You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Publishing unused Capgo cloud edge functions is an infra abuse risk. Console and new CLI can talk to Cloudflare directly; old CLIs still hit Supabase invoke for a few endpoints, so those stay published for ~3 months.
Business Impact (AI generated)
Fewer Capgo cloud Supabase functions to operate and attack, without breaking existing customer CLIs during the upgrade window. Self-host full deploy is unchanged.
Test Plan (AI generated)
Console: open API keys, webhooks, Stripe portal/checkout, org invites, password compliance — confirm requests go to api.capgo.app, not sb.capgo.app/functions/v1
CLI latest: bundle upload, channel set/delete, upload link / delete failed version / set manifest against Capgo cloud
CLI with --supa-host / self-host: same flows still hit /functions/v1
Capgo cloud deploy only publishes allowlisted functions (bun scripts/supabase-cloud-functions.ts list)
Unit: bunx vitest run tests/supabase-cloud-functions.unit.test.ts
After 2026-10-28: remove bundle/channel/files/private from the allowlist and delete Capgo cloud Supabase deployments
Capgo cloud traffic already runs on Cloudflare Workers; only `triggers`
must stay on Supabase for pg_net queue_consumer. Keep full deploy for
self-hosting.
Co-authored-by: Cursor <cursoragent@cursor.com>
supabase.functions.invoke always uses SUPABASE_URL, so console/CLI still
need private, apikey, app, bundle, channel, files, organization,
statistics, and webhooks published alongside triggers.
Co-authored-by: Cursor <cursoragent@cursor.com>
Stop Capgo cloud console traffic on sb.capgo.app edge functions by calling
api.capgo.app instead. Migrate CLI the same way while keeping
bundle/channel/files/private published until 2026-10-28 for older CLIs.
Co-authored-by: Cursor <cursoragent@cursor.com>
Your recent review volume is higher than typical usage, so adaptive limits are currently applied.
Next review available in:3 minutes
Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).
How can I continue?
After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.
To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.
How do review limits work?
CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.
For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.
Reviewing files that changed from the base of the PR and between a3c0cae and 548d2fc.
📒 Files selected for processing (18)
.github/workflows/build_and_deploy.yml
README.md
cli/src/utils.ts
cloudflare_workers/api/index.ts
package.json
scripts/supabase-cloud-functions.ts
src/components/dashboard/AppOnboardingFlow.vue
src/components/dashboard/Usage.vue
src/pages/onboarding/organization.vue
src/services/apikeys.ts
src/services/capgoApi.ts
src/services/chartDataService.ts
src/services/emailOtp.ts
src/utils/invites.ts
src/utils/onboardingAppCreateHelpers.ts
tests/apikeys-service.unit.test.ts
tests/capgo-api-error-code.unit.test.ts
tests/supabase-cloud-functions.unit.test.ts
📝 Walkthrough
Walkthrough
The PR adds allowlisted Supabase function deployment with cleanup, introduces cloud/self-hosted Capgo API routing for the CLI, and migrates frontend Supabase Edge Function calls to shared Capgo API services with updated tests.
Changes
Capgo API and deployment routing
Layer / File(s)
Summary
Allowlisted Supabase function publishing .github/workflows/build_and_deploy.yml, scripts/supabase-cloud-functions.ts, package.json, README.md, tests/supabase-cloud-functions.unit.test.ts
Cloud deployments now select allowlisted functions, reject empty lists, remove skipped functions, and document distinct cloud and self-hosted procedures.
CLI API routing and upload integration cli/src/utils.ts, cli/src/bundle/upload.ts, cli/src/channel/*
CLI requests use shared API invocation logic with cloud, files, or self-hosted endpoint resolution, while upload, channel, rollout, manifest, and cleanup flows forward credentials and connection settings.
Frontend operations replace direct Supabase function calls with invokeCapgoApi or service wrappers, preserving request payloads, methods, response handling, and error flows. Tests mock the new API boundary.
Default invoke helpers to any like supabase.functions.invoke and tighten
the few call sites that still need explicit shapes for typecheck.
Co-authored-by: Cursor <cursoragent@cursor.com>
log-as and apikeys unit tests still stubbed supabase.functions.invoke after
the Cloudflare helper migration; point them at invokeCapgoApi instead.
Co-authored-by: Cursor <cursoragent@cursor.com>
Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.
Keep unread error bodies for FunctionsHttpError, support anonymous invite
bootstrap, fall back to /functions/v1 for self-host consoles, fix CLI auth
and Capgo-managed --supa-host routing, and make Capgo cloud deploy fail
closed plus delete non-allowlisted functions.
