You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Added shared error helpers in src/utils/errors.ts and supabase/functions/_backend/utils/errors.ts and reused them across stores/components/backend catch paths.
Replaced easy bodyRaw: any with unknown, narrowed Hono Context generics, and typed webhook event checks via isWebhookEventType.
Removed homemade slow types: deleted recursive Merge / Concrete / ArrayElement helpers in src/services/types.ts and replaced call sites with simple Supabase Returns[number] aliases / intersections.
Motivation (AI generated)
There were hundreds of any/unknown usages, plus a homemade deep Merge utility that forced expensive recursive type instantiation. Focusing on reusable helpers and deleting our own slow types improves type safety and compile cost without rewriting Supabase-generated types.
Business Impact (AI generated)
Fewer silent type holes in API request bodies and error handling, with faster/safer frontend typechecking by dropping recursive homemade utilities.
Test Plan (AI generated)
bun typecheck (cli + backend + frontend)
bun lint / bun lint:backend / bun lint:deadcode
CI Run tests green on latest commit
Spot-check org members / usage pages still type and render correctly
Could not type (too hard / out of scope) (AI generated)
Left alone on purpose:
Chart.js tooltip/annotation helpers
Supabase client bootstrap (null as any) and many RPC/as any joins
SSO admin/rpc as any casts
Cloudflare caches, Drizzle/pg aliases
Stripe/plans org: any paths
CLI Ink onboarding UI + CLI fixtures
Test-only as any mocks
TableRow = any default kept for unparameterized tables
Generated with AI
Summary by CodeRabbit
Bug Fixes
Improved error handling for role assignments, API key updates, webhooks, and notifications by safely extracting messages/codes and correctly detecting duplicate/structured failures.
Improved resilience when the CLI realtime feed preferences are malformed or not in the expected shape.
Strengthened webhook event validation for more consistent request outcomes.
Refactor
Tightened type safety across table rendering and core request/notification payload handling for more predictable behavior and easier maintenance.
Add reusable error helpers and replace easy bodyRaw/catch/Record any
patterns across frontend stores and backend public APIs without over-typing
Chart.js, SSO, or CLI UI paths.
Co-authored-by: Martin DONADIEU <martindonadieu@gmail.com>
Your recent review volume is higher than typical usage, so adaptive limits are currently applied.
Next review available in:11 minutes
Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).
How can I continue?
After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.
To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.
How do review limits work?
CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.
For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.
Reviewing files that changed from the base of the PR and between 1d5cd1f and 3ec566a.
📒 Files selected for processing (4)
src/pages/settings/organization/Usage.vue
src/services/supabase.ts
src/services/types.ts
src/stores/organization.ts
📝 Walkthrough
Walkthrough
The PR strengthens TypeScript contracts across frontend components, stores, services, Supabase functions, request handlers, and notification utilities. It also centralizes unknown-error parsing, narrows webhook validation, and adds runtime validation for realtime-feed preferences.
Adds shared error message/code helpers and applies unknown catch typing with normalized error extraction.
Frontend contracts and state typing src/components/comp_def.ts, src/composables/useRealtimeCLIFeed.ts, src/services/apikeys.ts, src/services/supabase.ts, src/stores/adminDashboard.ts, src/stores/{main,organization}.ts
Genericizes table definitions, validates realtime preferences, and tightens dashboard, API-key, service, and auth-event types.
Backend typing and request flows
Layer / File(s)
Summary
Backend shared contracts and utilities supabase/functions/_backend/utils/*, supabase/functions/_backend/plugin_runtime/utils/*, supabase/functions/_backend/private/{admin_credits,credits,invite_existing_user_to_org}.ts
Replaces broad payload, context, error, notification, analytics, and webhook types with unknown-based contracts and adds webhook event narrowing.
Backend API and webhook validation supabase/functions/_backend/private/role_bindings.ts, supabase/functions/_backend/public/apikey/*, supabase/functions/_backend/public/webhooks/*
Normalizes status/code inspection, narrows handler inputs and contexts, and reuses the webhook event type guard and API-key chain helpers.
