Compliance/l1 l15

[flvvius]

Summary by CodeRabbit

• New Features
  • Added AI-generated summary disclosures, source grounding, and per-sentence attribution on event pages.
  • Added an on-page form for reporting content errors.
  • Added publisher opt-out/takedown requests and crawler information pages.
  • Added profile controls to download personal data and delete accounts.
  • Added consent-aware waitlist signup and one-click unsubscribe links.
  • Added responsive event layouts and truncated third-party snippets.
• Bug Fixes
  • Improved privacy by preventing analytics identifiers from being stored without consent.
  • Added safeguards to hide unpublished content and restricted publisher images.
• Documentation
  • Expanded privacy, terms, contact, crawler, and image-policy information.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
news	Error		Jul 11, 2026 1:32pm
news-web	Ready	Preview, Comment	Jul 11, 2026 1:32pm

[coderabbitai]

Walkthrough

This PR adds CI validation, compliance controls for snippets, storage, consent, retention, crawler access, images, AI summaries, reports, publisher takedowns, GDPR actions, and unsubscribe flows. It also adds related backend schemas, web routes, admin interfaces, disclosures, documentation, migrations, and automated tests.

Changes

Web compliance surfaces

Layer / File(s)	Summary
Compliance-aware web components apps/web/src/components/..., apps/web/src/lib/...	Adds AI disclosure labels, grounded sentence rendering, third-party snippet truncation, consent provenance capture, cookieless analytics, and profile data export/account deletion controls.
Public and admin routes apps/web/src/routes/...	Adds publisher, crawler, report-review, publisher-review, unsubscribe-token, JSON-LD, privacy, and DSA contact flows.
Validation and documentation apps/web/e2e/*, docs/*, FOOTER_TODO.md, .github/workflows/ci.yml	Adds browser compliance checks, storage allowlists, event-page disclosure checks, policy documentation, and CI typecheck/test execution.

Backend policy and data workflows

Layer / File(s)	Summary
Policy contracts and persistence packages/backend/convex/schema.ts, packages/backend/convex/lib/*, packages/backend/convex/retention.ts	Adds schemas and shared policies for consent, retention, snippets, images, domain permissions, AI metadata, reports, publisher requests, and audit records.
Crawler and TDM enforcement packages/backend/convex/domainPermissions*, packages/backend/convex/ingestion.ts, packages/backend/convex/lib/{articleExtraction,politeFetch,tdmPolicy}.ts	Adds declared crawler identity, polite fetching, conditional RSS requests, TDM signal resolution, extraction gating, and image purging/filtering.
AI verification pipeline packages/backend/convex/summarization*.ts, packages/backend/convex/lib/{grounding,verbatimOverlap}.ts, packages/backend/convex/generationAudit.ts	Adds paraphrase prompts, overlap checks, sentence grounding, NER risk holds, append-only generation audits, and publication metadata enforcement.
Privacy, reports, and publisher operations packages/backend/convex/{waitlist,dataRights,reports,publisherRequests,emails}.ts	Adds consent records, token unsubscribe, send suppression, GDPR export/deletion, content reports, reporter notifications, and publisher opt-out/takedown decisions.

Estimated code review effort: 5 (Critical) | ~120 minutes

Possibly related PRs

• flvvius/news#2: Related waitlist and email-flow changes.
• flvvius/news#18: Related event grounding and summarization pipeline work.
• flvvius/news#24: Overlapping waitlist component changes.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 16.22% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check	❓ Inconclusive	The title is too vague and code-name-like to clearly describe the main change set.	Use a concise, descriptive title that states the primary change, such as adding compliance, consent, and AI disclosure enforcement.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch compliance/l1-l15

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 35

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (2)

packages/backend/convex/waitlist.ts (1)

28-46: 🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift

Do not treat a client-supplied IP address as consent provenance.

clientIp comes directly from the public mutation payload and is persisted without validation, so any caller can forge the audit record. Capture it through a trusted server boundary, or explicitly store it as client-reported metadata; also validate consentSourcePage as an allowed application path.

As per path instructions, “Focus on Convex best practices” and “Review database schema changes carefully.”

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/backend/convex/waitlist.ts` around lines 28 - 46, Update the
waitlist mutation handler around consentRecord so clientIp is not persisted as
trusted consent provenance: obtain the IP from a trusted server-side boundary,
or rename and store it explicitly as client-reported metadata. Validate
consentSourcePage against the application’s allowed paths before including it in
the record, while preserving the existing consent version, hash, and timestamp
fields.