Co-authored-by: Cursor <cursoragent@cursor.com>
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: high. Left a non-blocking comment — Cursor Bugbot completed as skipped, so it is not a clean approval signal, and this PR changes console/CLI API routing plus Capgo cloud function publish allowlists (auth, billing, and deploy surface). Assigning reviewers for human review; no approval from this run.
Sent by Cursor Approval Agent: Pull Request Approver
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: high. Left a non-blocking comment — Cursor Bugbot did not complete successfully (skipped due to usage limit), and this PR is above the low-risk approval threshold given broad console/CLI API routing and deploy-surface changes. Assigned reviewers for human review.
Sent by Cursor Approval Agent: Pull Request Approver External
Route setChannelDeviceOverride through invokeCapgoApi.
Self-host/local consoles route API calls through Supabase /functions/v1, but this flow still posts channel_device directly to VITE_API_HOST, bypassing that fallback and potentially sending the override request to Capgo Cloud. Migrate this call to invokeCapgoApi and handle its returned error.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/pages/app/`[app].channel.[channel].devices.vue around lines 119 - 176,
Update setChannelDeviceOverride to call invokeCapgoApi for
private/channel_device instead of fetch against defaultApiHost, preserving the
existing app, channel, and device request fields. Handle the returned error in
customDeviceOverwritePart5 through the existing overwrite-error path, and remove
the direct session/JWT and HTTP response handling.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@cli/src/utils.ts`:
- Around line 792-862: Update invokeCapgoCliApi to reuse the result of
getRemoteConfig(true) across calls during the CLI process, while preserving
explicit supaHost/supaAnon behavior and avoiding stale configuration beyond that
process. Review the non-functions/v1 Authorization construction in
invokeCapgoCliApi against the Cloudflare API contract; use the required Bearer
format if the API validates Authorization, otherwise retain raw-key behavior
only when capgkey is intentionally the sole credential and ensure the
implementation reflects that contract.
- Around line 748-757: Validate the --supa-host value centrally before routing
or invoking the API, using isCapgoManagedSupabaseHost and the existing
host-normalization flow where appropriate. Reject malformed or unsupported hosts
with a clear CLI-facing error that states the required URL format, and ensure
this validation occurs inside invokeCapgoCliApi()’s error-handling path so raw
“Invalid URL” TypeErrors do not escape.
In `@package.json`:
- Around line 187-188: Make Supabase stale-function cleanup fail closed: in
package.json lines 187-188, remove unconditional success masking from
deploy:supabase:prod and deploy:supabase:preprod, ignoring deletion errors only
when the function is confirmed missing; in
.github/workflows/build_and_deploy.yml lines 97-109, ensure cleanup failures
propagate and fail the workflow rather than being masked; in README.md lines
467-470, document the full cleanup-aware deployment procedure or explicitly
state that the alternate command does not remove stale functions.
In `@README.md`:
- Around line 80-83: Correct the console/CLI routing description in the README
paragraph: limit SUPABASE_URL routing to self-hosted deployments and legacy CLI
compatibility through October 28, 2026. State that the migrated Capgo Cloud
console uses VITE_API_HOST and the new CLI uses Capgo API hosts, while
preserving the existing Supabase function and pg_net context.
In `@src/components/dashboard/AppOnboardingFlow.vue`:
- Around line 644-648: Update the organization-creation error handling in the
unified onboarding flow around the `if (error || !data?.id)` block to read the
duplicate-name code from the HTTP error body by parsing the `FunctionsHttpError`
response in `error.context` before checking for `23505`. Use the parsed body
code for the `org-with-this-name-exists` toast, while preserving the generic
`cannot-create-org` fallback.
In `@src/services/apikeys.ts`:
- Line 68: Update each invokeCapgoApi call in src/services/apikeys.ts:68-68 and
124-124, src/services/chartDataService.ts:39-39, src/utils/invites.ts:44-44, and
src/utils/onboardingAppCreateHelpers.ts:124-124 to pass the caller-supplied
Supabase client/context, preserving injected client, session, and configuration
behavior instead of resolving the global client.
In `@src/services/capgoApi.ts`:
- Line 4: Update the method type declaration to use the repository’s accepted
single-quote style for all HTTP method literals, without changing the allowed
values or optional property behavior.
In `@src/services/emailOtp.ts`:
- Around line 52-54: Update the invokeCapgoApi call in the email OTP
verification flow to pass allowAnonymous: true, preserving unauthenticated
access while keeping the existing token sanitization and
private/verify_email_otp endpoint unchanged.
In `@tests/apikeys-service.unit.test.ts`:
- Around line 32-40: Remove the concurrent modifier from the “creates a member
key with only the selected app bindings” test so it runs as a standard
sequential test, preserving the shared hoisted mocks and beforeEach resets.