Backend request and database data contracts supabase/functions/_backend/public/app/*, supabase/functions/_backend/public/build/request.ts, supabase/functions/_backend/public/organization/**
Uses generated application-row and JSON types, while changing raw request body parameters to unknown without altering schema validation flows.
No successful run was found on main (9b4803d) during the generation of this report, so 507494d was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Left a non-blocking comment — Cursor Bugbot did not complete successfully (skipped: usage limit), and this 54-file typing refactor across backend public APIs/webhooks/RBAC and frontend stores exceeds the low-risk auto-approve threshold. Reviewers were assigned for human review.
Sent by Cursor Approval Agent: Pull Request Approver External
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Left a non-blocking comment — Cursor Bugbot did not complete successfully (skipped due to usage limit), so this cannot be auto-approved. Assigned a reviewer for human review.
Sent by Cursor Approval Agent: Pull Request Approver
The reason will be displayed to describe this comment to others. Learn more.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/components/comp_def.ts`:
- Around line 51-56: Update the generic default on the Tab interface to TableRow
instead of unknown, preserving the existing onClick callback behavior for
unparameterized Tab usages while leaving explicitly parameterized Tab types
unchanged.
In `@src/services/supabase.ts`:
- Around line 690-691: Update the native package metadata handling in the
version-fetching flow so missing or null remoteNativePackages.version or
native_packages remains a failure instead of defaulting to an empty array.
Validate that native_packages is an actual array, reject or propagate the
missing-metadata error through the existing failure path, and call
convertNativePackages only with validated array data.
In `@src/stores/adminDashboard.ts`:
- Around line 161-170: Update fetchStats<T> to default to unknown instead of
any, and stop treating cached or fetched unvalidated data as arbitrary T. Add
metric-specific response types with runtime validation before caching and
returning stats, preserving the existing cache behavior while requiring callers
to narrow unknown results when no specific type is supplied.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
Push a commit to this branch (recommended)
Create a new PR with the fixes
ℹ️ Review info⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 4dfad5b1-5e31-40c0-b5ad-7716e07971f7
📥 Commits
Reviewing files that changed from the base of the PR and between dd965dd and 52c730c.
Default Tab to TableRow for unparameterized callbacks, restore missing
native_packages failure path, and keep admin fetchStats polymorphic without
an unchecked generic default.
Co-authored-by: Martin DONADIEU <martindonadieu@gmail.com>
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Left a non-blocking comment — Cursor Bugbot did not complete successfully (skipped due to usage limit), so this cannot be auto-approved. Reviewers are already assigned for human review.
Sent by Cursor Approval Agent: Pull Request Approver
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Left a non-blocking comment — Cursor Bugbot did not complete successfully (skipped: usage limit), and this broad typing refactor across public APIs, webhooks, and RBAC exceeds the low-risk auto-approve threshold. Reviewers are already assigned for human review.
Sent by Cursor Approval Agent: Pull Request Approver External
The reason will be displayed to describe this comment to others. Learn more.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/services/supabase.ts`:
- Around line 690-694: Update the native package parsing flow before
convertNativePackages to require nativePackages to be an array, and validate
each item has the expected name and version fields before conversion. Keep the
existing parsing error for invalid metadata and only call convertNativePackages
with validated package entries.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
Push a commit to this branch (recommended)
Create a new PR with the fixes
ℹ️ Review info⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 031c27c9-0497-43f7-8854-9a3dc1637c86
📥 Commits
Reviewing files that changed from the base of the PR and between 52c730c and 1d5cd1f.
📒 Files selected for processing (3)
src/components/comp_def.ts
src/services/supabase.ts
src/stores/adminDashboard.ts
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Left a non-blocking comment — Cursor Bugbot did not complete successfully (skipped due to usage limit), so this cannot be auto-approved. Reviewers are already assigned for human review.
Sent by Cursor Approval Agent: Pull Request Approver
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Left a non-blocking comment — Cursor Bugbot did not complete successfully (skipped: usage limit), and this broad typing refactor across public APIs, webhooks, and RBAC exceeds the low-risk auto-approve threshold. Reviewers are already assigned for human review.