Source: Path instructions

packages/backend/convex/summarization.ts (1)

890-955: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Require overlap and grounding on publish These fields are optional, but omitting either skips the gate entirely and still allows a summary to publish. Make the publish path fail closed when either check is missing, or move legacy compatibility to a separate path.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/backend/convex/summarization.ts` around lines 890 - 955, The publish
handler around the summary application logic must fail closed when overlapCheck
or grounding is absent, not only when a provided check fails. Require both
checks before allowing publication, returning the appropriate rejection result
for missing or failing validation; preserve any legacy compatibility through a
separate path rather than optional gates in this handler.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/ci.yml:
- Around line 22-26: Replace the floating major-version references in the
workflow steps using actions/checkout, pnpm/action-setup, and actions/setup-node
with their verified full commit SHA pins, retaining the existing action versions
and configuration. Ensure Dependabot recognizes and verifies the SHA-pinned
dependencies.
- Line 22: Update the actions/checkout@v4 step in the CI workflow to set
persist-credentials to false, ensuring subsequent pnpm install and vitest steps
cannot access persisted GITHUB_TOKEN credentials.

In `@apps/web/src/components/feed/report-error-form.tsx`:
- Around line 59-60: Update the success message in the report form’s sent-state
rendering and the error message near the corresponding error-state rendering to
include the required ARIA live-region attributes, including aria-live and role.
Preserve their existing text, styling, translation keys, and conditional
rendering.

In `@apps/web/src/components/profile/AuthenticatedProfile.tsx`:
- Around line 97-118: Separate the error handling in handleDeleteAccount so the
catch for deleteMyAccount only reports deletion failures and resets deletion
state. After a successful deletion, handle authClient.signOut independently
using the existing handleSignOut pattern, while preserving the finally redirect
to "/" and avoiding any "profile.deleteFailed" toast when sign-out alone fails.

In `@apps/web/src/lib/getClientIp.ts`:
- Around line 9-13: Stop using the browser-provided result of getClientIp for
persisted consent provenance, since x-forwarded-for and x-real-ip can be forged
by the client. Update the mutation or consent-recording flow that consumes
clientIp to obtain the address from trusted server-side request context, or omit
persistence and treat the value as advisory only; do not rely on
apps/web/src/lib/getClientIp.ts for authoritative data.

In `@apps/web/src/lib/snippet.ts`:
- Around line 18-22: Update the snippet truncation logic around the budget slice
in the snippet-generation function to avoid ending on a dangling high surrogate:
if the cutoff splits a surrogate pair, back up one UTF-16 unit before
determining the word boundary and appending ELLIPSIS. Add a regression test
covering Unicode input such as an emoji at the cutoff, while preserving existing
word-boundary and ellipsis behavior.

In `@apps/web/src/routes/admin.reports.tsx`:
- Around line 107-121: Update the reasons textarea in the report decision form
to include the native required constraint and a minimum length of 5 characters,
matching the existing handleDecision validation while preserving the current
value and onChange behavior.
- Around line 13-15: Add an admin authentication guard to the shared parent
route for the /admin/* tree, or to AdminReportsRoute via beforeLoad if no parent
exists, so unauthenticated users are rejected or redirected before the route
component and Convex query execute. Reuse the project’s existing auth-check and
redirect symbols rather than introducing a separate mechanism.

In `@apps/web/src/routes/admin.review.tsx`:
- Around line 142-148: Update the flagged-field rendering in the reduce call so
every sentence in flagged is processed, rather than stopping once the
accumulator becomes a ReactNode. Refactor or reuse highlightFlagged to apply all
flagged sentences in a single pass while preserving the existing highlighted
output for each match.

In `@apps/web/src/routes/event`.$slug.tsx:
- Around line 296-301: Update the JSON-LD serialization in the event route’s
script element to escape HTML-breaking characters, especially `<` (and
optionally `>` and `&`), in the JSON.stringify(jsonLd) result before assigning
it to dangerouslySetInnerHTML. Preserve the existing jsonLd structure and
application/ld+json behavior while ensuring embedded values cannot prematurely
close the script tag.
- Around line 360-392: Guard the image figure rendering in the event image block
behind a truthy imageArticle check. Keep deriving imageArticle from the matching
article or articles[0], but render the <figure>, link, image, and caption only
when an article exists so the anchor never receives an undefined canonicalUrl.

In `@apps/web/src/routes/publishers.tsx`:
- Around line 91-96: Update apps/web/src/routes/publishers.tsx lines 91-96 by
adding role="status" and aria-live="polite" to the success message paragraph.
Update lines 103-152 by adding aria-label values matching the visible labels to
the domain Input, contact Input, request-type select, and message textarea;
preserve the existing label associations.

In `@packages/backend/convex/authMaintenance.ts`:
- Around line 34-69: Update the user-deletion mutation around deleteByUserIndex
and the quizAttempts cleanup to process records in bounded batches rather than
collecting and deleting entire tables in one transaction. Paginate each table’s
by_user/by_user_quiz query, delete one batch, and continue until no records
remain; only delete the user record after every table, including quizAttempts,
has been fully processed.

In `@packages/backend/convex/dataRights.ts`:
- Around line 50-74: The GDPR export flow containing the interactions,
userInsights, quizAttempts, and briefingSends queries must return every matching
row instead of silently applying EXPORT_ROW_CAP. Replace the capped
single-response approach with a paginated, multipart, or asynchronous archive
mechanism that fully exports these datasets and provides continuation or
completion handling.

