fix: remove insecure text session id fallback

[11suixing11]

Why

CodeQL alert #1 reports the Math.random() fallback used for new text element IDs as insecure randomness. These IDs are persisted with the board, so remove the weak random fallback instead of dismissing the alert.

What

• keep crypto.randomUUID() as the preferred ID source
• use crypto.getRandomValues() when UUID generation is unavailable
• use a timestamp plus process-local monotonic counter only when Web Crypto is unavailable
• cover all three runtime paths with focused tests

Verification

• npm run check (111 files, 1011 tests)
• npm audit --audit-level=high (0 vulnerabilities)
• npm audit --omit=dev --audit-level=high (0 vulnerabilities)
• git diff --check

Risk

Low. The ID format remains opaque and preserves the existing text- prefix. Existing persisted IDs are unchanged.

Summary by CodeRabbit

• Bug Fixes

  • Improved text editor session ID generation for environments with limited or unavailable Web Crypto support.
  • Session IDs now remain unique and predictable across fallback scenarios.

• Tests

  • Added coverage for secure UUID generation, random-value fallback behavior, and unavailable Web Crypto environments.
  • Improved test cleanup to prevent mock and global state from affecting subsequent tests.

[coderabbitai]

Warning

Review limit reached

Next included review available in 56 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: fdd06ac1-c5a6-4859-bd27-c89273e45d97

📥 Commits

Reviewing files that changed from the base of the PR and between 543b3e2 and 4eca932.

📒 Files selected for processing (2)

• src/components/canvas/useTextEditor.test.ts
• src/components/canvas/useTextEditor.ts

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: e8e3fb51-b44a-4c61-ab55-82391f1e5ded

📥 Commits

Reviewing files that changed from the base of the PR and between ba4ebbe and 543b3e2.

📒 Files selected for processing (2)

• src/components/canvas/useTextEditor.test.ts
• src/components/canvas/useTextEditor.ts

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

createSessionId now uses Web Crypto when available and a timestamp-counter fallback otherwise. The helper is exported. Tests cover all generation branches and reset mocks and global stubs after each test.

Changes

Session ID generation

Layer / File(s)	Summary
Implement session ID generation src/components/canvas/useTextEditor.ts	createSessionId is exported. It uses crypto.randomUUID(), then crypto.getRandomValues(), then a timestamp and incrementing counter.
Validate ID generation src/components/canvas/useTextEditor.test.ts	Tests cover all ID-generation branches. An afterEach hook restores mocks and unstubs globals.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 543b3

This localized change replaces insecure text-element ID fallback behavior while preserving the existing prefix and persisted IDs; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the removal of the insecure Math.random() text session ID fallback.
Docstring Coverage	✅ Passed	Docstring check was indeterminate for this PR — some files could not be analyzed in time. Not blocking.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-codeql-session-id

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔦 Lighthouse CI Results

Category	Score
Performance	🟢 100
Accessibility	🟢 96
Best Practices	🟢 100
SEO	🟢 100

Ran 5 audit(s). Full report available in workflow artifacts.

[github-actions]

🔦 Lighthouse CI Results

Category	Score
Performance	🟢 100
Accessibility	🟢 96
Best Practices	🟢 100
SEO	🟢 100

Ran 5 audit(s). Full report available in workflow artifacts.