User profile and Preferences

[sheriffjimoh]

Summary by Sourcery

Add comprehensive profile management and preferences features, including editable username/email, email verification, theme/font selectors, and translation support. Introduce an onboarding flow for anonymous users to pick categories, enhance global thread search with backend filtering, and expand Hasura services with user update and verification token logic.

New Features:

• Enable users to edit their username and email in the preferences with client-side validation and inline save buttons
• Add email verification functionality with a resend verification email flow and server API for token creation
• Integrate Google Translate widget into preferences to allow on-page content translation
• Convert theme and font size settings from toggles to dropdown selectors
• Introduce an onboarding section for anonymous users to select categories on home and browse pages
• Add a global search input to browse and profile threads that filters results via backend keyword queries

Enhancements:

• Extend Hasura service with an updateUser mutation, username uniqueness check, and include is_verified flag in user data
• Enhance thread-fetching logic to support keyword filtering in getThreads and getBrowseThreads
• Refactor PreferenceSection to handle multiple item types (input, email verification, translation, dropdown) and tie into the profile context
• Load and update profile data in ProfileLayoutContent using getUserBySlug and next-auth session updates
• Various UI, layout, and style adjustments across auth pages, sidebar, thread popups, and profile components

Chores:

• Reorder and clean up package.json and Bun workspaces configuration
• Add new Hasura seed files for domain, category, subcategory, tag, and example enums

Summary by CodeRabbit

• New Features

  • Global search across messages and threads with a new search bar.
  • Guided onboarding for new users to choose topics.
  • Revamped Preferences: edit username/slug, resend email verification, select language (built-in translation), and choose theme and font size (now includes Small/Medium).

• Improvements

  • Clearer signup feedback when a username is already taken.
  • Email verification status with improved error messages.
  • UI polish: layout height tweaks, updated accordion icon, hidden breadcrumbs, refined empty-state text.

• Access Control

  • Preference and Subscription pages now require login and matching user.

• Chores

  • Monorepo configuration and tooling updates.

[AndlerRL]

Hey @sheriffjimoh the changes looks good! However, there are some areas that we can take.

What went wrong:

• The seeds have a new hash ref: Do you recall which changes you did? These are important to keep as they are to develop. I see their sizes are different from original, meaning that they might be either re-formatted at large-scale or content added/removed.
• I see the old masterbots.ai folder. Please refer to this update and update this folder to both web and pro-web. Make sure we have the same components on both versions.
• We are removing key permissions for pro and main app version: please revert them as they are on develop.
• I left the coderabbitai feedbacks and additional observations to do before the merge.

The changes seem right and the latest to be at the masterbots.ai directory from these changes however, I experienced something similar as this PR with the old directory, so I made few updates too hence, let me merge that PR and then pull the latest to this PR to see the new changes and see what else we are missing/changing.

Btw, you saved the day ⭐ I see a few files missed from the latest changes that wan't merged.

[AndlerRL]

Is this hashed class static? Not sure if it is better to use html tags as selectors with a more reliable class selection 🤔

[sheriffjimoh]

I use couple of other classes and ID too, but i think this is static, tho it's just to hide the top banner.

[AndlerRL]

I think we already have this type definition in here.

[AndlerRL]

Keep in mind the incremental font-size display in the icons and text on each dropdown option for users a11y to preview the font before changes. You may find the exponential value set for each size global class.

[sheriffjimoh]

Manually adjusted the fontsize

[AndlerRL]

OK, I see that you are actually validating the username regex here—great 👍 you may ignore my another feedback related to this validation.

[AndlerRL]

@sheriffjimoh just 2 files fully synced, please check the rest. I pulled the latest from develop.

[coderabbitai]

Actionable comments posted: 3

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (3)

apps/pro-web/app/actions/ai-main-call.actions.ts (1)

533-537: Type error: Partial<typeof aiTools> with a type‑only import will not compile

typeof aiTools expects a value import, but aiTools is imported as a type. This produces a TS error. Use the same tools type you already use above or import the value.

Apply this diff to align with the earlier block:

-  const tools: Partial<typeof aiTools> = {
+  const tools: StreamTextParams['tools'] = {
     // webSearch: aiTools.webSearch,
     // ? Temp disabling ICL as tool. Using direct ICL integration to main prompt instead. Might be enabled later.
     // chatbotMetadataExamples: aiTools.chatbotMetadataExamples
   }

apps/pro-web/app/api/auth/signup/route.ts (2)

109-110: Security concern: Auto-verifying users bypasses email validation

Setting isVerified: true and lastLogin at signup time bypasses email verification, which could allow fake accounts and spam registrations.