In `@packages/backend/convex/domainPermissions.ts`:
- Around line 72-99: Normalize args.domain once at the start of each
domain-permission operation, including the paths at the referenced ranges, using
the established canonical domain utility. Use the normalized value consistently
for by_domain queries, stored row.domain values, logs, and scheduled purge
operations so equivalent inputs share one record. Preserve the schema shape and
existing permission state behavior while applying canonicalization to every read
and write.
- Around line 184-199: Update the purge condition in the domain-permission flow
to also trigger when article.entities contains extracted data, and extend the
corresponding ctx.db.patch for that article to clear entities. Preserve the
existing cleanup behavior for summary, atomicFacts, image fields, and
extractionQuality.

In `@packages/backend/convex/domainPermissionsNode.ts`:
- Around line 25-38: Update fetchWithTimeout and its redirect handling to
prevent SSRF: resolve each target hostname, reject loopback, private,
link-local, reserved, and otherwise non-public IPs, disable automatic redirects,
and manually follow each Location response only after applying the same
validation to the next URL. Preserve the existing timeout and request headers
while enforcing validation on the initial URL and every redirect hop.
- Around line 162-176: Update the domain-resolution loop over toResolve to run
resolveDomainPermission calls with a small bounded concurrency limit instead of
awaiting each domain sequentially. Preserve per-domain result.set behavior,
including the existing rss_only fallback and warning when a resolution fails.
Ensure all scheduled resolutions complete before returning the aggregate result.

In `@packages/backend/convex/enrichmentNode.ts`:
- Around line 807-842: Update the enrichment flow around ensureDomainPermissions
and extractArticleContentForEmbedding so authorization is performed for the
final host actually fetched, not only article.canonicalUrl. Resolve each
article’s destination URL, obtain permission for every resulting host including
redirect destinations, and allow full extraction only when the fetched host is
permitted; otherwise use rssOnlyArticleContent. Preserve the existing RSS-only
behavior and ensure no response body is read or processed before destination
authorization succeeds.

In `@packages/backend/convex/ingestion.ts`:
- Around line 1342-1384: Remove the outer botFetchHeaders wrapper from the
politeFetch call in the ingestion flow, passing the Accept, Accept-Language, and
conditional request headers directly through the headers option. Keep
politeFetch responsible for applying the standard bot headers and preserve the
existing conditional-header behavior.

In `@packages/backend/convex/lib/imagePolicy.ts`:
- Around line 46-64: Update the image policy function containing the hostname
lookup to accept the article/source publisher domain and evaluate its domain
permission first, returning the same denied result for disabled or non-full
publisher states. Only if the publisher has no blocking permission should the
existing image-host lookup run, preserving current CDN-host behavior for
otherwise allowed publishers.
- Around line 38-43: Update the killSwitch parsing logic in the image-policy
function so malformed JSON returns false immediately instead of continuing to
per-domain checks. In the catch block, emit an operational error alert using the
existing logging or alerting mechanism, while preserving the current false
result when the parsed value is explicitly false.

In `@packages/backend/convex/lib/publicEventPreviews.ts`:
- Around line 249-252: Remove the true fallback that treats missing provenance
as AI-generated: in packages/backend/convex/events.ts lines 469-475, expose
explicit event provenance; in packages/backend/convex/lib/publicEventPreviews.ts
lines 249-252, derive or backfill the accurate provenance when persisting
previews; and in packages/backend/convex/lib/feedSerialization.ts lines 116-118,
serialize the persisted value without inventing AI provenance.

In `@packages/backend/convex/lib/tdmPolicy.ts`:
- Around line 161-173: The declaresNoAi parser currently requires the robots
meta tag’s name attribute to precede content; parse the attributes independently
so either order is accepted while preserving case-insensitive noai detection.
Add a reversed-attribute regression case in
packages/backend/convex/tdmPermissions.test.ts at lines 101-109 covering a meta
tag with content before name.
- Around line 88-112: Update robotsGroupFor() to merge all matching exact-agent
or wildcard groups into one RobotsGroup before robotsDisallowsAll() evaluates
disallow and allow rules, so later Allow entries are preserved; retain
exact-agent precedence over wildcard groups. Add regressions in
packages/backend/convex/tdmPermissions.test.ts covering duplicate-agent groups
and Disallow: / combined with a path-specific Allow.

In `@packages/backend/convex/publisherRequests.ts`:
- Around line 61-67: Update the pipelineAlerts insert in the publisher request
handler to remove contact from details; store only requestId, domain, and
requestType, preserving the existing alert severity, code, message, and
timestamp.
- Around line 39-50: Update the rate-limiting flow around enforceRateLimit so
anonymous requests must first pass an abuse control tied to a trusted requester
signal, such as verified IP/session or CAPTCHA, before consuming publisher
quotas. Preserve the existing domain limit as a secondary guard and retain the
global limit, ensuring untrusted callers cannot exhaust either quota.

