Feat/cloudflare d1 #92

illyrius666 · 2026-02-05T11:39:34Z

Description

Please include a summary of the changes and the related issue. Explain the motivation behind these changes.

Checklist:

My code follows the style guidelines of this project
I have performed a self-review of my own code
I have commented my code, particularly in hard-to-understand areas
I have made corresponding changes to the documentation
My changes generate no new warnings
I have added tests that prove my fix is effective or that my feature works
New and existing unit tests pass locally with my changes
Any dependent changes have been merged and published in downstream modules

Signed-off-by: Illyrius <fitimq@live.nl>

…alDB types Signed-off-by: Illyrius <fitimq@live.nl>

Split GitHub OAuth callback logic into smaller functions for fetching user data, saving or updating users, extracting user ID, and setting session cookies. Update chrono dependency to enable serde support. Signed-off-by: Illyrius <fitimq@live.nl>

…ated logic Signed-off-by: Illyrius <fitimq@live.nl>

Signed-off-by: Illyrius <fitimq@live.nl>

Copilot

Pull request overview

This PR attempts to migrate the database layer from SurrealDB to Cloudflare D1. However, the implementation is incomplete and contains critical architectural incompatibilities that prevent it from functioning.

Changes:

Replaced SurrealDB database client with a stub Cloudflare D1 implementation (incomplete)
Removed IFC model data routes and associated functionality
Changed model IDs from SurrealDB RecordId to UUID v7
Refactored GitHub OAuth callback handler into smaller helper functions
Updated configuration to use database binding name instead of connection URL
Added worker and uuid dependencies, removed surrealdb dependencies
Renamed GitHub workflow cache step ID from cache_deps to cache_dependencies

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 16 comments.

Show a summary per file

File	Description
src/database.rs	Complete rewrite of database layer with new trait-based abstraction and D1-style implementation (incomplete with critical bugs)
src/config.rs	Updated database configuration fields from URL/username/password to binding name
src/models/user.rs	Changed ID type from RecordId to Uuid, added Default derive
src/models/card.rs	Changed ID type from RecordId to Uuid, added Default derive
src/routes/github.rs	Removed SurrealDB imports, refactored callback into helper functions, uses new database trait
src/routes/data.rs	Completely removed file containing IFC model CRUD endpoints
src/main.rs	Updated Database initialization to synchronous call, removed data route imports
src/lib.rs	Removed data module export
src/utils.rs	Updated error message to display database_binding_name instead of database_url
Cargo.toml	Added worker, uuid, chrono serde features; removed surrealdb dependencies
.github/workflows/release_build.yml	Renamed cache_dependencies step ID

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-05T11:45:45Z

src/database.rs


 pub struct Database {
-    pub client: Surreal<Client>,
+    binding_name: String,


The binding_name field is stored in the Database struct but never used in any of the methods. In a Cloudflare Workers environment with D1, this binding name should be used to access the D1 database instance from the Workers runtime environment.

Copilot · 2026-02-05T11:45:46Z

src/database.rs

+        let sql = format!("UPDATE {} SET data = ?, updated_at = ? WHERE id = ?", table);
+        let params = vec![


The SQL query uses format! to directly interpolate the table name into the query string. While the params are properly parameterized, the table name itself could be vulnerable to SQL injection if the caller passes unsanitized input. Consider validating the table name against a whitelist or using a safer approach to construct the query.

Copilot · 2026-02-05T11:45:46Z

src/database.rs

+        let where_clause: Vec<String> = conditions
+            .keys()
+            .map(|key| format!("json_extract(data, '$.{}') = ?", key))
+            .collect();
+        let sql = format!(
+            "SELECT data FROM {} WHERE {}",
+            table,
+            where_clause.join(" AND ")
+        );


The SQL query uses format! to directly interpolate both the table name and the condition keys into the query string. The condition keys from the HashMap are inserted into the json_extract function without sanitization. This could be vulnerable to SQL injection if malicious keys are passed in the conditions HashMap. Consider validating both the table name and condition keys against whitelists.

