Integrate Setup Automation, Sync Recovery, and Hardened SSRF Security - #12
Conversation
…ection test SSRF security
|
Warning Review limit reached
Next review available in: 12 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe PR prevents Plex connection testing on configured instances, adds tests for configured and unconfigured setup states, documents four repository issues, and corrects generated Next.js type import paths. ChangesSetup connection-test security
Next.js generated types
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested labels: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 2📝 Generate docstrings 💡
🛠️ Fix failing CI checks 💡
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/api/src/server.test.ts`:
- Around line 273-294: Update the setup connection security tests around the
configured and unconfigured cases: stub PlexClient.testConnection in the
configured-instance test and assert it is not called, while asserting
testConnectionSpy is called once in the unconfigured test. Ensure all spies are
restored during test teardown.
In `@BUGS_AND_TODOS.md`:
- Around line 67-69: Update the compiler-output code fence in BUGS_AND_TODOS.md
to include the text language tag, changing the opening fence from ``` to ```text
while leaving the enclosed error message unchanged.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: b3926cf5-acdf-48d0-9d58-ee89f568d086
📒 Files selected for processing (4)
BUGS_AND_TODOS.mdapps/api/src/server.test.tsapps/api/src/server.tsapps/web/next-env.d.ts
…ection test SSRF security
…ection test SSRF security
…ection test SSRF security
1 participant
Musearr Repository-wide Audit, Feature Integration, and Security Hardening
This PR brings together several critical active feature PRs, fixes important bugs, resolves a strict compile-time TypeScript error, and implements a high-priority security hardening to prevent Setup Connection Test SSRF vulnerability.
1. Pull Request (PR) Triage & Reused Fixes
We triaged all existing branches on origin to integrate proven work:
origin/feat/web-sync-recovery-states(Reused & Fixed): Integrated the dynamicSyncRecoveryStatecard into the main dashboard, which replaced the static sync card. This allows local owners to view detailed page counts, scanned offset, and a retry button for failed libraries. We fixed a strict TypeScript compilation error regardingAbortSignaltype mismatch.origin/development&origin/feat/ui-controls-sync-progress(Reused & Fixed):docker-compose.release.yml.origin/feat/web-sync-state(Obsolete): Superseded by the superior classified sync failure system (sanitiseSyncFailure) already merged inmain.2. Bug & security backlog (BUGS_AND_TODOS.md)
The repository-wide audit findings are fully documented in
BUGS_AND_TODOS.mdat the repo root.POST /api/v1/setup/test-plexto scan internal ports or request arbitrary URLs. Fixed by checking setup status first.`ncharacters corrupted Compose files. Cleaned up and verified.{ signal }could be passed asundefinedunderexactOptionalPropertyTypes: true. Fixed conditionally.3. Verified Fixes Completed
apps/api/src/server.tsby checkinggetSetupStatusand rejecting connection tests if the instance is already configured.apps/api/src/server.test.tsto ensure unconfigured connection test is allowed while configured is blocked.AbortSignaltypescript build issue insync-recovery-state.tsx.`nsyntax corruptions indocker-compose.release.yml.4. Test and Build Results
npm run buildon API, worker, web apps, and db package).5. Remaining High-Priority Problems
Summary by CodeRabbit
Bug Fixes
Tests