Sent by Cursor Approval Agent: Pull Request Approver External
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Left a non-blocking comment — Cursor Bugbot did not complete successfully (skipped: usage limit), and this broad typing refactor across public APIs, webhooks, and RBAC exceeds the low-risk auto-approve threshold. Reviewers are already assigned for human review.
Sent by Cursor Approval Agent: Pull Request Approver External
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Left a non-blocking comment — Cursor Bugbot did not complete successfully (skipped due to usage limit), so this cannot be auto-approved. Reviewers are already assigned for human review.
Sent by Cursor Approval Agent: Pull Request Approver
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Left a non-blocking comment — Cursor Bugbot did not complete successfully (skipped due to usage limit), so this cannot be auto-approved. Reviewers are already assigned for human review.
Sent by Cursor Approval Agent: Pull Request Approver
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Left a non-blocking comment — Cursor Bugbot did not complete successfully (skipped: usage limit), and this broad typing refactor across public APIs, webhooks, and RBAC exceeds the low-risk auto-approve threshold. Reviewers are already assigned for human review.
Sent by Cursor Approval Agent: Pull Request Approver External
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Left a non-blocking comment — Cursor Bugbot did not complete successfully (skipped: usage limit), and this broad typing refactor across public APIs, webhooks, and RBAC exceeds the low-risk auto-approve threshold. Reviewers are already assigned for human review.
Sent by Cursor Approval Agent: Pull Request Approver External
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Left a non-blocking comment — Cursor Bugbot did not complete successfully (skipped due to usage limit), so this cannot be auto-approved. Reviewers are already assigned for human review.
Sent by Cursor Approval Agent: Pull Request Approver
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Left a non-blocking comment — Cursor Bugbot did not complete successfully (skipped due to usage limit), so this cannot be auto-approved. Reviewers are already assigned for human review.
Sent by Cursor Approval Agent: Pull Request Approver
The reason will be displayed to describe this comment to others. Learn more.
Risk: medium. Left a non-blocking comment — Cursor Bugbot did not complete successfully (skipped: usage limit), and this broad typing refactor across public APIs, webhooks, and RBAC exceeds the low-risk auto-approve threshold. Reviewers are already assigned for human review.
Sent by Cursor Approval Agent: Pull Request Approver External
The reason will be displayed to describe this comment to others. Learn more.
Risk: medium. Left a non-blocking comment — Cursor Bugbot did not complete successfully (skipped due to usage limit), so this cannot be auto-approved. Reviewers are already assigned for human review.
Sent by Cursor Approval Agent: Pull Request Approver
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Summary (AI generated)
src/utils/errors.tsandsupabase/functions/_backend/utils/errors.tsand reused them across stores/components/backend catch paths.bodyRaw: anywithunknown, narrowed HonoContextgenerics, and typed webhook event checks viaisWebhookEventType.Merge/Concrete/ArrayElementhelpers insrc/services/types.tsand replaced call sites with simple SupabaseReturns[number]aliases / intersections.Motivation (AI generated)
There were hundreds of
any/unknownusages, plus a homemade deepMergeutility that forced expensive recursive type instantiation. Focusing on reusable helpers and deleting our own slow types improves type safety and compile cost without rewriting Supabase-generated types.Business Impact (AI generated)
Fewer silent type holes in API request bodies and error handling, with faster/safer frontend typechecking by dropping recursive homemade utilities.
Test Plan (AI generated)
bun typecheck(cli + backend + frontend)bun lint/bun lint:backend/bun lint:deadcodeRun testsgreen on latest commitCould not type (too hard / out of scope) (AI generated)
Left alone on purpose:
null as any) and many RPC/as anyjoinsrpc as anycastscaches, Drizzle/pg aliasesorg: anypathsas anymocksTableRow = anydefault kept for unparameterized tablesGenerated with AI
Summary by CodeRabbit
Bug Fixes
Refactor