Chore/monorepo quality gates - #309
Merged
Merged
Conversation
github-actions
Bot
added
dependencies
Contributor
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF ScorecardScorecard details
Scanned Files
|
Member
Author
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
Contributor
|
Visit the preview URL for this PR (updated for commit 3f34b93): https://hacklytics2027--pr-309-pt7agxm3.web.app (expires Wed, 12 Aug 2026 03:33:00 GMT) 🔥 via Firebase Hosting GitHub Action 🌎 Sign: c48ba34db61581e25fe2978355160b5eefe0e83f |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Member
Author
|
| Filename | Overview |
|---|---|
| packages/api/src/routers/stripe.ts | Reworks Stripe payment and membership flows; the ownership fix rejects legitimate compound-name payers using a different account email. |
| sites/mainweb/app/(portal)/api/webhooks/stripe/route.ts | Expands Stripe webhook processing and membership synchronization without an accepted finding in this pass. |
| packages/db/src/services/membership.ts | Introduces shared membership resolution and update behavior without an accepted finding in this pass. |
| packages/api/src/routers/judge/portal.ts | Substantially revises judging portal behavior and related state handling without an eligible follow-up finding. |
| pnpm-lock.yaml | Updates locked workspace dependencies to match manifest and workspace changes. |
Reviews (2): Last reviewed commit: "yea" | Re-trigger Greptile
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
| }); | ||
| } catch { | ||
| // Swallowed deliberately — see above. Nothing here may break sign-in. | ||
| } |
There was a problem hiding this comment.
Sign-in link skips cache eviction
Medium Severity
The new signIn event grants membership via linkPaidPaymentByVerifiedEmail but never clears membership or portal caches. A cached “not a member” result can persist for minutes after a successful link on login.
Reviewed by Cursor Bugbot for commit b0986e8. Configure here.
Member
Author
Comment on lines
+503
to
+515
| const paymentTokens = new Set( | ||
| normalize(payment.customerName ?? "") | ||
| .split(" ") | ||
| .filter(Boolean), | ||
| ); | ||
| const firstName = normalize(input.firstName); | ||
| const lastName = normalize(input.lastName); | ||
|
|
||
| const nameMatches = | ||
| firstName.length > 0 && | ||
| lastName.length > 0 && | ||
| paymentTokens.has(firstName) && | ||
| paymentTokens.has(lastName); |
There was a problem hiding this comment.
When a legitimate payer uses a different account email and submits a compound name such as lastName: "Jane Watson" for the stored name Mary Jane Watson, the code splits the stored name into individual tokens but searches for jane watson as one token. This makes nameMatches false and prevents the payer from linking their paid membership.
|
Too many files changed for review. ( Bypass the limit by tagging |
| expect(end.getTime()).toBeGreaterThan(Date.now() + 360 * DAY); | ||
| expect(end.getTime()).toBeLessThan(Date.now() + 370 * DAY); | ||
| }); | ||
| }); |
There was a problem hiding this comment.
New db tests skip CI
Low Severity
The PR adds packages/db/src/services/membership.test.ts for the updated renewal term logic, but root pnpm test still runs only vitest run packages/api, whose config includes tests under packages/api/src only. These cases never execute in the default quality gate.
Reviewed by Cursor Bugbot for commit aa6a04c. Configure here.
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.
There are 3 total unresolved issues (including 2 from previous reviews).
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 3f34b93. Configure here.
|
|
||
| // The sign-in hook in @query/auth grants memberships and cannot reach this | ||
| // cache; registering here is how those grants get their entries evicted. | ||
| setMembershipChangeHandler(clearMembershipCaches); |
There was a problem hiding this comment.
Sign-in cache eviction never runs
Medium Severity
The setMembershipChangeHandler(clearMembershipCaches) registration in portal-context.ts is not active during the OAuth sign-in flow. Since the sign-in process doesn't import portal-context.ts, notifyMembershipChanged calls don't trigger cache eviction. This leaves member status caches stale, incorrectly showing users as "not a member" after a membership grant until the cache expires.
Reviewed by Cursor Bugbot for commit 3f34b93. Configure here.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
Low Risk
Documentation and ignore-file updates plus a minor Next.js patch bump; no application logic changes in the diff.
Overview
Monorepo hygiene: Adds
.cache/to.gitignoreso Turbo/tsc task outputs (e.g..cache/tsbuildinfo.jsonfromturbo.json) stay untracked and builds no longer dirty the working tree after every run.Docs: Removes the
sites/discordBotrow from the README workspace table.Dependencies: Bumps root
nextfrom16.2.11to16.3.0.Reviewed by Cursor Bugbot for commit 3f34b93. Bugbot is set up for automated code reviews on this repo. Configure here.