In `@packages/backend/convex/reports.ts`:
- Around line 59-68: Update the rate limiting in the report handler around the
existing enforceRateLimit calls to key the primary limit by the individual
client or reporter rather than eventId, so one client cannot block reporting for
others. Retain contentReport:all only as a secondary global ceiling, and
preserve the existing limits and time window unless necessary for the per-client
key.
- Around line 177-225: Update the correction flow in the decision handler around
appendGenerationAudit and the nextStatus assignment so a correction remains
pending until summary regeneration and publication succeed. Do not set corrected
or schedule the outcome email immediately after enqueueing eventSummaryJobs;
instead, transition the report and notify the reporter from the successful
publication path, and unpublish the existing content while regeneration is
pending if supported by the existing status model.

In `@packages/backend/convex/sitemap.ts`:
- Around line 85-102: Give sources an independent reserved budget in the sitemap
query flow: define a fixed RESERVED_SOURCE_SLOTS value, cap the events query in
this block at limit minus that reservation, and fetch sources using the reserved
amount rather than events.length-based sourceLimit. Preserve non-negative limits
and ensure source pages remain included as events grow.

In `@packages/backend/convex/summarization.ts`:
- Around line 1290-1310: Update the review approval flow containing
appendGenerationAudit for action "review_approved" to include sourceArticles
derived from the associated review event, matching the published audit entry’s
provenance data. Reuse the existing event/source derivation mechanism and
preserve the current approval summary and metadata fields.

In `@packages/backend/convex/summarizationNode.ts`:
- Around line 866-888: The verifySummaryGrounding field-stripping logic must
restore fallback text when any non-neutral field becomes empty. In
verifySummaryGrounding, after filtering supported sentences, replace empty
reformist, suveranist, or globalImpact values with their corresponding original
field text before returning publish, while preserving the existing neutral
blocking behavior.

In `@packages/backend/convex/tdmPermissions.test.ts`:
- Around line 101-109: Add a regression assertion in the “noai meta and
X-Robots-Tag are detected” test for declaresNoAi, using a robots meta tag with
content before name and expecting true. Keep the existing detection and
negative-case assertions unchanged.
- Around line 64-93: Add regression coverage in the robots.txt tests around
evaluateTdmSignals, robotsDisallowsAll, and robotsCrawlDelay for duplicate
BiviantBot groups, ensuring a later BiviantBot Disallow: / is honored, and for
partial Allow rules, ensuring Disallow: / with Allow: /public still treats the
bot as restricted. Preserve the existing assertions for wildcard and
AI-convention tokens.

In `@packages/backend/convex/waitlist.ts`:
- Line 176: Update the waitlist unsubscribe flow around the return object in the
relevant mutation/function so token holders receive only the success status, or
a masked email rather than record.email. Adjust the route’s success message to
match the new response shape and remove any dependency on the full email field.

---

Outside diff comments:
In `@packages/backend/convex/summarization.ts`:
- Around line 890-955: The publish handler around the summary application logic
must fail closed when overlapCheck or grounding is absent, not only when a
provided check fails. Require both checks before allowing publication, returning
the appropriate rejection result for missing or failing validation; preserve any
legacy compatibility through a separate path rather than optional gates in this
handler.

In `@packages/backend/convex/waitlist.ts`:
- Around line 28-46: Update the waitlist mutation handler around consentRecord
so clientIp is not persisted as trusted consent provenance: obtain the IP from a
trusted server-side boundary, or rename and store it explicitly as
client-reported metadata. Validate consentSourcePage against the application’s
allowed paths before including it in the record, while preserving the existing
consent version, hash, and timestamp fields.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: b97cf98f-c19b-4a0f-9ad1-204ac8593064

📥 Commits

Reviewing files that changed from the base of the PR and between 832e91c and cea127b.

⛔ Files ignored due to path filters (2)

• apps/web/src/routeTree.gen.ts is excluded by !**/routeTree.gen.ts
• packages/backend/convex/_generated/api.d.ts is excluded by !**/_generated/**, !**/_generated/**

📒 Files selected for processing (93)

