feat(platform-notifications): PR Fixes

Author: 0ski

apps/webapp/app/components/navigation/NotificationPanel.tsx

@@ -262,13 +262,26 @@ function NotificationCard({
         </div>
 
         {image && (
-          <img src={image} alt="" className="mt-1.5 rounded" />
+          <img src={sanitizeImageUrl(image)} alt="" className="mt-1.5 rounded" />
         )}
       </div>
     </Wrapper>
   );
 }
 
+/** Sanitize image URL to prevent XSS via javascript: or data: URIs. */
+function sanitizeImageUrl(url: string): string {
+  try {
+    const parsed = new URL(url);
+    if (parsed.protocol === "https:" || parsed.protocol === "http:") {
+      return parsed.href;
+    }
+    return "";
+  } catch {
+    return "";
+  }
+}
+
 function getMarkdownComponents(onLinkClick: () => void) {
   return {
     p: ({ children }: { children?: React.ReactNode }) => (
@@ -280,7 +293,10 @@ function getMarkdownComponents(onLinkClick: () => void) {
         target="_blank"
         rel="noopener noreferrer"
         className="text-indigo-400 underline hover:text-indigo-300 transition-colors"
-        onClick={onLinkClick}
+        onClick={(e) => {
+          e.stopPropagation();
+          onLinkClick();
+        }}
       >
         {children}
       </a>

apps/webapp/app/routes/admin.api.v1.platform-notifications.ts

@@ -42,7 +42,12 @@ export async function action({ request }: ActionFunctionArgs) {
     return json({ error: message }, { status });
   }
 
-  const body = await request.json();
+  let body: unknown;
+  try {
+    body = await request.json();
+  } catch {
+    return json({ error: "Invalid JSON body" }, { status: 400 });
+  }
   const result = await createPlatformNotification(body as CreatePlatformNotificationInput);
 
   if (result.isErr()) {

apps/webapp/app/routes/admin.notifications.tsx

@@ -712,9 +712,8 @@ function NotificationPreviewCard({
           )}
         </div>
 
-        {/* lgtm[js/xss-through-dom] React JSX sets src via setAttribute, not raw HTML interpolation — safe from XSS */}
         {image && (
-          <img src={image} alt="" className="mt-1.5 rounded px-2 pb-2" />
+          <img src={sanitizeImageUrl(image)} alt="" className="mt-1.5 rounded px-2 pb-2" />
         )}
       </div>
     </Wrapper>
@@ -793,6 +792,19 @@ function defaultEndsAt(): string {
   return toDatetimeLocalUTC(new Date(Date.now() + 30 * 24 * 60 * 60 * 1000));
 }
 
+/** Sanitize image URL to prevent XSS via javascript: or data: URIs. */
+function sanitizeImageUrl(url: string): string {
+  try {
+    const parsed = new URL(url);
+    if (parsed.protocol === "https:" || parsed.protocol === "http:") {
+      return parsed.href;
+    }
+    return "";
+  } catch {
+    return "";
+  }
+}
+
 type NotificationStatus = "active" | "pending" | "expired" | "archived";
 
 function getNotificationStatus(n: {

apps/webapp/app/routes/resources.platform-notifications.tsx

@@ -34,13 +34,13 @@ const POLL_INTERVAL_MS = 60000; // 1 minute
 
 export function usePlatformNotifications(organizationId: string, projectId: string) {
   const fetcher = useFetcher<typeof loader>();
-  const hasInitiallyFetched = useRef(false);
+  const lastLoadedUrl = useRef<string | null>(null);
 
   useEffect(() => {
     const url = `/resources/platform-notifications?organizationId=${encodeURIComponent(organizationId)}&projectId=${encodeURIComponent(projectId)}`;
 
-    if (!hasInitiallyFetched.current && fetcher.state === "idle") {
-      hasInitiallyFetched.current = true;
+    if (lastLoadedUrl.current !== url && fetcher.state === "idle") {
+      lastLoadedUrl.current = url;
       fetcher.load(url);
     }
 

apps/webapp/app/services/platformNotificationCounter.server.ts

@@ -0,0 +1,45 @@
+import { Redis } from "ioredis";
+import { env } from "~/env.server";
+import { singleton } from "~/utils/singleton";
+import { logger } from "./logger.server";
+
+const KEY_PREFIX = "cli-notif-ctr:";
+const MAX_COUNTER = 1000;
+
+function initializeRedis(): Redis | undefined {
+  const host = env.CACHE_REDIS_HOST;
+  if (!host) return undefined;
+
+  return new Redis({
+    connectionName: "platformNotificationCounter",
+    host,
+    port: env.CACHE_REDIS_PORT,
+    username: env.CACHE_REDIS_USERNAME,
+    password: env.CACHE_REDIS_PASSWORD,
+    keyPrefix: "tr:",
+    enableAutoPipelining: true,
+    ...(env.CACHE_REDIS_TLS_DISABLED === "true" ? {} : { tls: {} }),
+  });
+}
+
+const redis = singleton("platformNotificationCounter", initializeRedis);
+
+/** Increment and return the user's CLI request counter (0-based, wraps at 1000→0). */
+export async function incrementCliRequestCounter(userId: string): Promise<number> {
+  if (!redis) return 0;
+
+  try {
+    const key = `${KEY_PREFIX}${userId}`;
+    const value = await redis.incr(key);
+
+    if (value > MAX_COUNTER) {
+      await redis.set(key, "0");
+      return 0;
+    }
+
+    return value;
+  } catch (error) {
+    logger.error("Failed to increment CLI notification counter", { userId, error });
+    return 0;
+  }
+}

apps/webapp/app/services/platformNotifications.server.ts

@@ -2,13 +2,15 @@ import { z } from "zod";
 import { errAsync, fromPromise, type ResultAsync } from "neverthrow";
 import { prisma } from "~/db.server";
 import { type PlatformNotificationScope, type PlatformNotificationSurface } from "@trigger.dev/database";
+import { incrementCliRequestCounter } from "./platformNotificationCounter.server";
 
 // --- Payload schema (spec v1) ---
 
 const DiscoverySchema = z.object({
   filePatterns: z.array(z.string().min(1)).min(1),
   contentPattern: z
     .string()
+    .max(200)
     .optional()
     .refine(
       (val) => {
@@ -275,6 +277,9 @@ export async function recordNotificationClicked({
 // --- Read: recent changelogs (for Help & Feedback) ---
 
 export async function getRecentChangelogs({ limit = 2 }: { limit?: number } = {}) {
+  // NOTE: Intentionally not filtering by archivedAt, startsAt, or endsAt.
+  // We want to show archived and expired changelogs in the "What's new" section
+  // so users can still find recent release notes.
   const notifications = await prisma.platformNotification.findMany({
     where: {
       surface: "WEBAPP",
@@ -398,6 +403,11 @@ export async function getNextCliNotification({
 
   const sorted = [...notifications].sort(compareNotifications);
 
+  // Global per-user request counter stored in Redis, used for cliShowEvery modulo.
+  // This is independent of per-notification showCount so that cliMaxShowCount
+  // correctly tracks actual displays, not API encounters.
+  const requestCounter = await incrementCliRequestCounter(userId);
+
   for (const n of sorted) {
     const interaction = n.interactions[0] ?? null;
 
@@ -407,6 +417,12 @@ export async function getNextCliNotification({
     const parsed = PayloadV1Schema.safeParse(n.payload);
     if (!parsed.success) continue;
 
+    // Check cliShowEvery using the global request counter
+    if (n.cliShowEvery !== null && requestCounter % n.cliShowEvery !== 0) {
+      continue;
+    }
+
+    // Only increment showCount when the notification will actually be displayed
     const updated = await prisma.platformNotificationInteraction.upsert({
       where: { notificationId_userId: { notificationId: n.id, userId } },
       update: { showCount: { increment: 1 } },
@@ -418,11 +434,6 @@ export async function getNextCliNotification({
       },
     });
 
-    // If cliShowEvery is set, only return on every N-th request
-    if (n.cliShowEvery !== null && updated.showCount % n.cliShowEvery !== 0) {
-      continue;
-    }
-
     return {
       id: n.id,
       payload: parsed.data,
@@ -471,7 +482,9 @@ export const CreatePlatformNotificationSchema = z
   .superRefine((data, ctx) => {
     validateScopeForeignKeys(data, ctx);
     validateSurfaceFields(data, ctx);
+    validatePayloadTypeForSurface(data, ctx);
     validateStartsAt(data, ctx);
+    validateEndsAt(data, ctx);
   });
 
 function validateScopeForeignKeys(
@@ -535,6 +548,34 @@ function validateStartsAt(data: { startsAt?: Date }, ctx: z.RefinementCtx) {
   }
 }
 
+const CLI_TYPES = new Set(["info", "warn", "error", "success"]);
+const WEBAPP_TYPES = new Set(["card", "changelog"]);
+
+function validatePayloadTypeForSurface(
+  data: { surface: string; payload: PayloadV1 },
+  ctx: z.RefinementCtx
+) {
+  const allowedTypes = data.surface === "CLI" ? CLI_TYPES : WEBAPP_TYPES;
+  if (!allowedTypes.has(data.payload.data.type)) {
+    ctx.addIssue({
+      code: "custom",
+      message: `payload.data.type "${data.payload.data.type}" is not allowed for ${data.surface} surface`,
+      path: ["payload", "data", "type"],
+    });
+  }
+}
+
+function validateEndsAt(data: { startsAt?: Date; endsAt: Date }, ctx: z.RefinementCtx) {
+  const effectiveStart = data.startsAt ?? new Date();
+  if (data.endsAt <= effectiveStart) {
+    ctx.addIssue({
+      code: "custom",
+      message: "endsAt must be after startsAt",
+      path: ["endsAt"],
+    });
+  }
+}
+
 export type CreatePlatformNotificationInput = z.input<typeof CreatePlatformNotificationSchema>;
 
 type CreateError =

packages/cli-v3/src/utilities/discoveryCheck.ts

@@ -126,6 +126,21 @@ async function checkContentPattern(
 ): Promise<boolean> {
   const useFastPath = !REGEX_METACHARACTERS.test(contentPattern);
 
+  // Pre-compile regex once outside the loop to avoid repeated compilation
+  // and to catch invalid patterns early
+  let regex: RegExp | undefined;
+  if (!useFastPath) {
+    try {
+      regex = new RegExp(contentPattern);
+    } catch (error) {
+      logger.debug("Discovery: invalid regex pattern, skipping content check", {
+        contentPattern,
+        error,
+      });
+      return false;
+    }
+  }
+
   logger.debug("Discovery: checking content pattern", {
     contentPattern,
     useFastPath,
@@ -140,9 +155,7 @@ async function checkContentPattern(
       continue;
     }
 
-    const matches = useFastPath
-      ? content.includes(contentPattern)
-      : new RegExp(contentPattern).test(content);
+    const matches = useFastPath ? content.includes(contentPattern) : regex!.test(content);
 
     logger.debug("Discovery: content check result", { filePath, matches });
 

packages/cli-v3/src/utilities/platformNotifications.ts

@@ -95,26 +95,32 @@ export async function awaitAndDisplayPlatformNotification(
 ): Promise<void> {
   if (!notificationPromise) return;
 
-  // Race against a short delay — if the promise resolves quickly, skip the spinner
-  const pending = Symbol("pending");
-  const raceResult = await Promise.race([
-    notificationPromise,
-    new Promise<typeof pending>((resolve) => setTimeout(() => resolve(pending), SPINNER_DELAY_MS)),
-  ]);
-
-  if (raceResult !== pending) {
-    displayPlatformNotification(raceResult);
-    return;
-  }
+  try {
+    // Race against a short delay — if the promise resolves quickly, skip the spinner
+    const pending = Symbol("pending");
+    const raceResult = await Promise.race([
+      notificationPromise,
+      new Promise<typeof pending>((resolve) =>
+        setTimeout(() => resolve(pending), SPINNER_DELAY_MS)
+      ),
+    ]);
+
+    if (raceResult !== pending) {
+      displayPlatformNotification(raceResult);
+      return;
+    }
 
-  // Still pending after delay — show a spinner while waiting
-  const $spinner = spinner();
-  $spinner.start("Checking for notifications");
-  const notification = await notificationPromise;
+    // Still pending after delay — show a spinner while waiting
+    const $spinner = spinner();
+    $spinner.start("Checking for notifications");
+    const notification = await notificationPromise;
 
-  if (notification) {
-    $spinner.stop(formatNotificationMessage(notification));
-  } else {
-    $spinner.stop("No new notifications");
+    if (notification) {
+      $spinner.stop(formatNotificationMessage(notification));
+    } else {
+      $spinner.stop("No new notifications");
+    }
+  } catch (error) {
+    logger.debug("Platform notification display failed silently", { error });
   }
 }