feat(org): make the default organization name configurable (#1749) - #2222
feat(org): make the default organization name configurable (#1749)#2222aniketshukla1 wants to merge 4 commits into
Conversation
…1749) The default org for the open-source deployment was hardcoded as "mock_org", fixing the org segment of every URL (e.g. /mock_org/tools) and doubling as the frontend open-source sentinel. Backend: add DEFAULT_ORGANIZATION_NAME (env, default "mock_org", mirroring DEFAULT_AUTH_USERNAME); DefaultOrg reads it. The name flows to the frontend via sessionDetails.orgName, so URLs follow automatically. Frontend: expose defaultOrgName through the runtime config + config.js, and point the four isOpenSource checks at it instead of the literal "mock_org". Set VITE_DEFAULT_ORG_NAME to the same value as the backend to keep open-source detection correct. Fully backward compatible: every default stays "mock_org", so existing deployments are unaffected; a new deployment can rename the org by setting both env vars.
|
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
Summary by CodeRabbit
WalkthroughThe default organization name is now configurable through backend settings and frontend runtime configuration. Frontend authorization, navigation, analytics, and administration checks use the shared configured value instead of a hardcoded organization name. ChangesDefault Organization Configuration
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
|
| Filename | Overview |
|---|---|
| backend/account_v2/constants.py | Replaces the hardcoded default tenant identifier with the configured value, but existing deployments still require an external data migration when that value changes. |
| backend/backend/settings/base.py | Adds trimming, fallback, and single-path-segment validation for the configurable organization name, while documenting that later renames strand existing tenant data. |
| frontend/generate-runtime-config.sh | Normalizes the frontend organization setting consistently with the backend and safely emits it into runtime configuration. |
| frontend/src/config.js | Resolves the default organization name from runtime or build-time configuration with trimming and a backward-compatible fallback. |
| frontend/src/components/helpers/auth/RequireAdmin.js | Uses the configured organization sentinel for OSS admin-route behavior. |
| frontend/src/components/navigations/top-nav-bar/TopNavBar.jsx | Uses the configured organization sentinel for OSS navigation behavior. |
| frontend/src/hooks/usePostHogEvents.js | Uses the configured organization sentinel when classifying telemetry as OSS or SaaS. |
| frontend/src/pages/UnstractAdministrationPage.jsx | Uses the configured organization sentinel for administration-page access behavior. |
Reviews (5): Last reviewed commit: "Merge branch 'main' into fix/1749-config..." | Re-trigger Greptile
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@backend/backend/settings/base.py`:
- Around line 175-178: Normalize or reject blank DEFAULT_ORGANIZATION_NAME
values in backend/backend/settings/base.py lines 175-178 so the resolved value
never becomes empty. Update frontend/src/config.js lines 21-26 to fail fast on
missing or mismatched VITE_DEFAULT_ORG_NAME, or source it from the
backend-resolved organization name instead of silently defaulting to mock_org;
keep both configurations in lockstep.
In `@frontend/generate-runtime-config.sh`:
- Line 22: Update the defaultOrgName generation in the runtime configuration to
pass the resolved VITE_DEFAULT_ORG_NAME/REACT_APP_DEFAULT_ORG_NAME/mock_org
value through the existing js_escape helper before embedding it in JavaScript,
while preserving the current fallback order.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 93cf1ebf-2cf5-45f4-b244-49714844db93
📒 Files selected for processing (10)
backend/account_v2/constants.pybackend/backend/settings/base.pybackend/sample.envfrontend/generate-runtime-config.shfrontend/sample.envfrontend/src/components/helpers/auth/RequireAdmin.jsfrontend/src/components/navigations/top-nav-bar/TopNavBar.jsxfrontend/src/config.jsfrontend/src/hooks/usePostHogEvents.jsfrontend/src/pages/UnstractAdministrationPage.jsx
| # Name/id of the default organization created for the open-source (single-tenant) | ||
| # deployment. Configurable so the org segment of URLs (e.g. /mock_org/tools) can be | ||
| # a meaningful name. Defaults to "mock_org" for backward compatibility. | ||
| DEFAULT_ORGANIZATION_NAME = os.environ.get("DEFAULT_ORGANIZATION_NAME", "mock_org") |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
Keep backend and frontend organization-name configuration in lockstep.