• .github/workflows/ci.yml
• FOOTER_TODO.md
• apps/web/e2e/compliance-event-page.spec.ts
• apps/web/e2e/consent-free-storage.spec.ts
• apps/web/src/components/early-access-apply-card.tsx
• apps/web/src/components/feed/ai-disclosure-label.test.tsx
• apps/web/src/components/feed/ai-disclosure-label.tsx
• apps/web/src/components/feed/articles-list.tsx
• apps/web/src/components/feed/event-card.test.tsx
• apps/web/src/components/feed/event-detail-tabs.tsx
• apps/web/src/components/feed/report-error-form.tsx
• apps/web/src/components/layout/Footer.tsx
• apps/web/src/components/layout/StaticPage.tsx
• apps/web/src/components/profile/AuthenticatedProfile.tsx
• apps/web/src/components/ui/snippet.test.tsx
• apps/web/src/components/ui/snippet.tsx
• apps/web/src/lib/getClientIp.ts
• apps/web/src/lib/posthog.tsx
• apps/web/src/lib/snippet.ts
• apps/web/src/routes/admin.publishers.tsx
• apps/web/src/routes/admin.reports.tsx
• apps/web/src/routes/admin.review.tsx
• apps/web/src/routes/bot.tsx
• apps/web/src/routes/contact.tsx
• apps/web/src/routes/cum-functioneaza.tsx
• apps/web/src/routes/despre.tsx
• apps/web/src/routes/event.$slug.tsx
• apps/web/src/routes/footer-pages.test.tsx
• apps/web/src/routes/politica-confidentialitate.tsx
• apps/web/src/routes/publishers.tsx
• apps/web/src/routes/source.$sourceId.tsx
• apps/web/src/routes/termeni.tsx
• apps/web/src/routes/unsubscribe.tsx
• docs/bias-axis-spec.md
• docs/compliance-image-policy.md
• docs/compliance-storage-inventory.md
• docs/compliance-third-party-text-audit.md
• packages/backend/convex/authMaintenance.ts
• packages/backend/convex/clustering.ts
• packages/backend/convex/compliance.test.ts
• packages/backend/convex/config.ts
• packages/backend/convex/consentHygiene.test.ts
• packages/backend/convex/crons.ts
• packages/backend/convex/dataRights.ts
• packages/backend/convex/domainPermissions.ts
• packages/backend/convex/domainPermissionsNode.ts
• packages/backend/convex/emails.ts
• packages/backend/convex/enrichment.ts
• packages/backend/convex/enrichmentNode.ts
• packages/backend/convex/events.ts
• packages/backend/convex/feeds.test.ts
• packages/backend/convex/feeds.ts
• packages/backend/convex/gdprCascade.test.ts
• packages/backend/convex/generationAudit.test.ts
• packages/backend/convex/generationAudit.ts
• packages/backend/convex/groundingGate.test.ts
• packages/backend/convex/imagePolicy.test.ts
• packages/backend/convex/ingestion.ts
• packages/backend/convex/lib/articleExtraction.ts
• packages/backend/convex/lib/botIdentity.ts
• packages/backend/convex/lib/compliance.ts
• packages/backend/convex/lib/consent.ts
• packages/backend/convex/lib/feedSerialization.ts
• packages/backend/convex/lib/grounding.ts
• packages/backend/convex/lib/imagePolicy.ts
• packages/backend/convex/lib/imageVerification.ts
• packages/backend/convex/lib/politeFetch.ts
• packages/backend/convex/lib/publicEventPreviews.ts
• packages/backend/convex/lib/retentionPolicy.ts
• packages/backend/convex/lib/tdmPolicy.ts
• packages/backend/convex/lib/verbatimOverlap.ts
• packages/backend/convex/migrations.ts
• packages/backend/convex/politeFetch.test.ts
• packages/backend/convex/prompts.ts
• packages/backend/convex/publisherRequests.test.ts
• packages/backend/convex/publisherRequests.ts
• packages/backend/convex/reports.test.ts
• packages/backend/convex/reports.ts
• packages/backend/convex/retention.test.ts
• packages/backend/convex/retention.ts
• packages/backend/convex/schema.ts
• packages/backend/convex/shareAssetsNode.ts
• packages/backend/convex/sitemap.ts
• packages/backend/convex/snippetEnforcement.test.ts
• packages/backend/convex/sourceReputation.ts
• packages/backend/convex/summarization.ts
• packages/backend/convex/summarizationNode.ts
• packages/backend/convex/summarizationPublishGate.test.ts
• packages/backend/convex/tdmPermissions.test.ts
• packages/backend/convex/verbatimOverlap.test.ts
• packages/backend/convex/waitlist.ts
• packages/backend/package.json
• packages/i18n/src/strings.ts

💤 Files with no reviewable changes (3)

• apps/web/src/routes/despre.tsx
• packages/backend/convex/sourceReputation.ts
• packages/backend/convex/feeds.ts

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Set persist-credentials: false on the checkout action.

By default actions/checkout@v4 persists the GITHUB_TOKEN in .git/config. Subsequent steps run pnpm install (which executes package install scripts) and vitest — both are untrusted-code paths that could exfiltrate the token.

🔒 Proposed fix

       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	- uses: actions/checkout@v4
	- uses: actions/checkout@v4
	with:
	persist-credentials: false

🧰 Tools

🪛 zizmor (1.26.1)

[warning] 22-22: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

---

[error] 22-22: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml at line 22, Update the actions/checkout@v4 step in
the CI workflow to set persist-credentials to false, ensuring subsequent pnpm
install and vitest steps cannot access persisted GITHUB_TOKEN credentials.

Source: Linters/SAST tools

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Pin actions to SHA hashes instead of floating version tags.

All three actions (actions/checkout@v4, pnpm/action-setup@v4, actions/setup-node@v4) are pinned to major-version tags. If any action repository is compromised, a malicious update can be pushed under the same tag. Pin to a commit SHA and verify in dependabot.

