Remade the activity tracker#174
Merged
Merged
Conversation
Contributor
|
Warning Review limit reached
Next review available in: 38 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (8)
📝 WalkthroughWalkthroughOrbitActivity was rewritten around unified player state, reliable queued HTTP delivery, session synchronization, AFK tracking, and remote configuration. New APIs and settings controls add bulk session startup plus private-server and studio tracking configuration. ChangesActivity platform
Estimated code review effort: 5 (Critical) | ~120 minutes Possibly related PRs
Suggested labels: Suggested reviewers: Sequence Diagram(s)sequenceDiagram
participant OrbitActivity
participant HttpQueue
participant ActivityAPI
participant ActivityDatastore
OrbitActivity->>HttpQueue: queue session and player updates
HttpQueue->>ActivityAPI: send retryable HTTP request
ActivityAPI->>ActivityDatastore: create, end, or synchronize session
ActivityDatastore-->>ActivityAPI: return session result
ActivityAPI-->>HttpQueue: return delivery response
HttpQueue-->>OrbitActivity: report request status
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…ntrolled format string' Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
…ntrolled format string' Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 15
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@components/settings/general/activity.tsx`:
- Around line 245-277: Preserve each setting’s previous value before the
optimistic update and restore that value in the catch blocks of
updatePrivateServer and updateStudio instead of hardcoding false. Also change
updateStudio’s error toast to a studio-specific failure message, while leaving
the successful response handling unchanged.
In `@components/switch.tsx`:
- Around line 27-33: Add a visible focus-visible indicator to the switch
element’s class list while preserving the existing focus:outline-none behavior
and disabled/checked styling. Update the clsx classes in the switch component to
apply an accessible ring or equivalent focus styling only when the control
receives keyboard-visible focus.
In `@Orbit-activity.rbxmx`:
- Around line 527-531: Update InitiatePlayer so MovementDetection runs
asynchronously on its own thread, allowing InitiatePlayer to return and
CreateSession to execute without waiting for Character or CharacterAdded.
Preserve the existing movement setup behavior while ensuring players without a
spawned character do not block session creation.
- Line 595: Update the URL construction in the httpGet call to use Luau’s
{Configuration.groupId} interpolation syntax instead of
${Configuration.groupId}, ensuring the actual group ID is sent in the request.
- Around line 596-608: Update the remote-config override loop to read values
from response.data instead of response, and align the overridable key list with
the API payload names: minTrackedRank, privateServerEnabled, and studioEnabled.
Ensure each matching Configuration field is updated and tracked in changed while
preserving the existing validation and local-default behavior.
- Around line 181-190: Update fetchRank’s GetRolesInGroupAsync call to pass the
player’s valid user ID property instead of Player.User, so the protected lookup
executes successfully and minTrackedRank filtering uses the retrieved rank.
In `@pages/api/activity/bulk-start.ts`:
- Line 103: Update both console.error calls in the bulk-start handler to keep
the first argument as a static message and pass userid or sessionData.userid as
a separate argument before error. Remove their interpolation from the format
string so user-controlled percent sequences cannot trigger format substitution.
- Around line 61-146: Limit concurrent session processing in the bulk-start
flow, especially the checkSpecificUser calls created by the creations map and
Promise.all, using a bounded concurrency limiter or batches instead of unbounded
fan-out. Reuse the userRank obtained by getRankInGroup when invoking
checkSpecificUser by extending its API as needed, avoiding duplicate Roblox rank
lookups while preserving existing permission behavior.
- Around line 70-135: The active-session check in the bulk-start flow is
vulnerable to TOCTOU races. Enforce one active session per user and workspace
group at the database level with a unique partial constraint/index, then replace
the check-then-create behavior around the existing lookup and
prisma.activitySession.create call with an atomic upsert or handle the
unique-constraint error as an already-started result.
In `@pages/api/activity/config.ts`:
- Around line 22-39: Return immediately after the successful response in the
activity config handler, updating the flow around getConfig and the existing
res.status(200).send call so execution cannot reach the unconditional response
at the end. Preserve the current error response and payloads.
- Around line 14-38: Add the same authorization-key validation used by the
bulk-start.ts and bulk-end.ts handlers to the GET handler before calling
getConfig or returning activity configuration. Validate the request’s
authorization value against the established key, and return the existing
unauthorized response for invalid or missing credentials while preserving the
current successful GET behavior.
In `@pages/api/workspace/`[id]/settings/activity/download.ts:
- Line 28: Remove the console.log(activityconfig) statement from the activity
download handler. Do not log the full activity configuration or its key;
preserve the surrounding configuration generation and download flow unchanged.
- Around line 28-35: Update the activityconfig initialization flow to assign the
newly generated key back to the local activityconfig after setConfig, preserving
any existing fields. Ensure activityconfig is non-null before later unguarded
activityconfig.key usage so the first download without an existing configuration
succeeds.
In `@pages/api/workspace/`[id]/settings/activity/setprivateserver.ts:
- Around line 28-33: Validate and coerce req.body.enabled to a real boolean
before constructing newconfig in the activity settings handler. Ensure values
such as the string "false" are stored as false rather than truthy, while
preserving the existing getConfig and setConfig flow.
In `@pages/api/workspace/`[id]/settings/activity/setstudio.ts:
- Around line 28-33: Update the setstudio handler’s newconfig construction to
coerce req.body.enabled with Boolean before assigning studioEnabled, matching
the validation used by setprivateserver.ts; leave the surrounding getConfig and
setConfig flow unchanged.
🪄 Autofix (Beta)
❌ Autofix failed (check again to retry)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 9d31892a-32d4-4eb7-bfbf-e0a6d5950403
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (10)
Orbit-activity.rbxmxcomponents/settings/general/activity.tsxcomponents/switch.tsxpages/api/activity/bulk-start.tspages/api/activity/config.tspages/api/workspace/[id]/settings/activity/download.tspages/api/workspace/[id]/settings/activity/getConfig.tspages/api/workspace/[id]/settings/activity/setIdleTime.tspages/api/workspace/[id]/settings/activity/setprivateserver.tspages/api/workspace/[id]/settings/activity/setstudio.ts
💤 Files with no reviewable changes (1)
- pages/api/workspace/[id]/settings/activity/setIdleTime.ts
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
New Features
Bug Fixes
UI Improvements