The backend accepts an explicitly empty value, while the frontend silently falls back to mock_org when its value is missing or empty. A custom backend deployment with a missing or mismatched VITE_DEFAULT_ORG_NAME therefore classifies the organization as SaaS instead of OSS; this can expose SaaS-only UI and enable the PostHog PII path.
backend/backend/settings/base.py#L175-L178: reject or normalize blank values instead of accepting"".frontend/src/config.js#L21-L26: fail fast on a missing/mismatched frontend value, or source the frontend value from the backend-resolved organization name rather than silently defaulting tomock_org.
📍 Affects 2 files
backend/backend/settings/base.py#L175-L178(this comment)frontend/src/config.js#L21-L26
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@backend/backend/settings/base.py` around lines 175 - 178, Normalize or reject
blank DEFAULT_ORGANIZATION_NAME values in backend/backend/settings/base.py lines
175-178 so the resolved value never becomes empty. Update frontend/src/config.js
lines 21-26 to fail fast on missing or mismatched VITE_DEFAULT_ORG_NAME, or
source it from the backend-resolved organization name instead of silently
defaulting to mock_org; keep both configurations in lockstep.
…ntime config Address Greptile/CodeRabbit review feedback on Zipstack#2222: - Reject non-URL-safe DEFAULT_ORGANIZATION_NAME values (e.g. containing "/") that would break org routing, since the middleware matches a single [^/]+ segment and the frontend uses it as a raw route segment. - Normalize blank values to "mock_org" so the backend and frontend defaults stay in lockstep and the open-source org isn't misclassified as SaaS. - Document the setting as set-once: changing it on an existing deployment strands the previous organization's data and needs a manual migration. - Escape defaultOrgName through js_escape in generate-runtime-config.sh so a value containing " or \ can't produce invalid JavaScript.
|
Thanks @greptileai and @coderabbitai for the review. Pushed 1. Unvalidated names break org routing (Greptile · P1) 2. Renaming strands persisted tenant data (Greptile · P1) 3. Keep backend and frontend configuration in lockstep (CodeRabbit · Major) 4. Escape Verified before pushing: @greptileai review |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
git show --stat --oneline --decorate --no-renames b155ce9
git diff b155ce9^ b155ce9 -- \
backend/backend/settings/base.py \
backend/sample.env \
frontend/generate-runtime-config.sh
printf '\n--- settings references and validation context ---\n'
rg -n -C 8 'DEFAULT_ORGANIZATION_NAME|DefaultOrg|organization_id' \
backend/backend/settings/base.py backend/account_v2/constants.py backend/sample.env
printf '\n--- runtime configuration context ---\n'
sed -n '1,240p' frontend/generate-runtime-config.sh
printf '\n--- frontend config and sample environment references ---\n'
rg -n -C 6 'defaultOrgName|VITE_DEFAULT_ORG_NAME|REACT_APP_DEFAULT_ORG_NAME' \
frontend/src/config.js frontend/sample.envLength of output: 13982 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- frontend configuration module ---'
sed -n '1,120p' frontend/src/config.js
printf '%s\n' '--- runtime config references and deployment inputs ---'
rg -n -C 4 \
'runtime-config\.js|RUNTIME_CONFIG|generate-runtime-config|VITE_DEFAULT_ORG_NAME|REACT_APP_DEFAULT_ORG_NAME' \
frontend \
-g '!**/node_modules/**' -g '!**/dist/**' -g '!**/build/**'
printf '%s\n' '--- related tests and script conventions ---'
fd -t f . frontend | rg '(^|/)(test|tests|__tests__)/|(\.test|\.spec)\.[cm]?[jt]sx?$|\.sh$'
rg -n -C 4 'js_escape|sed -e .s/\\\\|runtime config' frontend \
-g '*.sh' -g '*test*' -g '*spec*'Length of output: 11086
One issue remains. Please escape JavaScript line terminators and control characters in 🐇 ✅ Action performedReview finished.
