feat(settings): add developer toggle for useLatestURL cookie#589
Merged
SupertigerDev merged 5 commits intoNerimity:mainfrom Mar 4, 2026
Merged
feat(settings): add developer toggle for useLatestURL cookie#589SupertigerDev merged 5 commits intoNerimity:mainfrom
SupertigerDev merged 5 commits intoNerimity:mainfrom
Conversation
Contributor
📝 WalkthroughWalkthroughAdds a storage key Changes
Sequence Diagram(s)sequenceDiagram
participant User as User
participant UI as DeveloperSettings
participant State as Signal(useLatest)
participant Cookie as BrowserCookie
User->>UI: toggle "Use Latest URL"
UI->>State: set useLatest value
UI->>Cookie: write `useLatestURL` cookie (add domain if hostname includes nerimity.com)
Cookie-->>UI: cookie stored
UI->>UI: re-render SettingsBlock with updated state
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Tip Try Coding Plans. Let us write the prompt for your AI agent so you can ship faster (with fewer bugs). Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@src/components/settings/developer/DeveloperSettings.tsx`:
- Around line 55-60: The checkbox in DeveloperSettings (the input using
checked={useLatest()} and onChange={handleToggleCookie}) lacks an accessible
name; update the markup to provide one by either adding a descriptive id to the
input and a corresponding <label htmlFor="..."> (e.g., “Use latest build” or
similar) or by adding an explicit aria-label/aria-labelledby attribute on the
input that describes its purpose, and ensure the label text matches the meaning
used in handleToggleCookie/useLatest for clarity.
- Around line 32-33: The hostname check in DeveloperSettings.tsx uses
window.location.hostname.includes("nerimity.com") which can match unintended
hosts; replace this with a strict match against the root domain and allowed
subdomains (e.g., compare hostname === "nerimity.com" or
endsWith(".nerimity.com") with a guard that ensures a dot before the suffix)
when computing the domain variable used in document.cookie assignment for
useLatestURL, so only exact root or valid subdomains set domain=.nerimity.com;
keep the rest of the cookie string (path, max-age) unchanged and update the
domain variable logic accordingly.
ℹ️ Review info
Configuration used: defaults
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
src/common/localStorage.tssrc/components/settings/developer/DeveloperSettings.tsxsrc/locales/list/en-gb.json
Member
|
You should probably update the message to let people know that they shouldn't use latest because it can be buggy |
Contributor
Author
|
I added the warning 
|
Contributor
There was a problem hiding this comment.
♻️ Duplicate comments (1)
src/components/settings/developer/DeveloperSettings.tsx (1)
32-33:⚠️ Potential issue | 🟡 MinorUse strict domain matching before setting
domain=.nerimity.com.Line 32 uses
includes("nerimity.com"), which can match unintended hostnames and make cookie behavior fragile. Use exact root/subdomain matching.Suggested fix
- const domain = window.location.hostname.includes("nerimity.com") ? "domain=.nerimity.com;" : ""; + const hostname = window.location.hostname; + const isNerimityDomain = + hostname === "nerimity.com" || hostname.endsWith(".nerimity.com"); + const domain = isNerimityDomain ? "domain=.nerimity.com;" : "";🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@src/components/settings/developer/DeveloperSettings.tsx` around lines 32 - 33, The hostname check is too permissive: replace the includes("nerimity.com") logic used to build the domain string (the const domain and subsequent document.cookie assignment in DeveloperSettings.tsx) with a strict match such as hostname === "nerimity.com" || hostname.endsWith(".nerimity.com") so only the root domain and its subdomains set domain=.nerimity.com; keep the rest of the cookie string (useLatestURL, path, max-age) unchanged and only append `domain=.nerimity.com;` when the strict check passes.
🧹 Nitpick comments (1)
src/components/settings/developer/DeveloperSettings.tsx (1)
21-24: Avoid duplicating the cookie key literal.
"useLatestURL"is hardcoded in both read/write paths. Please use the shared storage key constant added insrc/common/localStorage.tsto prevent drift across web/desktop/mobile integrations.Also applies to: 33-33
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@src/components/settings/developer/DeveloperSettings.tsx` around lines 21 - 24, Replace the hardcoded "useLatestURL" string with the shared exported storage key constant (e.g., USE_LATEST_URL_KEY) from the localStorage module: import that constant, update getInitialCookieValue to search for `${USE_LATEST_URL_KEY}=` when parsing document.cookie, and update any cookie write/update code (the setter/onChange that writes the cookie) to use the same constant so read and write paths reference the single shared symbol (e.g., update getInitialCookieValue and the cookie-setter/onChange handler to use USE_LATEST_URL_KEY).
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Duplicate comments:
In `@src/components/settings/developer/DeveloperSettings.tsx`:
- Around line 32-33: The hostname check is too permissive: replace the
includes("nerimity.com") logic used to build the domain string (the const domain
and subsequent document.cookie assignment in DeveloperSettings.tsx) with a
strict match such as hostname === "nerimity.com" ||
hostname.endsWith(".nerimity.com") so only the root domain and its subdomains
set domain=.nerimity.com; keep the rest of the cookie string (useLatestURL,
path, max-age) unchanged and only append `domain=.nerimity.com;` when the strict
check passes.