This differs from the web app which properly implements email verification. If this is intentional for the pro-web app, it should be documented and potentially controlled via configuration.

 object: {
 	email,
 	username: newUsername,
 	slug: toSlug(newUsername),
 	password: hashedPassword,
 	profilePicture: `https://robohash.org/${newUsername}?bgset=bg2`,
 	dateJoined: new Date().toISOString(),
-	isVerified: true, // Set as verified directly
-	lastLogin: new Date().toISOString(), // Set initial login timestamp
+	// Only set as verified if email verification is disabled
+	isVerified: !appConfig.features.enableVerificationEmail,
+	...(
+		!appConfig.features.enableVerificationEmail && {
+			lastLogin: new Date().toISOString()
+		}
+	)
 },

---

157-174: Dead code: Verification token generation is unused

Lines 158-160 generate a verification token that is never used. The function immediately returns success without creating the token in the database or sending a verification email.

Either remove the dead code or implement proper email verification:

-// * Generate verification token
-const verificationToken = crypto.randomBytes(32).toString('hex')
-const tokenExpiry = new Date()
-tokenExpiry.setDate(tokenExpiry.getDate() + 15) // 15 days to verify
-
-// Skip email verification and simply return success with credentials
-// This allows the frontend to auto-login after signup
 return NextResponse.json(
 	{
 		message: 'User created successfully.',
 		userId: insertUserOne.userId,
-		requiresVerification: false, // No verification needed
+		requiresVerification: false,
 		username: newUsername,
 		email: email,
 		success: true,
 	},
 	{ status: 201 },
 )

♻️ Duplicate comments (3)

apps/pro-web/app/actions/ai-main-call.actions.ts (1)

359-374: Reasoning opts: top-level reasoning_effort is likely ignored; re‑enable providerOptions with correct OpenAI fields

You commented out providerOptions and added reasoning_effort at the top level. In the AI SDK, OpenAI reasoning parameters should be passed under providerOptions.openai (or the SDK’s supported alias), not as a top‑level key. Otherwise the model may run without the intended reasoning controls.

Apply this diff to restore provider options and remove the unknown top‑level field:

               temperature: 1,
-              reasoning_effort: isPowerUp ? 'high' : 'medium',
-              // providerOptions: {
-              //  openai: {
-              //    reasoningEffort: 'low',
-              //    reasoningSummary: 'auto',
-              //  },
-              // },
+              // Reasoning opts must go under providerOptions.openai (verify SDK version).
+              providerOptions: {
+                openai: {
+                  // Most recent SDKs accept `reasoning: { effort }`.
+                  reasoning: { effort: isPowerUp ? 'high' : 'medium' },
+                  // If supported in your SDK version; otherwise omit/adjust.
+                  reasoningSummary: 'auto',
+                },
+              },

Please double‑check the exact shape supported by your installed ai-sdk/openai version.

Vercel AI SDK: how to set OpenAI reasoning parameters (reasoning effort / reasoning summary) via streamText `providerOptions.openai`

apps/pro-web/services/hasura/hasura.service.ts (2)

254-263: Remove redundant exact match check in keyword filtering

The current implementation uses both _iregex and _eq operators. The _eq check is redundant since _iregex already handles exact matches case-insensitively. Additionally, the keyword should be escaped to prevent regex injection vulnerabilities.

 ...(keyword
   ? {
       messages: {
-        _or: [
-          { content: { _iregex: keyword } },
-          { content: { _eq: keyword } },
-        ],
+        content: { _iregex: keyword.replace(/[.*+?^${}()|[\]\\]/g, '\\$&') },
       },
     }
   : {}),

---

758-767: Extract duplicated keyword filtering logic

The keyword filtering logic is duplicated from the getThreads function (lines 254-263). This violates DRY principles and makes maintenance harder.