|
Greptile flagged that the backend strips DEFAULT_ORGANIZATION_NAME while the frontend preserved surrounding whitespace, so matching values that contain whitespace would compare unequal and misclassify the open-source deployment as SaaS (wrong navigation, route gating, admin page and telemetry). - generate-runtime-config.sh: trim the resolved value (with a blank -> mock_org fallback) before escaping it into the runtime config. - config.js: trim the resolved value with the same blank -> mock_org fallback for the dev/build path, so both frontend paths mirror the backend .strip().
|
Pushed Root cause: the backend now Both frontend paths now normalize identically to the backend:
Verified: @greptileai review |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
git show --stat --oneline --no-renames 22611ee
git diff 22611ee^ 22611ee -- frontend/generate-runtime-config.sh frontend/src/config.js
printf '\n--- runtime config generator ---\n'
nl -ba frontend/generate-runtime-config.sh | sed -n '1,220p'
printf '\n--- frontend config module ---\n'
nl -ba frontend/src/config.js | sed -n '1,180p'
printf '\n--- backend normalization and validation context ---\n'
rg -n -C 6 'DEFAULT_ORGANIZATION_NAME|strip\(\)|URL-safe|organization name' \
backend/backend/settings/base.py backend/sample.env
printf '\n--- default organization consumers ---\n'
rg -n -C 3 'defaultOrgName|VITE_DEFAULT_ORG_NAME|REACT_APP_DEFAULT_ORG_NAME' \
frontend/src frontend/generate-runtime-config.sh frontend/sample.envLength of output: 4254 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- runtime config generator ---'
sed -n '1,220p' frontend/generate-runtime-config.sh
printf '%s\n' '--- frontend config module ---'
sed -n '1,180p' frontend/src/config.js
printf '%s\n' '--- exact escaping implementation in commit 22611ee ---'
git show 22611ee:frontend/generate-runtime-config.sh | sed -n '/^js_escape()/,/^}/p'
printf '%s\n' '--- JavaScript-sensitive input handling references ---'
rg -n -C 4 'js_escape|DEFAULT_ORG_NAME|defaultOrgName' \
frontend/generate-runtime-config.sh frontend/src/config.js
printf '%s\n' '--- backend normalization and validation context ---'
rg -n -C 6 'DEFAULT_ORGANIZATION_NAME|strip\(\)|URL-safe|organization name' \
backend/backend/settings/base.py backend/sample.envLength of output: 14517
One issue remains in
Please either:
The first option keeps the frontend configuration contract consistent with You are interacting with an AI system. |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@frontend/generate-runtime-config.sh`:
- Line 33: Update the defaultOrgName generation in generate-runtime-config.sh to
encode the entire DEFAULT_ORG_NAME value with a JSON/JSON-superset encoder
rather than the limited js_escape helper, ensuring LF, CR, U+2028, U+2029, and
other invalid JavaScript characters produce valid runtime-config.js output. Add
a test covering these inputs and verify the generated configuration remains
valid.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 3d55510f-ecd6-43de-b775-f128e5e46d7b
📒 Files selected for processing (2)
frontend/generate-runtime-config.shfrontend/src/config.js
🚧 Files skipped from review as they are similar to previous changes (1)
- frontend/src/config.js
| faviconPath: "${VITE_FAVICON_PATH:-${REACT_APP_FAVICON_PATH}}", | ||
| logoUrl: "${VITE_CUSTOM_LOGO_URL:-${REACT_APP_CUSTOM_LOGO_URL}}", | ||
| enablePosthog: "${VITE_ENABLE_POSTHOG:-${REACT_APP_ENABLE_POSTHOG}}", | ||
| defaultOrgName: "$(js_escape "$DEFAULT_ORG_NAME")", |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "## Locate file and outline"
fd -a 'generate-runtime-config\.sh$' . || true
if [ -f frontend/generate-runtime-config.sh ]; then
wc -l frontend/generate-runtime-config.sh
sed -n '1,120p' frontend/generate-runtime-config.sh
fi
echo "## Search js_escape usages and runtime config env"
rg -n "js_escape|DEFAULT_ORG_NAME|runtime-config|generate-runtime-config" -S .Repository: Zipstack/unstract
Length of output: 3895
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "## Locate file and outline"
fd -a 'generate-runtime-config\.sh$' . || true
if [ -f frontend/generate-runtime-config.sh ]; then
wc -l frontend/generate-runtime-config.sh
sed -n '1,160p' frontend/generate-runtime-config.sh
fi
echo "## Search js_escape usages and runtime config env"
rg -n "js_escape|DEFAULT_ORG_NAME|runtime-config|generate-runtime-config" -S .Repository: Zipstack/unstract
Length of output: 3895
🌐 Web query:
ECMAScript JavaScript string literal line terminators LF CR U+2028 U+2029 control characters syntax
💡 Result:
In ECMAScript, line terminators are defined as a specific set of four Unicode code points [1][2]. While these characters are identified as line terminators, their treatment within string literals differs from that of standard control characters like LF and CR [1][3]. Line Terminators The ECMAScript specification defines the following code points as line terminators [1][2]: - U+000A: LINE FEED (LF) - U+000D: CARRIAGE RETURN (CR) - U+2028: LINE SEPARATOR (LS) - U+2029: PARAGRAPH SEPARATOR (PS) Treatment in String Literals - LF (U+000A) and CR (U+000D): These characters are generally forbidden from appearing literally within string literals [1][4]. To include them, they must be represented using escape sequences, such as \n for LF and \r for CR [3][4]. A backslash followed by a line terminator sequence is treated as an empty string (line continuation) [3][5]. - LS (U+2028) and PS (U+2029): Unlike LF and CR, U+2028 and U+2029 are permitted as literal characters within ECMAScript string literals [6][7]. Although they are classified as line terminators for the purposes of lexical grammar (affecting features like automatic semicolon insertion and source code readability), they do not terminate a string literal [1][7]. This behavior was established to make ECMAScript a true superset of JSON, which allows these characters unescaped [6][8]. Summary Table | Code Point | Unicode Name | Literal in String | Escape Sequence | |:--- |:--- |:--- |:--- | | U+000A | LINE FEED (LF) | No | \n | | U+000D | CARRIAGE RETURN (CR) | No | \r | | U+2028 | LINE SEPARATOR | Yes | \u2028 | | U+2029 | PARAGRAPH SEPARATOR | Yes | \u2029 | While template literals also allow U+2028 and U+2029 as literal characters, standard string literals (delimited by single or double quotes) enforce these restrictions for LF and CR [3][8]. Other Unicode line-breaking characters (such as Next Line, U+0085) are not considered line terminators by the ECMAScript specification and are treated simply as white space [3].
Citations:
- 1: https://tc39.es/ecma262/multipage/ecmascript-language-lexical-grammar.html
- 2: https://tc39.es/ecma262/2026/multipage/ecmascript-language-lexical-grammar.html
- 3: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Lexical%5Fgrammar
- 4: https://tc39.es/ecma262/2024/multipage/ecmascript-language-lexical-grammar.html
- 5: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Lexical_grammar
- 6: https://ecma-international.org/wp-content/uploads/ECMA-262_16th_edition_june_2025.pdf
- 7: <LS> and <PS> are valid characters in string literals tc39/test262-parser-tests#26
- 8: https://github.com/tc39/proposal-json-superset
🌐 Web query:
ECMAScript string literal control characters invalid syntax Unicode code point value
💡 Result:
In ECMAScript, string literals are defined as sequences of zero or more Unicode code points enclosed in single or double quotes [1][2]. Most Unicode code points can appear literally within these strings; however, a small set of characters is restricted from appearing as literal source text [1][3]. The specific code points that cannot appear literally in a string literal are: - U+005C (REVERSE SOLIDUS, or backslash) [1][2] - U+000D (CARRIAGE RETURN, or CR) [1][2] - U+000A (LINE FEED, or LF) [1][2] - The closing quote code point (either U+0027 APOSTROPHE or U+0022 QUOTATION MARK, depending on how the string was opened) [1][3] If these characters are placed directly in the source text of a string literal, it results in a syntax error [4][2]. To include these characters or any other code point in a string value, you must use an escape sequence [1][5][3]. Crucially, ECMAScript handles Unicode escape sequences differently than some other languages like Java [5][6]. A Unicode escape sequence (e.g., \u000A) used within a string literal is interpreted as the character it represents and is never treated as a line terminator or a character that could terminate the string literal [5][6]. Consequently, while a literal U+000A is forbidden, the escape sequence \u000A (or the common escape \n) is perfectly valid and is the standard way to represent such characters within a string [1][5]. Additionally, a backslash can be used at the end of a line (a LineContinuation) to allow a string literal to conceptually span multiple lines in the source code without containing a line terminator in the final string value [1][3].
