Repository navigation
admin-ui: stop logging raw AxiosError on request failures - #97
Conversation
The shared axios request interceptor attaches the session token to every request as config.headers['api-token'], and an axios error object carries error.config. Every request catch block that logged the raw error therefore printed the API token (and config.data, the request body) into devtools and into any console screenshot taken for support. Log a bounded diagnostic instead of the raw object at the request failure sites in the custom-client view (custom_build/list, custom_preset/list, custom_preset/delete, custom_build/delete), the dashboard, server health, server config and admin config loads. The response interceptor already toasts a bounded message for these failures, so no signal is lost. The preset custom_json parse failure is bounded to the error type only: the V8 JSON.parse message quotes an excerpt of the offending input, and custom_json can carry permanent_password and key. Add a regression test that drives the real implementations with an axios error carrying a canary token and body, and assert neither reaches the console while a bounded diagnostic remains. Run every file in admin-ui/tests/ in CI. Co-Authored-By: opencode <opencode@opencode.ai>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Docstring Coverage |  |
Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 2 files. (5 skipped: 5 … | Write docstrings for the functions missing them to satisfy the coverage threshold. |
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title clearly and concisely describes the main change: preventing raw AxiosError objects from being logged in the Admin UI during request failures. Linked Issues check Issue #96requirements are met. The four named handlers inadmin-ui/src/views/custom-client/index.vuenow log fixed labels pluse?.message || String(e)instead of raw errors. The handlers retain t…Out of Scope Changes check The added logging changes for image upload, /config/all, server health, dashboard stats, and admin configuration address the same raw AxiosError exposure and use the same bounded-diagnostic pattern.…Full details: Linked Issues check
-
Explanation
Issue
#96requirements are met. The four named handlers inadmin-ui/src/views/custom-client/index.vuenow log fixed labels pluse?.message || String(e)instead of raw errors. The handlers retain their existing request, cancellation, generation, and state-update flow. The regression test uses real Axios errors with canary token and body values and checks that console calls receive only strings while a bounded diagnostic remains. The reported changes are limited to Admin UI files, add no dependencies, and preserve the existing interceptor and API calls. The PR also reports that the#95preset-save path is unchanged.
Full details: Out of Scope Changes check
-
Explanation
The added logging changes for image upload,
/config/all, server health, dashboard stats, and admin configuration address the same raw AxiosError exposure and use the same bounded-diagnostic pattern. The 655-line regression suite directly tests the affected handlers and preserves cancellation, successful list handling, and stale-request behavior. The CI glob change runs this required test suite. No unrelated product behavior, API contract, or dependency change is shown.
-
Full details: Docstring Coverage
-
Explanation
Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 2 files. (5 skipped: 5 unsupported.)
Resolution
Write docstrings for the functions missing them to satisfy the coverage threshold.
✨ Finishing Touches: 💡 1
-
📝 Generate docstrings: 💡
-
- Commit to this branch
- Create a new PR
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Fixes #96
Summary
Admin-ui request catch blocks no longer print the raw axios error object. The shared request interceptor in
admin-ui/src/utils/request.jsattaches the session token to every request asconfig.headers['api-token'], and an axios error carrieserror.config— so logging the raw object printed the API token and the request body into devtools and into any console screenshot taken for support.Each affected site now logs a bounded diagnostic instead of the object.
custom-client/index.vue—custom_build/list,custom_preset/list,custom_preset/delete,custom_build/delete(the four paths named in admin-ui: stop logging raw AxiosError (api-token) on list/delete failures #96), plus the image-upload and/config/allfailures.components/dashboard/ServerHealth.vue—/dashboard/health.views/index/index.vue—/dashboard/stats.views/server/config.vue—/config/all.store/app.js—/config/admin.The response interceptor already toasts a bounded message for these failures, so no signal is lost.
The
preset custom_jsonparse failure is bounded to the error type only (e?.name), not the message: the V8JSON.parsemessage quotes an excerpt of the offending input, andcustom_jsoncan carrypermanent_passwordandkey.Why
Issue #96 (non-blocking P2 from the #95 review). A support screenshot of the console would capture the session token.
Validation
node --test tests/*.test.mjs— 88/88 pass (72 existing + 16 new) on Node 20.20.2, 22.23.0 and 24.17.0npm run build— passgit diff --check— cleanconsole.error(e)fails it again.Regression test
New
admin-ui/tests/admin-ui-request-error-logging.test.mjsdrives the real implementations — it reads each source file, extracts the relevant slice by string boundaries, evaluates it in anode:vmcontext with a stubbed console, and calls it with a realaxios.AxiosErrorwhoseconfigcarries a canary token and canary body. It asserts the canaries never reach the console, that a bounded diagnostic remains, and that neighbouring behaviour (successful list, cancelled confirm, superseded request generation) is preserved..github/workflows/build.ymlnow runsnode --test tests/*.test.mjsso every file inadmin-ui/tests/runs in CI. The glob form is used rather thannode --test tests/because the directory form is broken on Node 22+.Scope
Admin UI only. No new dependencies.
admin-ui/src/utils/request.jsandadmin-ui/src/api/are unchanged — the token is still attached to requests, and the #95 preset-save path (reportCreateBuildFailure,saveCurrentAsPreset, thecustom_preset/createwrapper) is byte-identical tomain.Manual verification
/admin/→ Custom Client, and DevTools → Console./custom_build/listin the Network panel) and reload.Failed to load custom builds: Network Error— and noapi-tokenor request body in the console output.Co-Authored-By: opencode opencode@opencode.ai
Summary by CodeRabbit
Security
Bug Fixes
Tests