Add controlled TokMetric activation console#219
Open
support371 wants to merge 23 commits into
Open
Conversation
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Reviewer's GuideAdds a governed TokMetric command gateway and a protected activation console that operates on real workspace data but keeps all TikTok publishing actions internal and fail-closed, wired through a Next.js API route and a shared gateway client, with tests ensuring the gateway is included in production and constrained to GEM admin sessions. Sequence diagram for TokMetric create_draft command flowsequenceDiagram
actor Admin
participant TokMetricActivationPanel
participant TokMetricCommandRoute as api_tokmetric_command_route
participant GatewayClient as invokeTokMetricCommandGateway
participant SupabaseFunction as gem_tokmetric_command_gateway
participant Database
Admin->>TokMetricActivationPanel: click Create draft
TokMetricActivationPanel->>TokMetricCommandRoute: POST /api/tokmetric/command
TokMetricCommandRoute->>TokMetricCommandRoute: getGatewaySessionToken
TokMetricCommandRoute->>GatewayClient: invokeTokMetricCommandGateway(token, create_draft, payload)
GatewayClient->>SupabaseFunction: POST gem-tokmetric-command-gateway
SupabaseFunction->>SupabaseFunction: requireOperator(token)
SupabaseFunction->>SupabaseFunction: dispatch(create_draft)
SupabaseFunction->>Database: insert tokmetric_contents, tokmetric_content_versions
Database-->>SupabaseFunction: OK
SupabaseFunction-->>GatewayClient: { ok: true, externalActionTaken: false }
GatewayClient-->>TokMetricCommandRoute: result
TokMetricCommandRoute-->>TokMetricActivationPanel: JSON 201
TokMetricActivationPanel-->>Admin: show success notice
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
8 Skipped Deployments
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 1 issue, and left some high level feedback:
- The workspace ID is hard-coded in both the Supabase function and the React panel; consider centralizing this into a shared configuration/constant to avoid drift and make future workspace changes safer.
- Operation names are duplicated across the edge gateway dispatch logic, the Next.js API route
OPERATIONSset, and theTokMetricCommandOperationunion; aligning these via a single shared definition or enum would reduce the risk of mismatches when adding or renaming operations.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- The workspace ID is hard-coded in both the Supabase function and the React panel; consider centralizing this into a shared configuration/constant to avoid drift and make future workspace changes safer.
- Operation names are duplicated across the edge gateway dispatch logic, the Next.js API route `OPERATIONS` set, and the `TokMetricCommandOperation` union; aligning these via a single shared definition or enum would reduce the risk of mismatches when adding or renaming operations.
## Individual Comments
### Comment 1
<location path="src/app/api/tokmetric/command/route.ts" line_range="99-102" />
<code_context>
+ );
+ }
+ const payload = body as Record<string, unknown>;
+ const operation =
+ typeof payload.operation === "string"
+ ? (payload.operation as TokMetricCommandOperation)
+ : "snapshot";
+ if (!OPERATIONS.has(operation)) {
+ return json(
</code_context>
<issue_to_address>
**suggestion (bug_risk):** Defaulting to `snapshot` when `operation` is omitted may hide client-side bugs.
This silent fallback makes it easy for clients to ship code that omits or misnames `operation` without noticing, including cases where a write was intended but the payload was malformed. Consider treating a missing `operation` as a 4xx error and requiring explicit operations, with `GET` remaining the way to request snapshots.
Suggested implementation:
```typescript
const payload = body as Record<string, unknown>;
if (typeof payload.operation !== "string") {
return json(
{
error: "TokMetric command operation is required.",
code: "INVALID_OPERATION",
},
400,
);
}
const operation = payload.operation as TokMetricCommandOperation;
if (!OPERATIONS.has(operation)) {
return json(
{
error: "TokMetric command operation is invalid.",
code: "INVALID_OPERATION",
},
400,
);
```
1. Any client code issuing POST requests to this `/tokmetric/command` route must now always include a valid `operation` field; missing or malformed values will receive a 400 response.
2. Ensure the snapshot behavior via `GET` is documented and, if implemented in a separate handler/file, confirm it remains the sanctioned way to request snapshots without an explicit `operation` field.
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ❌ Deployment failed View logs |
gem-enterprise | 8e700f8 | Jul 17 2026, 10:30 AM |
Contributor
|
Deployment failed with the following error: Learn More: https://vercel.com/admin-25521151s-projects?upgradeToPro=build-rate-limit |
Contributor
|
Deployment failed with the following error: Learn More: https://vercel.com/geraldhoeven-4141s-projects?upgradeToPro=build-rate-limit |
Contributor
|
Deployment failed with the following error: Learn More: https://vercel.com/carolinasuarez8419-9338s-projects?upgradeToPro=build-rate-limit |
Contributor
|
Deployment failed with the following error: Learn More: https://vercel.com/alliancetrustrealtyearner-cells-projects?upgradeToPro=build-rate-limit |
Contributor
|
Deployment failed with the following error: Learn More: https://vercel.com/carolinasuarez8419-9338s-projects?upgradeToPro=build-rate-limit |
Contributor
|
Deployment failed with the following error: Learn More: https://vercel.com/dpj58sq6xc-2324s-projects?upgradeToPro=build-rate-limit |
Contributor
|
Deployment failed with the following error: Learn More: https://vercel.com/geraldhoeven-4141s-projects?upgradeToPro=build-rate-limit |
Contributor
|
Deployment failed with the following error: Learn More: https://vercel.com/legal-9831s-projects?upgradeToPro=build-rate-limit |
Contributor
|
Deployment failed with the following error: Learn More: https://vercel.com/garciamirandaramirez-2606s-projects?upgradeToPro=build-rate-limit |
Contributor
|
Deployment failed with the following error: Learn More: https://vercel.com/jamesaugustine199726-2076s-projects?upgradeToPro=build-rate-limit |
Contributor
|
Deployment failed with the following error: Learn More: https://vercel.com/gilbertmichael561-5155s-projects?upgradeToPro=build-rate-limit |
Contributor
|
Deployment failed with the following error: Learn More: https://vercel.com/support-8685s-projects?upgradeToPro=build-rate-limit |
Contributor
|
Deployment failed with the following error: Learn More: https://vercel.com/victoriaeleanor544-2270s-projects?upgradeToPro=build-rate-limit |
Contributor
|
Deployment failed with the following error: Learn More: https://vercel.com/gemassists-projects-3feb3fa9?upgradeToPro=build-rate-limit |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the protected TokMetric activation console and routes its internal workflow through the existing administrator gateway.
Included:
External TikTok publishing, advertising, and Shop writes remain disabled.
Release status: mergeable, but not ready to merge. Vercel verification is rate-limited and the updated administrator gateway has not been activated in Supabase.