Citations:
- 1: https://tc39.es/ecma262/2026/multipage/ecmascript-language-lexical-grammar.html
- 2: https://tc39.es/ecma262/2025/multipage/ecmascript-language-lexical-grammar.html
- 3: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Lexical%5Fgrammar
- 4: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Errors/String_literal_EOL
- 5: https://tc39.es/ecma262/2026/multipage/ecmascript-language-source-code.html
- 6: https://tc39.es/ecma262/2025/multipage/ecmascript-language-source-code.html
🌐 Web query:
frontend.Dockerfile bun image entrypoint 40-env.sh VITE_DEFAULT_ORG_NAME config runtime-config
💡 Result:
To implement runtime configuration for a frontend application (such as one built with Vite) using a Bun-based Docker image, the 40-env.sh script is a common pattern used to inject environment variables into the application after the build process is complete [1][2][3]. Because Vite applications are typically built as static assets, variables prefixed with VITE_ are baked into the code during the build stage [1]. To make these configurable at runtime (e.g., changing VITE_DEFAULT_ORG_NAME without rebuilding the container), follow this architectural pattern: 1. Runtime Injection Pattern: Instead of relying on build-time environment variables for all settings, you configure your application to fetch configuration from an external file (often named env.js or config.js) at runtime [1][2][4]. You then set your bundler (Vite) to treat this file as an external module, preventing it from baking the values into the static bundle [1]. 2. The 40-env.sh Script: When using an Nginx or similar web server container to host the static assets, you place a script (commonly named 40-env.sh) in the /docker-entrypoint.d/ directory [1][2][3]. Upon container startup, this script: - Reads the desired environment variables (e.g., VITE_DEFAULT_ORG_NAME) from the container's environment [2][3]. - Generates a JavaScript file (e.g., /usr/share/nginx/html/env.js) containing these variables as global constants or a configuration object [5][1][2]. - This file is then served by the web server to the browser, allowing the frontend application to access the updated configuration dynamically [1][4]. 3. Dockerfile Configuration: - Use a multi-stage Dockerfile [6][7]. The first stages build your application using the official oven/bun image [8][7]. - The final stage should copy the built assets to a production-ready image (often Nginx or Alpine) [3][7]. - Ensure your COPY instruction includes the 40-env.sh script in the directory that the image's entrypoint scans on startup [1][2]. - If you are running the application directly with Bun (e.g., for SSR or a node-compatible server), the entrypoint script should use the exec command to ensure the application receives signals (like SIGTERM) correctly [6]. Note that the official oven/bun Docker images utilize a built-in docker-entrypoint.sh, but for frontend runtime configuration, the custom 40-env.sh approach is an extension typically added to the hosting layer (like Nginx) rather than the Bun runtime image itself [9][10][1][2].