In `@tests/supabase-cloud-functions.unit.test.ts`:
- Around line 39-41: Extend the existing buildCapgoCloudSupabaseDeployArgs test
coverage to assert that passing an empty array throws, preserving the
fail-closed guard while retaining the explicit-list expectation.
---
Outside diff comments:
In `@src/pages/app/`[app].channel.[channel].devices.vue:
- Around line 119-176: Update setChannelDeviceOverride to call invokeCapgoApi
for private/channel_device instead of fetch against defaultApiHost, preserving
the existing app, channel, and device request fields. Handle the returned error
in customDeviceOverwritePart5 through the existing overwrite-error path, and
remove the direct session/JWT and HTTP response handling.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
Push a commit to this branch (recommended)
Create a new PR with the fixes
ℹ️ Review info⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 24a10173-2a16-4ac1-8f48-d066b11fe8a1
📥 Commits
Reviewing files that changed from the base of the PR and between 622efa9 and a3c0cae.
📒 Files selected for processing (39)
.github/workflows/build_and_deploy.yml
README.md
cli/src/bundle/upload.ts
cli/src/channel/delete.ts
cli/src/channel/set.ts
cli/src/utils.ts
package.json
scripts/supabase-cloud-functions.ts
src/components/dashboard/AppAccess.vue
src/components/dashboard/AppOnboardingFlow.vue
src/components/dashboard/AppSetting.vue
src/components/dashboard/InviteTeammateModal.vue
src/components/dashboard/StepsApp.vue
src/components/dashboard/Usage.vue
src/components/permissions/ChannelAccessPanel.vue
src/components/tables/AccessTable.vue
src/pages/ApiKeys.vue
src/pages/app/[app].channel.[channel].devices.vue
src/pages/invitation.vue
src/pages/onboarding/organization.vue
src/pages/settings/account/ChangePassword.vue
src/pages/settings/account/ManageTwoFactor.vue
src/pages/settings/organization/Members.vue
src/pages/settings/organization/Plans.vue
src/pages/settings/organization/Security.vue
src/pages/settings/organization/index.vue
src/services/apikeys.ts
src/services/capgoApi.ts
src/services/chartDataService.ts
src/services/emailOtp.ts
src/services/logAs.ts
src/services/stripe.ts
src/services/supabase.ts
src/stores/webhooks.ts
src/utils/invites.ts
src/utils/onboardingAppCreateHelpers.ts
tests/apikeys-service.unit.test.ts
tests/log-as-service.unit.test.ts
tests/supabase-cloud-functions.unit.test.ts
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: high. Left a non-blocking comment — Cursor Bugbot completed as skipped on this sync, and this PR exceeds the low-risk approval threshold (console/CLI API routing plus Capgo cloud deploy allowlist changes). Reviewers are already assigned; no approval from this run.
Sent by Cursor Approval Agent: Pull Request Approver External
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: high. Left a non-blocking comment — Cursor Bugbot did not complete successfully on this commit (skipped/neutral), and unresolved Bugbot findings remain on this broad console/CLI API-routing and deploy-surface change. Reviewers are already assigned; no additional reviewers added.
Sent by Cursor Approval Agent: Pull Request Approver
The reason will be displayed to describe this comment to others. Learn more.
1 issue found across 10 files (changes from recent commits).
Confidence score: 2/5
In src/services/capgoApi.ts, the host check is too permissive (includes-style), so self-hosted domains that merely contain a managed hostname can be misrouted to VITE_API_HOST, causing bearer tokens to be sent to the wrong backend; this is a concrete auth/security regression risk for affected tenants — compare parsed hostnames for exact equality and keep non-managed hosts on /functions/v1.
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="src/services/capgoApi.ts">
<violation number="1" location="src/services/capgoApi.ts:19">
P1: Self-hosts whose domain merely contains a managed hostname are routed to `VITE_API_HOST` and their session bearer token is sent there instead of `/functions/v1`. Match parsed hostnames exactly so only Capgo-managed Supabase origins use the Cloudflare path.</violation>
</file>
Tip: Review your code locally with the cubic CLI to iterate faster.
Mount role_bindings and website_preview on the Cloudflare API worker, match
Capgo-managed Supabase hosts by exact hostname, fix app stats query URLs,
allow anonymous OTP verify, parse org duplicate errors from HTTP bodies, and
make Capgo cloud function cleanup fail closed.
Co-authored-by: Cursor <cursoragent@cursor.com>
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: high. Left a non-blocking comment — Cursor Bugbot did not complete successfully (skipped) and still has an unresolved finding on this broad console/CLI API-routing and Capgo cloud deploy-surface change. Reviewers are already assigned; no approval from this run.