+// Add this helper function at the top of the file after imports
+function buildKeywordFilter(keyword?: string) {
+  if (!keyword) return {}
+  return {
+    messages: {
+      content: { _iregex: keyword.replace(/[.*+?^${}()|[\]\\]/g, '\\$&') },
+    },
+  }
+}

 // In getBrowseThreads function:
 const baseWhereConditions = {
-  ...(keyword
-    ? {
-        messages: {
-          _or: [
-            { content: { _iregex: keyword } },
-            { content: { _eq: keyword } },
-          ],
-        },
-      }
-    : {}),
+  ...buildKeywordFilter(keyword),

 // Also update getThreads function (line 254-263):
-  ...(keyword
-    ? {
-        messages: {
-          _or: [
-            { content: { _iregex: keyword } },
-            { content: { _eq: keyword } },
-          ],
-        },
-      }
-    : {}),
+  ...buildKeywordFilter(keyword),

🧹 Nitpick comments (5)

apps/pro-web/app/actions/ai-main-call.actions.ts (3)

350-356: Unify reasoning-model detection to avoid drift between config and sendReasoning

You detect reasoning models via isReasoningModel in the OpenAI case, but sendReasoning later checks model.includes('o4-mini') directly. Use a single predicate so behavior doesn’t diverge.

Minimal change suggestion:

-        const isReasoningModel =
-          model.startsWith('o4-mini') || model.includes('gpt-5')
+        const isReasoningModel =
+          model.startsWith('o4-mini') || model.includes('gpt-5') // consolidate here

...
-        sendReasoning:
-          clientType === 'DeepSeek' ||
-          clientType === 'GroqDeepSeek' ||
-          (clientType === 'OpenAI' && model.includes('o4-mini')),
+        sendReasoning:
+          clientType === 'DeepSeek' ||
+          clientType === 'GroqDeepSeek' ||
+          (clientType === 'OpenAI' && isReasoningModel),

If you have a helper like getModelClientType() (per guidelines), consider hoisting a single “is reasoning” check based on the resolved client/model to avoid future mismatches.

Also applies to: 496-501

---

77-82: DeepSeek API key parameter unused

initializeDeepSeek validates apiKey but returns the provider without using it. Either wire the key through a factory (if supported) or rely solely on env vars and drop the param.

-const initializeDeepSeek = (apiKey: string) => {
-  if (!apiKey) {
-    throw new Error('DEEPSEEK_API_KEY is not defined in environment variables')
-  }
-  return deepseek
-}
+const initializeDeepSeek = (apiKey: string) => {
+  if (!apiKey && !process.env.DEEPSEEK_API_KEY) {
+    throw new Error('DEEPSEEK_API_KEY is not defined in environment variables')
+  }
+  return deepseek // relies on env var; if factory with apiKey exists in your SDK, use it here.
+}

---

114-163: Remove @ts-ignore by consuming the stream properly

Accessing .curr on the streamable value is an internal detail. Prefer readStreamableValue(response) (which you already sketched) to avoid type suppression and improve robustness.

I can provide a small refactor to return the final object (non‑streaming) from createResponseStreamObject, or wire a proper readStreamableValue loop here if you want streaming end‑to‑end.

apps/web/app/api/auth/signup/route.ts (1)

63-90: Optimize username generation with exponential backoff

The username generation loop has potential performance issues:

1. It regenerates the username on every collision (line 86)
2. The delay is fixed at 100ms regardless of attempt count
3. No maximum attempt limit could lead to infinite loops

 // * Generate unique username if needed
 let foundFreeUsername = false
 newUsername = generateUsername(newUsername)
 let sequence = 0
+const MAX_ATTEMPTS = 10
+const baseUsername = newUsername

-while (!foundFreeUsername) {
+while (!foundFreeUsername && sequence < MAX_ATTEMPTS) {
 	if (sequence > 0) {
-		newUsername = `${newUsername}${sequence}`
+		newUsername = `${baseUsername}${sequence}`
 	}

-	await delayFetch(100)
+	// Exponential backoff: 100ms, 200ms, 400ms...
+	await delayFetch(Math.min(100 * Math.pow(2, sequence), 1000))
 	const { user } = await client.query({
 		user: {
 			__args: {
 				where: {
 					username: { _eq: newUsername },
 				},
 			},
 			username: true,
 		},
 	})

 	if (!user.length) {
 		foundFreeUsername = true
-	} else {
-		newUsername = generateUsername(newUsername)
 	}

 	sequence++
 }

+if (!foundFreeUsername) {
+	throw new Error('Unable to generate a unique username after multiple attempts')
+}

apps/pro-web/services/hasura/hasura.service.ts (1)

250-289: Validate domain parameter format before query

The domain parameter undergoes string replacement (line 277) but lacks validation, which could lead to unexpected query behavior with special characters.