Citations:
- 1: https://medium.com/@kwokyinlun/change-environment-variables-after-build-time-for-web-fe-project-spa-ssg-80f23d8acb31
- 2: https://support.tools/dynamic-environment-variables-docker-react/
- 3: https://github.com/openlibraryenvironment/dcb-admin-for-libraries/blob/main/docs/DEPLOYMENT.md
- 4: https://github.com/AdaskoTheBeAsT/NXSamples
- 5: https://github.com/24042882wuqiuhai/resume-cicd-lab-goushuukai/blob/main/app/docker-entrypoint.d/40-write-env.sh
- 6: https://engineering.oakoliver.com/articles/docker-multistage-builds-for-bun
- 7: https://shahriyar.dev/blog/multi-stage-dockerfile-for-bun-next-js-prisma
- 8: https://bun.sh/docs/guides/ecosystem/docker
- 9: https://github.com/oven-sh/bun/blob/74e191b3/dockerhub/alpine/Dockerfile
- 10: https://github.com/oven-sh/bun/blob/74e191b3/dockerhub/debian/Dockerfile
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "## Read Dockerfile around frontend entrypoint/config"
sed -n '1,110p' docker/dockerfiles/frontend.Dockerfile
echo "## Read frontend config.js around VITE_DEFAULT_ORG_NAME"
sed -n '1,80p' frontend/src/config.js
echo "## Node probe for problematic raw characters in generated runtime-config.js string literals"
node - <<'JS'
const {Script, SourceTextModule} = require('vm');
function emit(value) {
return `window.RUNTIME_CONFIG = {
defaultOrgName: "${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"
};`;
}
for (const [kind, value] of [
['LF', 'a\n'] ,
['CR', 'a\r'] ,
['U+2028', 'a\u2028'],
['U+2029', 'a\u2029'],
['NUL', 'a\u0000'],
['BS', 'a\u0008'],
['control U+001F', 'a\u001f'],
]) {
let ok = false, error;
try {
// Use sourceTextModule only for syntax-only check without global effects.
// Need a top-level string containing the runtime config; wrap in strict mode to prevent global mutation.
const src = `(function() { ${emit(value)} })();`;
new SourceTextModule(src, {strictMode: true, identifier: `${kind}-module`});
ok = true;
} catch (err) {
error = err.message;
}
console.log(`${kind}: ${kind.includes('NUL') ? 'has NUL' : JSON.stringify(value).replace(/"/g, "'")}; valid=${ok}; ${error ?? ''}`.split('\n').slice(0,1).join('\n'));
}
JSRepository: Zipstack/unstract
Length of output: 4582
Escape all raw characters that defaultOrgName writes into runtime-config.js.
js_escape() only escapes \ and ", so embedded LF, CR, \u2028, \u2029, or other invalid characters in VITE_DEFAULT_ORG_NAME become invalid JavaScript in the generated script. Replace defaultOrgName: "$(js_escape "$DEFAULT_ORG_NAME")" with a full JSON/JSON-superset encoder, and add a test covering those inputs.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@frontend/generate-runtime-config.sh` at line 33, Update the defaultOrgName
generation in generate-runtime-config.sh to encode the entire DEFAULT_ORG_NAME
value with a JSON/JSON-superset encoder rather than the limited js_escape
helper, ensuring LF, CR, U+2028, U+2029, and other invalid JavaScript characters
produce valid runtime-config.js output. Add a test covering these inputs and
verify the generated configuration remains valid.
|
2 participants
Summary
The default organization for the open-source (single-tenant) deployment was hardcoded as
mock_org— it fixes the org segment of every URL (e.g./mock_org/tools) and also doubles as the frontend's open-source sentinel. This makes the name configurable while staying fully backward-compatible.Closes #1749.
Changes
Backend
DEFAULT_ORGANIZATION_NAME(env var, defaultmock_org) insettings/base.py, mirroring the existingDEFAULT_AUTH_USERNAMEpattern.DefaultOrg.ORGANIZATION_NAME/MOCK_ORGnow read that setting. The org name already flows to the frontend viasessionDetails.orgName, so URLs follow automatically.Frontend
defaultOrgNamethrough the runtime config (generate-runtime-config.sh) andconfig.js(envVITE_DEFAULT_ORG_NAME, defaultmock_org).isOpenSource = orgName === "mock_org"checks (top nav bar, admin route guard, PostHog events, administration page) now compare againstconfig.defaultOrgNameinstead of the literal string, so open-source detection stays correct after a rename.Docs
backend/sample.envandfrontend/sample.env.Backward compatibility
Every default remains
mock_org, so existing deployments are unaffected. To rename the org, setDEFAULT_ORGANIZATION_NAME(backend) andVITE_DEFAULT_ORG_NAME(frontend) to the same value.Testing
DEFAULT_AUTH_USERNAME.biome check(import organization + formatting) on all changed files.