🔒 Example pinning

-      - uses: actions/checkout@v4
+      - uses: actions/checkout@<commit-sha> # v4
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@<commit-sha> # v4
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@<commit-sha> # v4

🧰 Tools

🪛 zizmor (1.26.1)

[warning] 22-22: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

---

[error] 22-22: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

---

[error] 24-24: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

---

[error] 26-26: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 22 - 26, Replace the floating
major-version references in the workflow steps using actions/checkout,
pnpm/action-setup, and actions/setup-node with their verified full commit SHA
pins, retaining the existing action versions and configuration. Ensure
Dependabot recognizes and verifies the SHA-pinned dependencies.

Source: Linters/SAST tools

[coderabbitai]

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Add aria-live and role to status messages per coding guidelines.

The success message (line 60) and error message (line 126) are status messages that lack aria-live and role attributes. Screen reader users won't be notified when these appear. As per coding guidelines, forms must have ARIA live regions on status messages.

♿ Proposed fix for ARIA live regions

       {state === "sent" ? (
-        <p className="text-sm text-muted-foreground">{t("report.sent")}</p>
+        <p role="status" aria-live="polite" className="text-sm text-muted-foreground">
+          {t("report.sent")}
+        </p>
       ) : (

             {state === "error" && (
-              <p className="text-sm text-destructive">{t("report.error")}</p>
+              <p role="alert" aria-live="assertive" className="text-sm text-destructive">
+                {t("report.error")}
+              </p>
             )}

Also applies to: 125-127

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@apps/web/src/components/feed/report-error-form.tsx` around lines 59 - 60,
Update the success message in the report form’s sent-state rendering and the
error message near the corresponding error-state rendering to include the
required ARIA live-region attributes, including aria-live and role. Preserve
their existing text, styling, translation keys, and conditional rendering.

Source: Coding guidelines

[coderabbitai]

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Misleading "delete failed" toast when signOut throws after successful deletion.

deleteMyAccount and authClient.signOut share the same try/catch. If the mutation succeeds but signOut throws, the catch block fires toast.error(t("profile.deleteFailed")) even though the account was already deleted. For GDPR self-service, the user must receive accurate feedback about whether their data was erased — a false "failed" toast could prompt a retry that fails with "Not authenticated," causing confusion.

The existing handleSignOut (lines 120–133) already demonstrates the correct pattern: handle signOut errors independently. Apply the same separation here.

🔧 Proposed fix: separate deletion and signOut error handling

   const handleDeleteAccount = async () => {
     if (!deleteArmed) {
       setDeleteArmed(true);
       toast.warning(t("profile.deleteConfirm"));
       return;
     }
     setIsDeleting(true);
     try {
-      await deleteMyAccount({});
-      toast.success(t("profile.deleteDone"));
-      try {
-        await authClient.signOut({});
-      } finally {
-        location.href = "/";
-      }
+      await deleteMyAccount({});
+    } catch (error) {
+      console.error("Account deletion failed:", error);
+      toast.error(t("profile.deleteFailed"));
+      setIsDeleting(false);
+      setDeleteArmed(false);
+      return;
+    }
+    toast.success(t("profile.deleteDone"));
+    try {
+      await authClient.signOut({});
     } catch (error) {
-      console.error("Account deletion failed:", error);
-      toast.error(t("profile.deleteFailed"));
-      setIsDeleting(false);
-      setDeleteArmed(false);
+      console.error("Sign-out failed after deletion:", error);
+    } finally {
+      location.href = "/";
     }
   };

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	const handleDeleteAccount = async () => {
	if (!deleteArmed) {
	setDeleteArmed(true);
	toast.warning(t("profile.deleteConfirm"));
	return;
	}
	setIsDeleting(true);
	try {
	await deleteMyAccount({});
	toast.success(t("profile.deleteDone"));
	try {
	await authClient.signOut({});
	} finally {
	location.href = "/";
	}
	} catch (error) {
	console.error("Account deletion failed:", error);
	toast.error(t("profile.deleteFailed"));
	setIsDeleting(false);
	setDeleteArmed(false);
	}
	};
	const handleDeleteAccount = async () => {
	if (!deleteArmed) {
	setDeleteArmed(true);
	toast.warning(t("profile.deleteConfirm"));
	return;
	}
	setIsDeleting(true);
	try {
	await deleteMyAccount({});
	} catch (error) {
	console.error("Account deletion failed:", error);
	toast.error(t("profile.deleteFailed"));
	setIsDeleting(false);
	setDeleteArmed(false);
	return;
	}
	toast.success(t("profile.deleteDone"));
	try {
	await authClient.signOut({});
	} catch (error) {
	console.error("Sign-out failed after deletion:", error);
	} finally {
	location.href = "/";
	}
	};

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@apps/web/src/components/profile/AuthenticatedProfile.tsx` around lines 97 -
118, Separate the error handling in handleDeleteAccount so the catch for
deleteMyAccount only reports deletion failures and resets deletion state. After
a successful deletion, handle authClient.signOut independently using the
existing handleSignOut pattern, while preserving the finally redirect to "/" and
avoiding any "profile.deleteFailed" toast when sign-out alone fails.

[coderabbitai]

🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Trace how getClientIp's return value flows into the waitlist mutation.

