feat: disable public signup toggle and react sdk prop - #337
Conversation
|
Warning Review limit reached
More reviews will be available in 38 minutes and 35 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more credits in the billing tab to continue. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate. For paid Pro and Pro+ PR reviews, CodeRabbit uses rolling per-developer review limits. Reviews become available again as older review attempts age out of the rolling limit window. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (8)
📝 WalkthroughWalkthroughAdds an ChangesPublic Signup Toggle
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 6
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/dashboard-api/src/controllers/project.controller.js`:
- Around line 2565-2583: The response in this handler does not follow the
standard API envelope format and exposes internal error details. Refactor the
success response to use the standardized envelope with success: true, a data
object containing the project information and allowPublicSignup flag, and an
appropriate message field. For the error handling in the catch block, replace
the direct res.status(500).json({ error: err.message }) call with proper
AppError class usage that handles errors securely without exposing raw error
messages to clients, following the controller's contract of returning { success:
bool, data: {}, message: "" } format.
- Around line 2559-2568: The code currently uses `!!enable` to coerce the
request body value to a boolean, which silently treats invalid or missing values
as false and can unintentionally disable public signup. Instead of using the
coercion operator, explicitly validate that the enable parameter from req.body
is a boolean type. If it is not a boolean, return a 400 status code with an
appropriate error message. Only assign the validated boolean value directly to
project.allowPublicSignup without any coercion.
In `@apps/public-api/src/controllers/userAuth.controller.js`:
- Around line 620-624: Replace the raw Error object being thrown in the signup
gate check (the if block where `project.allowPublicSignup === false`) with an
AppError instance instead, passing the same "Public signup is disabled for this
project. Only existing users can log in." message and 403 status code. This will
ensure consistency with the controller's error handling requirements and the
established AppError usage pattern throughout the file, so that the response
format returned will conform to the required `{ success: bool, data: {},
message: "" }` structure.
In `@apps/web-dashboard/src/pages/Auth.jsx`:
- Around line 151-159: The handleTogglePublicSignup function is missing
protection against race conditions and unauthorized access. Add an in-flight
state variable to track pending requests and guard the function to prevent
execution if a request is already in progress or if the user is a viewer. In the
function body, check both the in-flight state and user role (isViewer) before
making the API call, setting the loading state before the request and clearing
it in both success and error handlers. Also disable the public signup toggle
control in the UI when either the in-flight state is true or the user is a
viewer. Apply this same pattern to the similar function at lines 377-382.
In `@sdks/urbackend-react/src/components/UrAuth.tsx`:
- Around line 199-200: The variable `showSwitcher` is declared twice using const
in the same scope in the UrAuth component, causing a redeclaration error. Remove
the duplicate `showSwitcher` declaration (the second one at line 211) and keep
only the first declaration at line 200 which assigns the value based on
`hasPasswordAuth && !hideSignup`. This will resolve the block-scoped
redeclaration error and allow the code to compile successfully.
- Around line 199-200: The hideSignup prop is only being enforced for the top
switcher via the showSwitcher variable, but the footer button that toggles mode
to signup is not respecting this prop. Apply the same hideSignup condition to
the footer button toggle (where it toggles mode to signup in the footer area) so
that when hideSignup is true, users cannot access signup through either the top
switcher or the footer button, ensuring the prop is fully enforced throughout
the component.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 0dd73f2a-9d05-4a6d-8299-8481f893dac6
📒 Files selected for processing (7)
apps/dashboard-api/src/__tests__/routes.projects.storage.test.jsapps/dashboard-api/src/controllers/project.controller.jsapps/dashboard-api/src/routes/projects.jsapps/public-api/src/controllers/userAuth.controller.jsapps/web-dashboard/src/pages/Auth.jsxpackages/common/src/models/Project.jssdks/urbackend-react/src/components/UrAuth.tsx
|
ok to merge? |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
# Check PR status, reviews, and open comments
gh pr view 337 --repo geturbackend/urBackend --json state,reviewDecision,mergeable,statusCheckRollup,reviews,comments
# Check review comments (inline code comments)
gh api repos/geturbackend/urBackend/pulls/337/comments --jq '[.[] | {id, user: .user.login, body: .body, resolved: .resolved}]' 2>/dev/null | head -200
# Check open review threads
gh api repos/geturbackend/urBackend/pulls/337/reviews --jq '[.[] | {id, user: .user.login, state, body}]' 2>/dev/nullLength of output: 40726
The PR is mergeable. 🐰 |
Render
Destroyed
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Workflows to automatically generate PRs for you. |
Disable Public Signup Toggle
Backend: Added the allowPublicSignup field to the project schema. The /api/projects/:projectId/auth/public-signup endpoint now allows toggling this setting.
Enforcement: Updated the signup and OAuth callback methods in userAuth.controller.js to immediately block new users with a 403 error if allowPublicSignup is false. Existing users can still log in fine.
Dashboard UI: Added a beautiful toggle under the "Settings" section on the Authentication page (Auth.jsx).
React SDK hideSignup Prop
Added an optional hideSignup?: boolean prop to inside @urbackend/react.
When set to true, the "Sign Up" tab on the authentication widget is completely hidden, and it defaults to the signin mode.
Summary by CodeRabbit