Sent by Cursor Approval Agent: Pull Request Approver
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: high. Left a non-blocking comment — Cursor Bugbot completed as skipped/neutral with an unresolved finding, and this PR exceeds the low-risk approval threshold (console/CLI API routing plus Capgo cloud deploy allowlist). Reviewers are already assigned; no approval from this run.
Sent by Cursor Approval Agent: Pull Request Approver External
Only cache successful /private/config responses so transient failures can
recover, and stop sending anon JWT to verify_email_otp which rejects it.
Co-authored-by: Cursor <cursoragent@cursor.com>
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: high. Left a non-blocking comment — Cursor Bugbot completed successfully with no open findings, but this PR exceeds the medium approval threshold (broad console/CLI API routing plus Capgo cloud deploy allowlist). Reviewers are already assigned; no approval from this run.
Sent by Cursor Approval Agent: Pull Request Approver
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: high. Left a non-blocking comment — Cursor Bugbot completed successfully with no open findings, but this PR exceeds the low-risk approval threshold (broad console/CLI API routing plus Capgo cloud deploy allowlist). Reviewers are already assigned; no approval from this run.
Sent by Cursor Approval Agent: Pull Request Approver External
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: high. Left a non-blocking comment — Cursor Bugbot completed as skipped on this sync and still has an unresolved finding, and this PR exceeds the low-risk approval threshold (broad console/CLI API routing plus Capgo cloud deploy allowlist). Reviewers are already assigned; no approval from this run.
Sent by Cursor Approval Agent: Pull Request Approver External
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: high. Left a non-blocking comment — Cursor Bugbot completed as skipped/neutral with an unresolved finding, and this PR exceeds the medium approval threshold (broad console/CLI API routing plus Capgo cloud deploy allowlist). Reviewers are already assigned; no approval from this run.
Sent by Cursor Approval Agent: Pull Request Approver
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: high. Left a non-blocking comment — Cursor Bugbot completed as skipped on this sync and still has unresolved findings, and this PR exceeds the low-risk approval threshold (broad console/CLI API routing plus Capgo cloud deploy allowlist). Reviewers are already assigned; no approval from this run.
Sent by Cursor Approval Agent: Pull Request Approver External
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: high. Left a non-blocking comment — Cursor Bugbot completed as skipped/neutral with 2 unresolved findings, and this PR exceeds the medium approval threshold (broad console/CLI API routing plus Capgo cloud deploy allowlist). Reviewers are already assigned; no approval from this run.
Sent by Cursor Approval Agent: Pull Request Approver
The reason will be displayed to describe this comment to others. Learn more.
Risk: high. Left a non-blocking comment — Cursor Bugbot completed successfully with no open findings, but this PR exceeds the medium approval threshold (broad console/CLI API routing plus Capgo cloud deploy allowlist). Reviewers are already assigned; no approval from this run.
Sent by Cursor Approval Agent: Pull Request Approver
The reason will be displayed to describe this comment to others. Learn more.
Risk: high. Left a non-blocking comment — Cursor Bugbot completed successfully with no open findings, but this PR exceeds the low-risk approval threshold (broad console/CLI API routing plus Capgo cloud deploy allowlist). Reviewers are already assigned; no approval from this run.
Sent by Cursor Approval Agent: Pull Request Approver External
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Summary (AI generated)
supabase.functions.invokecalls throughinvokeCapgoApi→VITE_API_HOST(api.capgo.app) instead ofsb.capgo.appinvokeCapgoCliApi→hostApi/hostFilesApi(self-host still uses/functions/v1)triggersforever; keepbundle,channel,files,privateuntil 2026-10-28 for older CLIs; stop publishing console-onlyapikey,app,organization,statistics,webhooksMotivation (AI generated)
Publishing unused Capgo cloud edge functions is an infra abuse risk. Console and new CLI can talk to Cloudflare directly; old CLIs still hit Supabase invoke for a few endpoints, so those stay published for ~3 months.
Business Impact (AI generated)
Fewer Capgo cloud Supabase functions to operate and attack, without breaking existing customer CLIs during the upgrade window. Self-host full deploy is unchanged.
Test Plan (AI generated)
api.capgo.app, notsb.capgo.app/functions/v1bundle upload, channel set/delete, upload link / delete failed version / set manifest against Capgo cloud--supa-host/ self-host: same flows still hit/functions/v1bun scripts/supabase-cloud-functions.ts list)bunx vitest run tests/supabase-cloud-functions.unit.test.tsbundle/channel/files/privatefrom the allowlist and delete Capgo cloud Supabase deploymentsGenerated with AI
Made with Cursor
Summary by CodeRabbit
New Features
Deployment
Documentation
Tests