# Check the early-access-apply-card for how the IP is used
ast-grep outline apps/web/src/components/early-access-apply-card.tsx --items all --match 'getClientIp|waitlist'

# Search for where the IP is passed to the mutation
rg -n -C5 'getClientIp|clientIp|requesterIp' apps/web/src/components/early-access-apply-card.tsx

# Check the backend waitlist mutation for how the IP is stored/validated
rg -n -C5 'clientIp|requesterIp|ip' packages/backend/convex/waitlist.ts

Repository: flvvius/news

Length of output: 2748

---

Don't persist clientIp from the browser
clientIp is user-controlled by the time it reaches the mutation, so this consent record can be forged. If the IP matters for provenance, capture it server-side from the request context; otherwise treat it as advisory only.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@apps/web/src/lib/getClientIp.ts` around lines 9 - 13, Stop using the
browser-provided result of getClientIp for persisted consent provenance, since
x-forwarded-for and x-real-ip can be forged by the client. Update the mutation
or consent-recording flow that consumes clientIp to obtain the address from
trusted server-side request context, or omit persistence and treat the value as
advisory only; do not rely on apps/web/src/lib/getClientIp.ts for authoritative
data.

[coderabbitai]

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Admin-approved corrections lose source provenance in the audit trail.

The published audit entry (Line 1033) includes sourceArticles: auditSources, but the review_approved audit entry appended here has no sourceArticles field at all. Since the module's stated goal is that "a single query reconstructs the chain: sources → checks → publication → corrections," human-reviewed/edited summaries silently lose the source-provenance portion of that chain.

🛡️ Proposed fix: derive source articles from the event before approving

+    const approvedArticles = await ctx.db
+      .query("articles")
+      .withIndex("by_event", (q) => q.eq("eventId", review.eventId))
+      .collect();
     await appendGenerationAudit(ctx, {
       eventId: review.eventId,
       jobId: review.jobId,
       runId: review.runId,
       action: "review_approved",
       model: review.proposed.modelUsed,
       promptVersion: String(SUMMARY_PROMPT_VERSION),
       summary: {
         neutral,
         reformist,
         suveranist,
         globalImpact,
         perspectiveApplicable: applicable,
       },
+      sourceArticles: approvedArticles.map((article) => ({
+        articleId: article._id,
+        canonicalUrl: article.canonicalUrl,
+      })),
       reviewOutcome: `approved by ${decidedByEmail ?? "admin"}${editedFields ? " (edited)" : ""}`,
       disclosureLabelVersion: "v1",
       publishedAt: Date.now(),
       note,
     });

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	// L7: the approval (possibly edited = a correction of the proposal) is a
	// new audit version superseding the held_for_review record.
	await appendGenerationAudit(ctx, {
	eventId: review.eventId,
	jobId: review.jobId,
	runId: review.runId,
	action: "review_approved",
	model: review.proposed.modelUsed,
	promptVersion: String(SUMMARY_PROMPT_VERSION),
	summary: {
	neutral,
	reformist,
	suveranist,
	globalImpact,
	perspectiveApplicable: applicable,
	},
	reviewOutcome: `approved by ${decidedByEmail ?? "admin"}${editedFields ? " (edited)" : ""}`,
	disclosureLabelVersion: "v1",
	publishedAt: Date.now(),
	note,
	});
	// L7: the approval (possibly edited = a correction of the proposal) is a
	// new audit version superseding the held_for_review record.
	const approvedArticles = await ctx.db
	.query("articles")
	.withIndex("by_event", (q) => q.eq("eventId", review.eventId))
	.collect();
	await appendGenerationAudit(ctx, {
	eventId: review.eventId,
	jobId: review.jobId,
	runId: review.runId,
	action: "review_approved",
	model: review.proposed.modelUsed,
	promptVersion: String(SUMMARY_PROMPT_VERSION),
	summary: {
	neutral,
	reformist,
	suveranist,
	globalImpact,
	perspectiveApplicable: applicable,
	},
	sourceArticles: approvedArticles.map((article) => ({
	articleId: article._id,
	canonicalUrl: article.canonicalUrl,
	})),
	reviewOutcome: `approved by ${decidedByEmail ?? "admin"}${editedFields ? " (edited)" : ""}`,
	disclosureLabelVersion: "v1",
	publishedAt: Date.now(),
	note,
	});

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/backend/convex/summarization.ts` around lines 1290 - 1310, Update
the review approval flow containing appendGenerationAudit for action
"review_approved" to include sourceArticles derived from the associated review
event, matching the published audit entry’s provenance data. Reuse the existing
event/source derivation mechanism and preserve the current approval summary and
metadata fields.