Copilot · 2026-02-05T11:45:46Z

Cargo.toml

+uuid = { version = "1.19", features = ["v7"] }
+worker = "0.7.4"


The worker crate (version 0.7.4) has been added to Cargo.toml but is not used anywhere in the codebase. This dependency is essential for Cloudflare Workers and D1 integration, but the actual integration code is missing. The database implementation needs to use this crate to interact with D1 bindings.

Suggested change

uuid = { version = "1.19", features = ["v7"] }

worker = "0.7.4"

uuid = { version = "1.19", features = ["v7"] }

Copilot · 2026-02-05T11:45:46Z

src/main.rs

 #[launch]
 async fn rocket() -> Rocket<Build> {
    let config = Config::new();
    build()
        .manage(config.clone())
-        .manage(Database::new(&config).await)
-        .mount(
-            "/",
-            routes![
-                github_login,
-                github_callback,
-                health,
-                data_upload,
-                data_get,
-                data_update,
-                data_delete,
-            ],
-        )
+        .manage(Database::new(&config.database_binding_name))
+        .mount("/", routes![github_login, github_callback, health,])


This PR attempts to migrate to Cloudflare D1 (which requires Cloudflare Workers runtime) while keeping Rocket as the web framework. Rocket is a standalone Rust web framework that runs on standard servers, not in the Cloudflare Workers runtime environment. These two are fundamentally incompatible. To use Cloudflare D1, the application needs to be rewritten as a Cloudflare Worker using the worker crate's HTTP routing instead of Rocket, or the database layer needs to use a different database that works with traditional server deployments.

Copilot · 2026-02-05T11:45:48Z

src/database.rs

+    async fn create<T: Serialize + Send>(&self, table: &str, data: T) -> Result<String> {
+        let id = Uuid::now_v7().to_string();
+        let data_value = serde_json::to_value(data)?;
+        let data_str = data_value.to_string();
+        let now = chrono::Utc::now().to_rfc3339();
+        let sql = format!(
+            "INSERT INTO {} (id, data, created_at) VALUES (?, ?, ?)",
+            table
+        );
+        let params = vec![
+            Value::String(id.clone()),
+            Value::String(data_str),
+            Value::String(now),
+        ];


The database stores entire objects as serialized JSON strings in a data column. While this works, it prevents efficient querying by object fields and loses type safety at the database level. For the D1 migration, consider using proper table schemas with individual columns for key fields, which would enable better indexing and querying capabilities. The current json_extract approach in the query method will be slower than native column queries.

Copilot · 2026-02-05T11:45:48Z

src/models/user.rs

+#[derive(Clone, Default, Debug, Serialize, Deserialize)]
 #[serde(crate = "rocket::serde")]
 pub struct User {
-    pub id: Option<RecordId>,
+    pub id: Uuid,


The User struct now derives Default trait (line 8), but the id field is of type Uuid which doesn't have a sensible default value. The derived Default will use Uuid::from_bytes([0; 16]) which creates a nil UUID. This could lead to ID conflicts when the default is used. Consider removing the Default derive or implementing a custom Default that generates a new UUID.

Copilot · 2026-02-05T11:45:49Z

src/models/card.rs

+#[derive(Clone, Default, Debug, Serialize, Deserialize)]
 #[serde(crate = "rocket::serde")]
 pub struct Card {
-    pub id: Option<RecordId>,
+    pub id: Uuid,
    pub thumbnail: Option<String>,
    pub title: String,
    pub author: User,


The Card struct now derives Default trait (line 8), which creates problematic defaults for multiple fields: id will be a nil UUID (potential conflicts), author will use User's default (which also has a nil UUID), and title, description, and platform will be empty strings. These defaults don't represent valid Card instances and could lead to data integrity issues. Consider removing the Default derive.

