
Timestamp: 2025-09-17T22:05:28.646Z
Learning: Applies to apps/web/utils/ai/**/*.{ts,tsx} : Remove excessive whitespace and truncate long inputs in prompts
Applied to files:
apps/web/utils/logger.ts
📚 Learning: 2025-09-17T22:05:28.646Z
Learnt from: CR
Repo: elie222/inbox-zero PR: 0
File: .cursor/rules/llm.mdc:0-0
Timestamp: 2025-09-17T22:05:28.646Z
Learning: Applies to apps/web/utils/ai/**/*.{ts,tsx} : Implement early returns for invalid inputs
Applied to files:
apps/web/utils/logger.ts
📚 Learning: 2025-07-18T15:06:47.625Z
Learnt from: CR
Repo: elie222/inbox-zero PR: 0
File: .cursor/rules/logging.mdc:0-0
Timestamp: 2025-07-18T15:06:47.625Z
Learning: Applies to **/*.{ts,tsx} : Typically add the logger initialization at the top of the file when using `createScopedLogger`
Applied to files:
apps/web/utils/logger.ts
📚 Learning: 2025-07-18T15:06:47.625Z
Learnt from: CR
Repo: elie222/inbox-zero PR: 0
File: .cursor/rules/logging.mdc:0-0
Timestamp: 2025-07-18T15:06:47.625Z
Learning: Applies to **/*.{ts,tsx} : Only use `.with()` on a logger instance within a specific function, not for a global logger
Applied to files:
apps/web/utils/logger.ts
🧬 Code graph analysis (1)
apps/web/utils/logger.ts (2)
apps/web/env.ts (1)
env(16-242)apps/web/utils/hash.ts (1)
hash(9-17)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: cubic · AI code reviewer
- GitHub Check: Jit Security
🔇 Additional comments (1)
apps/web/utils/logger.ts (1)
193-193: TheisPlainObjectcheck correctly addresses the past review concern.The guard on line 193 ensures that only plain objects (those with
Object.prototypeornullas their prototype) are recursively processed. Error and Date instances have their own prototypes (Error.prototype,Date.prototype), so they will be skipped and returned unchanged on line 223. This preserves error messages and date values in logs.Also applies to: 226-230
1 participant
Note
Adds PII-safe logging (hash/redact sensitive fields), includes provider in action context/logs, and replaces the privacy policy with a comprehensive version; bumps version.
utils/hash.tsand updatesutils/logger.tsto hash sensitive fields (e.g.,email,sender,to,userEmail) and redact tokens; applies hashing to console and Axiom logs.utils/actions/safe-action.ts, logproviderinstead of entireemailAccount; propagateproviderin action context; minor logger scoping tweak inapi/google/webhook/process-label-removed-event.ts.app/(landing)/privacy/content.mdxwith a full privacy policy covering data collection, processing roles, third-party AI usage, API compliance (Google/Microsoft), security, retention, international transfers, and user rights.version.txttov2.17.18.Written by Cursor Bugbot for commit 7a44a4c. Configure here.
Summary by CodeRabbit
Documentation
Chores