fix(api): JWT notifications auth + builtin kill-switch revert - #2807
Conversation
Dashboard silent push used JWT against middlewareKey-only routes. Channel builtin revert returned already_on_builtin with kind, so the plugin never reached its reset path for devices still on an OTA bundle. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 40 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (4)
Comment |
Merging this PR will not alter performance
Comparing 
Footnotes
|
The version_name equality path ran before the builtin branch, so already-on-builtin devices never hit the dedicated error code. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
plugin_parser maps version_name "builtin" to version_build, so compare version_name === version_build for the up-to-date case and keep the OTA kill-switch success payload when they differ. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Duplicate of #2805 (same JWT auth + builtin kill-switch fix). Closing to free CI concurrency. |
|
Temporarily closing so push-only CI can finish without PR/push concurrency cancel. Will reopen when green. |
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_f4d6727a-a4e2-47fc-b921-f4a6366375cd) |
|
1 participant
Summary (AI generated)
middlewareKeytomiddlewareAuthso the dashboard JWT can call/notifications/update-check(and related routes) withoutInvalid apikey./updatesnow returns success{ version: "builtin" }with noerror/kind, so the plugin can reset to the store binary.already_on_builtin+kind: up_to_date.Motivation (AI generated)
A customer enabling silent push after reverting a channel to built-in hit two bugs:
/updatesalways returnedalready_on_builtin+kind: up_to_datefor built-in channels, so the plugin never entered itsversion == "builtin"reset path.Business Impact (AI generated)
Restores the intended emergency rollback / kill-switch (channel → built-in) and silent background update push from the console, which customers rely on for production incident response.
Test Plan (AI generated)
/notifications/update-checkfrom the dashboard while logged in (JWT) and confirm it queues withoutInvalid apikey./updatesreturns{ "version": "builtin" }withouterror/kind, and the device resets to the store binary.already_on_builtin/up_to_date.Generated with AI
Made with Cursor