[coderabbitai]

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
rg -n 'GLOBAL_IMPACT_FALLBACK|LIMITED_COVERAGE_FALLBACK|SIDE_COVERAGE_FALLBACK' packages/backend/convex/prompts.ts

Repository: flvvius/news

Length of output: 513

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Inspect the grounding function and nearby logic.
wc -l packages/backend/convex/summarizationNode.ts
sed -n '820,910p' packages/backend/convex/summarizationNode.ts

# Inspect the fallback definitions in prompts.ts for exact behavior.
wc -l packages/backend/convex/prompts.ts
sed -n '110,170p' packages/backend/convex/prompts.ts

# Find where the published fields are later normalized or consumed.
rg -n 'perspectiveApplicable|globalImpact|reformist|suveranist|SummaryFields|grounding:|action: "publish"|action: "blocked"' packages/backend/convex -g '!**/dist/**'

Repository: flvvius/news

Length of output: 44790

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Inspect the grounding helper used by the summarization pipeline.
wc -l packages/backend/convex/lib/grounding.ts
sed -n '1,180p' packages/backend/convex/lib/grounding.ts

# Inspect the CASE D / completeness logic in the summary pipeline.
sed -n '60,110p' packages/backend/convex/summarization.ts

# Inspect the publish path that persists the final summary fields.
sed -n '960,1040p' packages/backend/convex/summarization.ts

Repository: flvvius/news

Length of output: 9969

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Inspect tests around publish-gate handling of blank / partial summaries.
sed -n '1,260p' packages/backend/convex/summarizationPublishGate.test.ts

# Inspect the grounding-gate tests that exercise stripped fields.
sed -n '1,360p' packages/backend/convex/groundingGate.test.ts

Repository: flvvius/news

Length of output: 18612

---

packages/backend/convex/summarizationNode.ts:866-888 — Grounding-stripped fields need fallback text before publish

verifySummaryGrounding only blocks when neutral becomes empty. If stripping empties reformist, suveranist, or globalImpact, the event can still publish with blank fields, which leaves the summary incomplete and eligible for re-summarization. Restore the existing fallback text for any emptied field before returning publish.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/backend/convex/summarizationNode.ts` around lines 866 - 888, The
verifySummaryGrounding field-stripping logic must restore fallback text when any
non-neutral field becomes empty. In verifySummaryGrounding, after filtering
supported sentences, replace empty reformist, suveranist, or globalImpact values
with their corresponding original field text before returning publish, while
preserving the existing neutral blocking behavior.

[coderabbitai]

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo '--- tdmPermissions.test.ts (relevant excerpt) ---'
sed -n '1,220p' packages/backend/convex/tdmPermissions.test.ts

echo
echo '--- tdmPolicy.ts outline ---'
ast-grep outline packages/backend/convex/lib/tdmPolicy.ts --view expanded || true

echo
echo '--- tdmPolicy.ts relevant excerpt ---'
sed -n '1,260p' packages/backend/convex/lib/tdmPolicy.ts

Repository: flvvius/news

Length of output: 17157

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo '--- locate related tests and symbols ---'
rg -n "robotsDisallowsAll|robotsCrawlDelay|evaluateTdmSignals|Allow: /public|BiviantBot|GPTBot|merged groups|partial" packages/backend/convex -g '!**/node_modules/**'

echo
echo '--- list files near tdm policy ---'
fd -a "tdmPolicy.ts|tdmPermissions.test.ts|tdm" packages/backend/convex || true

Repository: flvvius/news

Length of output: 3839

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo '--- test file with line numbers ---'
nl -ba packages/backend/convex/tdmPermissions.test.ts | sed -n '1,180p'

echo
echo '--- tdm policy file with line numbers ---'
nl -ba packages/backend/convex/lib/tdmPolicy.ts | sed -n '1,260p'

Repository: flvvius/news

Length of output: 226

---

Add regressions for duplicate BiviantBot groups and partial Allow rules. A second BiviantBot group with Disallow: /, plus Disallow: / with Allow: /public, would catch first-match and overbroad-allow parsers that this file still misses.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/backend/convex/tdmPermissions.test.ts` around lines 64 - 93, Add
regression coverage in the robots.txt tests around evaluateTdmSignals,
robotsDisallowsAll, and robotsCrawlDelay for duplicate BiviantBot groups,
ensuring a later BiviantBot Disallow: / is honored, and for partial Allow rules,
ensuring Disallow: / with Allow: /public still treats the bot as restricted.
Preserve the existing assertions for wildcard and AI-convention tokens.

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Add a reversed-attribute noai regression.

Assert that <meta content="index, noai" name="robots"> is detected so valid attribute ordering cannot bypass the policy.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/backend/convex/tdmPermissions.test.ts` around lines 101 - 109, Add a
regression assertion in the “noai meta and X-Robots-Tag are detected” test for
declaresNoAi, using a robots meta tag with content before name and expecting
true. Keep the existing detection and negative-case assertions unchanged.

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Do not return the subscriber’s full email to a token bearer.

A leaked unsubscribe token currently allows retrieval of the associated email address. Return only success, or a masked address, and update the route’s success message accordingly.

Proposed response change

-    return { success: true as const, email: record.email };
+    return { success: true as const };

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	return { success: true as const, email: record.email };
	return { success: true as const };

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/backend/convex/waitlist.ts` at line 176, Update the waitlist
unsubscribe flow around the return object in the relevant mutation/function so
token holders receive only the success status, or a masked email rather than
record.email. Adjust the route’s success message to match the new response shape
and remove any dependency on the full email field.