 ...(domain
   ? {
       metadata: {
         domainName: {
-          _ilike: `%${domain.replace(/-/g, ' ')}%`,
+          _ilike: `%${domain.replace(/-/g, ' ').replace(/[%_]/g, '\\$&')}%`,
         },
       },
     }
   : {}),

Also applies to line 441 in getThread function.

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between fd6207f and 84c055c.

📒 Files selected for processing (7)

• apps/pro-web/app/actions/ai-main-call.actions.ts (1 hunks)
• apps/pro-web/app/api/auth/signup/route.ts (2 hunks)
• apps/pro-web/services/hasura/hasura.service.ts (3 hunks)
• apps/web/app/api/auth/signup/route.ts (2 hunks)
• apps/web/app/api/payment/subscription/route.tsx (1 hunks)
• apps/web/app/globals.css (2 hunks)
• apps/web/services/hasura/hasura.service.ts (3 hunks)

🚧 Files skipped from review as they are similar to previous changes (3)

• apps/web/app/globals.css
• apps/web/app/api/payment/subscription/route.tsx
• apps/web/services/hasura/hasura.service.ts

🧰 Additional context used

📓 Path-based instructions (4)

**/*.{ts,tsx,js,jsx,cjs,mjs,json,jsonc}

📄 CodeRabbit inference engine (CLAUDE.md)

Use Biome for all formatting and linting (run bun format-and-lint:fix) instead of Prettier/ESLint

Files:

• apps/web/app/api/auth/signup/route.ts
• apps/pro-web/app/api/auth/signup/route.ts
• apps/pro-web/services/hasura/hasura.service.ts
• apps/pro-web/app/actions/ai-main-call.actions.ts

apps/{web,pro-web}/**/*.{ts,tsx}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

apps/{web,pro-web}/**/*.{ts,tsx}: Use feature detection before invoking modern Browser APIs
Implement progressive enhancement: basic functionality first, then enhancements
Add timing delays or requestAnimationFrame when the DOM needs to settle before operations
Verify DOM operations completed successfully; don’t assume success (e.g., scroll/check actual state)
Use multiple approaches for DOM actions: try modern APIs first, then fallback to legacy methods

Files:

• apps/web/app/api/auth/signup/route.ts
• apps/pro-web/app/api/auth/signup/route.ts
• apps/pro-web/services/hasura/hasura.service.ts
• apps/pro-web/app/actions/ai-main-call.actions.ts

apps/**/services/**/*.ts

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

Store external API integration code under services/

Files:

• apps/pro-web/services/hasura/hasura.service.ts

**/ai-main-call.actions.{ts,tsx}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

**/ai-main-call.actions.{ts,tsx}: Route AI calls through ai-main-call.actions for unified AI API handling
Use getModelClientType() to select the appropriate AI client

Files:

• apps/pro-web/app/actions/ai-main-call.actions.ts

🧠 Learnings (4)

📚 Learning: 2024-12-04T22:22:16.749Z

Learnt from: AndlerRL
PR: bitcashorg/masterbots#320
File: apps/masterbots.ai/services/admin/admin.service.ts:6-11
Timestamp: 2024-12-04T22:22:16.749Z
Learning: In `apps/masterbots.ai/services/admin/admin.service.ts`, the `verifyAdmin` function uses email domain verification as an additional security layer, complementing the role-based security implemented via JWTs and the GraphQL API with user roles "users" and "moderators".

Applied to files:

• apps/web/app/api/auth/signup/route.ts
• apps/pro-web/app/api/auth/signup/route.ts

📚 Learning: 2025-04-26T10:58:44.341Z

Learnt from: AndlerRL
PR: bitcashorg/masterbots#465
File: apps/masterbots.ai/components/routes/browse/browse-list.tsx:1-1
Timestamp: 2025-04-26T10:58:44.341Z
Learning: The browse-list.tsx component is redundant as thread-list.tsx has been developed to support all the same functionality including public pages. The codebase should be cleaned up to remove browse-list.tsx and related components in the browse directory, along with the BrowseProvider context.

Applied to files:

• apps/pro-web/services/hasura/hasura.service.ts

📚 Learning: 2025-04-26T10:58:44.341Z

Learnt from: AndlerRL
PR: bitcashorg/masterbots#465
File: apps/masterbots.ai/components/routes/browse/browse-list.tsx:1-1
Timestamp: 2025-04-26T10:58:44.341Z
Learning: The browse-list.tsx component and related components in the browse directory are redundant since thread-list.tsx has been developed to support all pages including public pages, and should be removed to simplify the codebase.