Copilot · 2026-02-05T11:45:49Z

src/database.rs

+        let sql = format!(
+            "INSERT INTO {} (id, data, created_at) VALUES (?, ?, ?)",
+            table
+        );


The SQL query uses format! to directly interpolate the table name into the query string. While the params are properly parameterized, the table name itself could be vulnerable to SQL injection if the caller passes unsanitized input. Consider validating the table name against a whitelist or using a safer approach to construct the query.

Copilot · 2026-02-05T11:45:49Z

src/database.rs

+            let sql = format!("SELECT data FROM {}", table);
+            let result = self.execute_query(&sql, vec![]).await?;


The SQL query uses format! to directly interpolate the table name into the query string. While the params are properly parameterized, the table name itself could be vulnerable to SQL injection if the caller passes unsanitized input. Consider validating the table name against a whitelist or using a safer approach to construct the query.

Illyrius added 8 commits January 22, 2026 14:58

init

099b77b

Signed-off-by: Illyrius <fitimq@live.nl>

Switch to uuid v7 for record IDs and update uuid crate usage

e058a7e

Signed-off-by: Illyrius <fitimq@live.nl>

cleanup

0a18f95

Signed-off-by: Illyrius <fitimq@live.nl>

Refactor user and card models to use uuid v7 for IDs and remove Surre…

9825fc9

…alDB types Signed-off-by: Illyrius <fitimq@live.nl>

Refactor database config for Cloudflare D1 integration and update rel…

86b295e

…ated logic Signed-off-by: Illyrius <fitimq@live.nl>

Rename cache step ID in release_build.yml for consistency

a88f8d7

Signed-off-by: Illyrius <fitimq@live.nl>

+

540153e

Signed-off-by: Illyrius <fitimq@live.nl>

Copilot AI review requested due to automatic review settings February 5, 2026 11:39

illyrius666 self-assigned this Feb 5, 2026

Merge branch 'dev' into feat/cloudflare_d1

0d1e6fe

Copilot started reviewing on behalf of illyrius666 February 5, 2026 11:39 View session

illyrius666 merged commit 01b6abd into dev Feb 5, 2026
1 check passed

illyrius666 deleted the feat/cloudflare_d1 branch February 5, 2026 11:40

illyrius666 restored the feat/cloudflare_d1 branch February 5, 2026 11:40

illyrius666 deleted the feat/cloudflare_d1 branch February 5, 2026 11:40

Copilot AI reviewed Feb 5, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Feat/cloudflare d1 #92

Feat/cloudflare d1 #92

Uh oh!

illyrius666 commented Feb 5, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 5, 2026

Uh oh!

Copilot AI Feb 5, 2026

Uh oh!

Copilot AI Feb 5, 2026

Uh oh!

Copilot AI Feb 5, 2026

Uh oh!

Copilot AI Feb 5, 2026

Uh oh!

Copilot AI Feb 5, 2026

Uh oh!

Copilot AI Feb 5, 2026

Uh oh!

Copilot AI Feb 5, 2026

Uh oh!

Copilot AI Feb 5, 2026

Uh oh!

Copilot AI Feb 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

		let sql = format!("UPDATE {} SET data = ?, updated_at = ? WHERE id = ?", table);
		let params = vec![

		uuid = { version = "1.19", features = ["v7"] }
		worker = "0.7.4" No newline at end of file

	uuid = { version = "1.19", features = ["v7"] }
	worker = "0.7.4"
	uuid = { version = "1.19", features = ["v7"] }

		let sql = format!("SELECT data FROM {}", table);
		let result = self.execute_query(&sql, vec![]).await?;

Uh oh!

Feat/cloudflare d1 #92

Feat/cloudflare d1 #92

Uh oh!

Conversation

illyrius666 commented Feb 5, 2026

Description

Checklist:

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 5, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant