[codex] Harden demo read paths by pc-style · Pull Request #3 · pc-style/postwork

pc-style · 2026-07-03T10:20:32Z

Summary

This PR hardens the demo data path after the docs/analytics cleanup landed on main.

The app is still a flow-design prototype with a shared Convex demo database. Public write mutations made it possible for visitors to persist demo state changes into that shared backend, while the frontend already has a session-only overlay for visitor interactions. This change aligns the backend with that model: shared demo data remains read-only for visitors, and temporary interaction state stays local to the browser session.

What changed

Removes public Convex write paths for visitor post creation and read-state updates.
Keeps post/reply/read interactions in the existing session-only frontend overlay.
Makes the destructive seed routine an internalMutation so it is not callable as a public function.
Limits the main feed query to the latest 200 posts to avoid unbounded table scans during enrichment.
Strips auth subject values from the public user directory response.
Replaces client-supplied subject profile edits with an authenticated updateProfile mutation based on ctx.auth.getUserIdentity().
Adds optional orgId to posts and simplifies org-scoped shared-space visibility checks.
Deduplicates participants when merging backend posts with session-added reply participants.
Adds CLEANUP_PLAN.md as the next-phase cleanup and architecture handoff.

User impact

Visitors can still explore the product flow, create local session posts/replies, mark content read, and use the prototype without mutating shared demo data. Authenticated profile edits are safer because the caller can only edit the profile associated with their own identity.

Validation

Rebased onto latest origin/main after PR Clean docs and add Plausible tracking #2 merged.
Ran bun install to hydrate the newly merged Plausible dependency locally.
Ran bun run build successfully.

Summary by cubic

Locks down the demo backend to keep shared data read‑only, bounds feed reads, fixes org‑scoped visibility, and migrates auth to stable tokenIdentifier with automatic backfill from legacy subject (now via a shared helper).

Bug Fixes & Hardening
- Removed public write paths (convex/reads.ts, posts.create, posts.counts); visitor posts/replies/read state stay in the session overlay.
- Made seed.run an internalMutation to prevent public DB wipes.
- Replaced subject-based edits with users.updateProfile (uses ctx.auth.getUserIdentity(); no role edits); users.list no longer returns tokenIdentifier or subject.
- Added users.by_token_identifier index and switched lookups; extracted authUsers.findUserForIdentity to resolve/backfill identities, used in users.updateProfile and discussions viewer creation; discussions now stores tokenIdentifier and derives avatar color from it.
- Added optional posts.orgId and fixed org‑scoped visibility in spaces.feedForSpace.
- Limited posts.feed to the latest 200 items.
- Deduplicated participants when merging backend posts with session replies.
- Updated convex/_generated/api.d.ts (added authUsers, removed reads) and added CLEANUP_PLAN.md.
Migration
- No UI changes; legacy users backfill automatically.
- Update any callers to use users.updateProfile.
- Regenerate convex/_generated/ with codegen when a deployment is available.

^{Written for commit b466066. Summary will update on new commits.}

…bound feed - seed:run is now internalMutation (was a public wipe-the-DB endpoint) - setProfileBySubject -> updateProfile: identity from ctx.auth, no client role escalation; users.list no longer exposes auth subjects - delete dead unauthenticated endpoints: reads.ts, posts.create, posts.counts - bound posts.feed to 200 most recent (was unbounded collect + N+1 reads) - add posts.orgId and fix feedForSpace org-visibility filter (checked a field that did not exist; org posts were invisible to everyone) - dedupe session-overlay participants (duplicate avatars / React keys) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

38 verified audit findings (tokens, components, architecture, routes, docs) organized into 7 executable phases with per-step do/verify instructions for an autonomous agent. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

vercel · 2026-07-03T10:20:38Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
better-slack	Ready	Preview, Comment	Jul 3, 2026 10:44am

coderabbitai · 2026-07-03T10:20:42Z

Warning

Review limit reached

@pc-style, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 25 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: e02b79be-0911-466b-83ec-036089964229

📥 Commits

Reviewing files that changed from the base of the PR and between 74a5003 and b466066.

⛔ Files ignored due to path filters (1)

convex/_generated/api.d.ts is excluded by !**/_generated/**

📒 Files selected for processing (10)

CLEANUP_PLAN.md
convex/authUsers.ts
convex/discussions.ts
convex/posts.ts
convex/reads.ts
convex/schema.ts
convex/seed.ts
convex/spaces.ts
convex/users.ts
src/lib/store.tsx

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch codex/harden-demo-read-paths

✨ Simplify code

Create PR with simplified code
Commit simplified code in branch codex/harden-demo-read-paths

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

cubic-dev-ai

1 issue found across 9 files

_{Reply with feedback, questions, or to request a fix.

Re-trigger cubic}

cubic-dev-ai

1 issue found across 3 files (changes from recent commits).

_{Reply with feedback, questions, or to request a fix.

Re-trigger cubic}

cubic-dev-ai

1 issue found across 2 files (changes from recent commits).

_{Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic}

Ph4seOn3 and others added 2 commits July 3, 2026 12:19

vercel Bot deployed to Preview July 3, 2026 10:20 View deployment

cubic-dev-ai Bot reviewed Jul 3, 2026

View reviewed changes

Comment thread convex/users.ts Outdated

Use token identifier for auth user mapping

aa67441

coderabbitai Bot approved these changes Jul 3, 2026

View reviewed changes

vercel Bot deployed to Preview July 3, 2026 10:28 View deployment

cubic-dev-ai Bot reviewed Jul 3, 2026

View reviewed changes

Comment thread convex/discussions.ts Outdated

Backfill auth token identifiers

42cdfa6

vercel Bot deployed to Preview July 3, 2026 10:40 View deployment

cubic-dev-ai Bot reviewed Jul 3, 2026

View reviewed changes

Comment thread convex/users.ts Outdated

Share auth user resolution

b466066

vercel Bot deployed to Preview July 3, 2026 10:44 View deployment

pc-style merged commit 83ea42c into main Jul 3, 2026
6 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[codex] Harden demo read paths#3

[codex] Harden demo read paths#3
pc-style merged 5 commits into
mainfrom
codex/harden-demo-read-paths

pc-style commented Jul 3, 2026 •

edited by cubic-dev-ai Bot

Loading

Uh oh!

vercel Bot commented Jul 3, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Jul 3, 2026 •

edited

Loading

Review limit reached

Uh oh!

cubic-dev-ai Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

pc-style commented Jul 3, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What changed

User impact

Validation

Summary by cubic

Uh oh!

vercel Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

pc-style commented Jul 3, 2026 •

edited by cubic-dev-ai Bot

Loading

vercel Bot commented Jul 3, 2026 •

edited

Loading

coderabbitai Bot commented Jul 3, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading