Anirudh/hot fix

[AnirudhAP2k]

User description

Description

• feat(rate-limit): add lightweight fixed-window rate limiter

• test(rate-limit): add unit tests for rate limiter

• docs(rules): update code-review-expert checklist and rule guidelines

• fix(upload): add auth check and exclude svg from image uploads

• fix(ai-service): add container origin to CORS allowed origins

• fix(ai-service): switch tenant api key hashing to sha256 constant time compare

• chore(ai-service): remove unused bcrypt dependency

• feat(ai-planner): add navigation link to organization pitches

• feat(pitches): add organization pitch detail page

• feat(pitches): add organization pitches listing page

• fix(ai): add organization permission check to brainstorm brief route

• fix(ai): add organization permission check to brainstorm message route

• fix(auth): enforce rate limiting on login endpoint

• fix(auth): enforce rate limiting on password reset endpoint

• fix(auth): enforce rate limiting on registration endpoint

• fix(auth): sanitize returnTo parameter to prevent open redirect vulnerabilities

• fix(org-documents): restrict document fetching to owner and admin roles

• fix(organizations): enforce organization id matching on member updates and removals

• fix(dashboard): remove caller user id requirement from pitch review component

• feat(brainstorm): add pitch list navigation link to brainstorm chat

• fix(pitches): derive user identity from session in pitch brief modal

• feat(pitches): add pitch detail view component

• fix(docker): update service network urls in dev compose

• fix(docker): update nextjs service url configuration in production compose

• docs(review): add code review documentation report

• fix(events): require owner or admin role for event creation

• fix(pitches): authenticate pitch actions using server session

• refactor(pitches): remove proposedById from create pitch input interface

• refactor(pitches): remove proposedById from create pitch schema

• feat(docker): enable pgvector extension and indexes on startup

• fix(lv-service): authorize event participant or host access for rooms

• fix(next): add import-in-the-middle to transpilePackages

• fix(package): add import-in-the-middle pnpm override

• fix(ws-service): authorize room membership for virtual event websocket events

• test(events): add unit tests for event actions authorization

• test(pitches): add unit tests for pitch actions authorization

---

PR Type

Bug fix, Enhancement, Security, Tests, Configuration changes

---

Description

• Enforce server session identity across event pitches to prevent IDOR vulnerabilities.
  • Implement fixed-window rate limiting for login, registration, and password reset endpoints.
  • Secure microservice and API routes with proper organization membership and permission checks.
  • Fix AI service tenant API key hashing using SHA-256 constant-time comparison.

---

Diagram Walkthrough

flowchart LR
 Client -- "HTTP / WS Requests" --> NextJS["Next.js App / BFF"]
 NextJS -- "Session Auth / Rate Limit" --> SecurityLayer["Security Middleware & Rate Limiter"]
 SecurityLayer -- "Validated Actions" --> DomainLayer["Domain Domain Actions"]
 DomainLayer -- "Prisma / DB" --> PostgreSQL[(PostgreSQL DB)]
 DomainLayer -- "Secure JWT / Master Key" --> Microservices["Microservices (AI / WS / LiveKit)"]

Loading

File Walkthrough

	Relevant files
Enhancement	6 files PitchDetailView.tsx Add interactive event pitch detail and editing view component +482/-0  page.tsx Add organization pitches listing page with role-based review views +150/-0  rate-limit.ts Implement lightweight fixed-window rate limiter and IP resolver +80/-0    BrainstormChat.tsx Add navigation link to user pitches from brainstorm chat  +8/-1      page.tsx Add view my pitches link to AI event brainstorming header +8/-1      page.tsx Add server-rendered organization pitch detail page route  +56/-0
Tests	3 files pitches-actions.test.ts Add comprehensive unit tests for pitch server actions        +332/-0  events-actions.test.ts Add unit tests for event creation membership and verification checks +179/-0  rate-limit.test.ts Add unit tests for the fixed-window rate limiter                  +102/-0
Bug fix	16 files actions.ts Enforce server session identity in pitch server actions    +31/-11  virtual-event.ts Add database-backed authorization check for virtual room presence +51/-6    PitchBriefModal.tsx Remove client-supplied user ID from pitch creation modal payload +4/-7      AdminPitchReview.tsx Remove admin user ID parameter from pitch review action calls +6/-6      upload.actions.ts Add server session authentication check to file upload action +14/-2    rooms.ts Restrict virtual room listing to event participants and organization hosts +28/-1    route.ts Enforce rate limiting on login endpoint against brute-force attacks +13/-0    route.ts Add organization membership permission check to brainstorm message route +7/-0      route.ts Add organization membership permission check to brainstorm brief route +7/-0      route.ts Enforce organization ID matching on member updates and removals +10/-0    route.ts Sanitize returnTo parameter to prevent open redirect vulnerabilities +17/-1    route.ts Restrict KYB document fetching to organization owner and admin roles +9/-0      actions.ts Require organization owner or admin role for event creation +14/-0    route.ts Enforce rate limiting on password reset endpoint                  +13/-0    route.ts Enforce rate limiting on registration endpoint                      +13/-0    auth.py Switch tenant API key verification to SHA-256 constant-time comparison +9/-5
Configuration changes	4 files next.config.ts Add import-in-the-middle to transpilePackages configuration +1/-0      config.py Add container origin host to CORS allowed origins                +1/-1      entrypoint.sh Enable pgvector extension and indexes during startup          +3/-0      compose.yaml Update service network environment URLs in production compose setup +8/-1
Documentation	2 files code_review_2026_07_22.md Add comprehensive platform code review report and audit follow-up +260/-0  code-review-expert.md Update code review expert prompt rules and checklist context +160/-2
Dependencies	1 files package.json Add pnpm overrides for import-in-the-middle package version +7/-4
Additional files	4 files requirements.txt +0/-2      compose.dev.yaml +14/-1    types.ts +0/-1      validation.ts +0/-1

---

[github-actions]

PR Reviewer Guide 🔍

(Review updated until commit 3f418c0)

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪

🧪 PR contains tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Security Design Flaw The login rate limiter is keyed by both IP and email combined (login:${ip}:${email}). This allows an attacker to perform credential stuffing by testing many different email addresses from a single IP (since each email gets its own quota of 10 attempts), or targeted brute-force on a single email by rotating IPs. Consider implementing separate rate limits: one per IP (to prevent credential stuffing) and one per email (to prevent targeted brute-force). const limit = rateLimit(`login:${getClientIp(req)}:${email.toLowerCase()}`, { limit: 10, windowMs: 15 * 60 * 1000, }); if (!limit.success) { return NextResponse.json( { error: "Too many login attempts. Please try again later." }, { status: 429, headers: { "Retry-After": String(limit.retryAfter) } } ); }

[github-actions]

PR Code Suggestions ✨

No code suggestions found for the PR.

[github-actions]

Persistent review updated to latest commit 3f418c0

[AnirudhAP2k]

🎉 This PR is included in version 1.24.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