Applied to files:

• apps/pro-web/services/hasura/hasura.service.ts

📚 Learning: 2025-09-12T20:31:46.639Z

Learnt from: CR
PR: bitcashorg/masterbots#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-12T20:31:46.639Z
Learning: Applies to **/ai-main-call.actions.{ts,tsx} : Route AI calls through ai-main-call.actions for unified AI API handling

Applied to files:

• apps/pro-web/app/actions/ai-main-call.actions.ts

🧬 Code graph analysis (3)

apps/web/app/api/auth/signup/route.ts (1)

apps/web/services/hasura/hasura.service.ts (1)

• isUsernameTaken (2003-2016)

apps/pro-web/app/api/auth/signup/route.ts (1)

apps/pro-web/services/hasura/hasura.service.ts (1)

• isUsernameTaken (2047-2060)

apps/pro-web/services/hasura/hasura.service.ts (1)

packages/mb-lib/src/hasura/hasura.lib.ts (1)

• getHasuraClient (19-54)

[coderabbitai]

🛠️ Refactor suggestion

Code duplication across web and pro-web signup routes

This entire signup route is nearly identical to apps/web/app/api/auth/signup/route.ts with minor differences in verification handling. This violates DRY principles.

Consider extracting the shared logic into a common service or utility function that both apps can use. Would you like me to help create a shared signup service that both apps can leverage while maintaining their specific configuration differences?

🤖 Prompt for AI Agents

In apps/pro-web/app/api/auth/signup/route.ts lines 28-36, the signup route
duplicates logic found in apps/web/app/api/auth/signup/route.ts; extract the
shared validation and username-checking/creation flow into a common service
(e.g., packages/auth-service or src/lib/auth/signup.ts) that returns
standardized results or throws typed errors, then have each route import that
service and pass in any app-specific hooks or options (such as verification
strategy, extra metadata, response formatting). Move input parsing,
isUsernameTaken call, user creation and common error mapping into the shared
function, and keep only the thin adapter in each route to handle NextResponse
specifics and the differing verification behavior via injected callbacks or an
options object.

[coderabbitai]

⚠️ Potential issue

Consider adding rate limiting for username checks

The isUsernameTaken function could be abused for username enumeration attacks or to cause excessive database load through rapid requests.

Consider implementing:

1. Rate limiting at the API route level (e.g., using middleware)
2. Caching recent username checks with a short TTL
3. Adding monitoring/alerting for excessive username check requests

This is particularly important since this function is called from public signup endpoints without authentication.

🤖 Prompt for AI Agents

In apps/pro-web/services/hasura/hasura.service.ts around lines 2047 to 2060, the
public isUsernameTaken function can be abused for enumeration or DoS; add
protections by implementing rate limiting on the public API route that calls
this function (IP- and endpoint-based limits, e.g., per-minute quotas and
exponential backoff), add a short-lived cache for recent username checks
(in-memory or Redis with a small TTL like 30–120s keyed by username and
optionally client IP to reduce DB hits), and add monitoring/alerting (metrics
for requests, rate-limit hits, cache hit/miss rates, and alerts for spikes) so
the route enforces limits before calling isUsernameTaken and falls back to
cached results when available.

[sheriffjimoh]

Hey @sheriffjimoh the changes looks good! However, there are some areas that we can take.

What went wrong:

• The seeds have a new hash ref: Do you recall which changes you did? These are important to keep as they are to develop. I see their sizes are different from original, meaning that they might be either re-formatted at large-scale or content added/removed.
• I see the old masterbots.ai folder. Please refer to this update and update this folder to both web and pro-web. Make sure we have the same components on both versions.
• We are removing key permissions for pro and main app version: please revert them as they are on develop.
• I left the coderabbitai feedbacks and additional observations to do before the merge.

The changes seem right and the latest to be at the masterbots.ai directory from these changes however, I experienced something similar as this PR with the old directory, so I made few updates too hence, let me merge that PR and then pull the latest to this PR to see the new changes and see what else we are missing/changing.

Btw, you saved the day ⭐ I see a few files missed from the latest changes that wan't merged.

Hey @AndlerRL . i tried to sync with develop and everything seems to be updated 🤔 , i have fixed all the coderabit and other observation as well.

[AndlerRL]

LGTM! Thanks for dealing with the details and the seeds reports 👍 everything is now good for a merge!