changes for the coming soon v2 - #90
Conversation
…and GitLab issue notes proxy endpoints Implementados endpoints /api/search (búsqueda multi-provider con soporte para topics), /api/trending/:provider (repos trending/new de GitHub/GitLab), y /api/gl-notes/:owner/:repo/:number (proxy de comentarios de issues de GitLab sin requerir token del usuario). Actualizado CSP para permitir conexiones a APIs externas y recursos CDN. Agregado middleware localhostCORS para desarrollo local. Eliminados archivos HTML estáticos obsoletos (approach.html, guidelines.html, karma.html),
|
Warning Review limit reached
Next review available in: 50 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (4)
📝 WalkthroughWalkthroughAdds GitLab issue notes proxy, repository search, and trending repository handlers to the HTTP layer, registers corresponding routes, introduces a localhost CORS middleware, broadens the Content Security Policy, updates static routing to serve repo.html, and removes three static HTML pages (approach, guidelines, karma). ChangesAPI endpoints and routing
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant Client
participant Router
participant SearchHandler
participant TrendingHandler
participant GitHubAPI
participant GitLabAPI
Client->>Router: GET /api/search?q=...
Router->>SearchHandler: route request
SearchHandler->>GitHubAPI: query search endpoint
SearchHandler->>GitLabAPI: query search endpoint
SearchHandler-->>Client: aggregated normalized results
Client->>Router: GET /api/trending/:provider
Router->>TrendingHandler: route request
TrendingHandler->>GitHubAPI: fetch trending repos
TrendingHandler->>GitLabAPI: fetch trending repos
TrendingHandler-->>Client: aggregated normalized results
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 6
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@internal/http/handlers.go`:
- Around line 2304-2308: The repository search in the URL-building logic is
using stale hardcoded created-date thresholds, so the “new” and “trending”
queries no longer reflect recency. Update the URL selection in the relevant
handler to compute the date cutoff dynamically at runtime instead of embedding
fixed dates. Use the existing sort branch in the search logic to derive relative
thresholds from the current time (for example, a longer window for trending and
a shorter one for new), and keep the rest of the GitHub search URL construction
unchanged.
- Line 2150: The repository search URL in the GitHub handler is built from a raw
query string, which can break multi-word searches and allow parameter injection.
Update the logic in the handler that constructs the GitHub search request to
URL-encode the user query with url.QueryEscape before interpolating it. Since
the local variable currently named url shadows the imported net/url package,
rename that variable (for example, apiURL) so the code can call url.QueryEscape
cleanly.
- Line 1197: The GitLab request in the handler still uses http.DefaultClient,
which can block indefinitely; update the request path in the relevant handler to
use a bounded http.Client with a timeout, matching the existing search/trending
helpers that already use a 10 second timeout. Locate the call site around the
GitLab fetch logic in the handler and swap the client used for Do(req) so the
request cannot hang goroutines under slow or stalled upstream responses.
- Around line 1181-1185: Validate the issue `number` before building the GitLab
API request in `internal/http/handlers.go`; unlike `owner` and `repo`, `number`
is currently interpolated raw into `apiURL`. Update the handler that reads
`c.Param("number")` to enforce a numeric-only value (reject anything else)
before `fmt.Sprintf` constructs the upstream URL, so `number` cannot alter the
query string.
In `@internal/http/router.go`:
- Line 43: The img-src policy in router.go is overly broad because the https:
scheme already allows images from any HTTPS origin, making the explicit host
entries redundant. Update the CSP string in the router setup to either keep
https: and remove the specific allowlist hosts, or remove https: and retain only
the intended hosts such as the amazonaws, s3, and cdn.simpleicons.org entries.
- Around line 17-26: The CORS middleware in SetupRouter is too permissive
because the Origin check uses strings.HasPrefix, which can reflect
attacker-controlled domains. Update the origin validation in the middleware near
the Origin header handling to parse the value and only allow exact
localhost/127.0.0.1 hosts with optional ports, ideally via a dedicated helper
such as isLocalhostOrigin. Also consider gating this CORS block behind a
dev-mode flag so it does not run unconditionally in production.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 381e43e6-d8dd-4c88-abeb-b59f894ea6b4
⛔ Files ignored due to path filters (1)
web/assets/logos/gitgost-logo.svgis excluded by!**/*.svg
📒 Files selected for processing (7)
internal/http/handlers.gointernal/http/router.goweb/approach.htmlweb/guidelines.htmlweb/index.htmlweb/karma.htmlweb/repo.html
💤 Files with no reviewable changes (3)
- web/karma.html
- web/approach.html
- web/guidelines.html
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 41f533ab19
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…d fix trending date filters Agregado banner de suspensión visible en index.html y repo.html que consulta /api/status para mostrar advertencia cuando panic_mode está activo. Implementada validación de dígitos en GitLabIssueNotesProxyHandler para prevenir inyección en número de issue. Añadido timeout de 10s en cliente HTTP de proxy GitLab. Mejorada validación de origen localhost en middleware CORS usando url.Parse en lugar de strings.HasPrefix
2 participants
Implementados endpoints /api/search (búsqueda multi-provider con soporte para topics), /api/trending/:provider (repos trending/new de GitHub/GitLab), y /api/gl-notes/:owner/:repo/:number (proxy de comentarios de issues de GitLab sin requerir token del usuario). Actualizado CSP para permitir conexiones a APIs externas y recursos CDN. Agregado middleware localhostCORS para desarrollo local. Eliminados archivos HTML estáticos obsoletos (approach.html, guidelines.html, karma.html),
Summary by CodeRabbit
New Features
Bug Fixes
Refactor