---
Nitpick comments:
In `@src/components/settings/developer/DeveloperSettings.tsx`:
- Around line 21-24: Replace the hardcoded "useLatestURL" string with the shared
exported storage key constant (e.g., USE_LATEST_URL_KEY) from the localStorage
module: import that constant, update getInitialCookieValue to search for
`${USE_LATEST_URL_KEY}=` when parsing document.cookie, and update any cookie
write/update code (the setter/onChange that writes the cookie) to use the same
constant so read and write paths reference the single shared symbol (e.g.,
update getInitialCookieValue and the cookie-setter/onChange handler to use
USE_LATEST_URL_KEY).
ℹ️ Review info
Configuration used: defaults
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
src/components/settings/developer/DeveloperSettings.tsxsrc/locales/list/en-gb.json
🚧 Files skipped from review as they are similar to previous changes (1)
- src/locales/list/en-gb.json
Member
|
Please use the existing checkbox component |
Contributor
Author
|
Changed it. Sorry, I forgot about components 🫠 
|
Contributor
There was a problem hiding this comment.
♻️ Duplicate comments (2)
src/components/settings/developer/DeveloperSettings.tsx (2)
31-32:⚠️ Potential issue | 🟡 MinorUse strict hostname matching before assigning
domain=.nerimity.com.
includes("nerimity.com")is too broad and can misfire on unrelated hosts, causing fragile cookie behavior.Suggested fix
- const domain = window.location.hostname.includes("nerimity.com") ? "domain=.nerimity.com;" : ""; + const hostname = window.location.hostname; + const isNerimityDomain = + hostname === "nerimity.com" || hostname.endsWith(".nerimity.com"); + const domain = isNerimityDomain ? "domain=.nerimity.com;" : "";🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@src/components/settings/developer/DeveloperSettings.tsx` around lines 31 - 32, The hostname check in DeveloperSettings.tsx is too permissive; replace window.location.hostname.includes("nerimity.com") with a strict match such as checking hostname === "nerimity.com" or hostname.endsWith(".nerimity.com") so only the root domain and its subdomains set domain=.nerimity.com; update the logic that computes the domain variable (the const domain line) to use this stricter test and leave the document.cookie assignment using that domain and the checked variable unchanged.
54-54:⚠️ Potential issue | 🟠 MajorGive the checkbox an accessible name.
Rendering
Checkboxwithout a label leaves the native input without a reliable accessible name for screen readers.One possible fix in this file
- <Checkbox checked={useLatest()} onChange={handleToggleCookie} /> + <Checkbox + checked={useLatest()} + onChange={handleToggleCookie} + label={t("settings.developer.useLatestUrl")} + />🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@src/components/settings/developer/DeveloperSettings.tsx` at line 54, The Checkbox rendered in DeveloperSettings (checked={useLatest()} onChange={handleToggleCookie}) lacks an accessible name; add one by either wrapping it with a visible label component (e.g., a FormControlLabel or <label> that references the Checkbox) or by supplying an explicit aria-label or aria-labelledby prop that describes its purpose (for example "Use latest version" or similar) so screen readers can announce it; update the Checkbox usage in DeveloperSettings.tsx accordingly and ensure the label text is meaningful and localized if needed.
🧹 Nitpick comments (1)
src/components/settings/developer/DeveloperSettings.tsx (1)
32-32: Harden cookie attributes (SameSite+ conditionalSecure).This preference cookie is missing defensive attributes. Add
SameSite=LaxandSecurewhen on HTTPS.Suggested hardening
- document.cookie = `useLatestURL=${checked}; path=/; max-age=315360000; ${domain}`; + const secure = window.location.protocol === "https:" ? "Secure; " : ""; + document.cookie = `useLatestURL=${checked}; path=/; max-age=315360000; SameSite=Lax; ${secure}${domain}`;🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@src/components/settings/developer/DeveloperSettings.tsx` at line 32, The cookie assignment for the preference (the template that sets document.cookie using checked and domain) lacks SameSite and conditional Secure attributes; update the cookie string constructed where document.cookie is set (the code using `useLatestURL=${checked}` and `domain`) to append `; SameSite=Lax` and, when running under HTTPS (check window.location.protocol === 'https:'), append `; Secure`; ensure you still include path and max-age and preserve the existing domain variable.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Duplicate comments:
In `@src/components/settings/developer/DeveloperSettings.tsx`:
- Around line 31-32: The hostname check in DeveloperSettings.tsx is too
permissive; replace window.location.hostname.includes("nerimity.com") with a
strict match such as checking hostname === "nerimity.com" or
hostname.endsWith(".nerimity.com") so only the root domain and its subdomains
set domain=.nerimity.com; update the logic that computes the domain variable
(the const domain line) to use this stricter test and leave the document.cookie
assignment using that domain and the checked variable unchanged.
- Line 54: The Checkbox rendered in DeveloperSettings (checked={useLatest()}
onChange={handleToggleCookie}) lacks an accessible name; add one by either
wrapping it with a visible label component (e.g., a FormControlLabel or <label>
that references the Checkbox) or by supplying an explicit aria-label or
aria-labelledby prop that describes its purpose (for example "Use latest
version" or similar) so screen readers can announce it; update the Checkbox
usage in DeveloperSettings.tsx accordingly and ensure the label text is
meaningful and localized if needed.
---
Nitpick comments:
In `@src/components/settings/developer/DeveloperSettings.tsx`:
- Line 32: The cookie assignment for the preference (the template that sets
document.cookie using checked and domain) lacks SameSite and conditional Secure
attributes; update the cookie string constructed where document.cookie is set
(the code using `useLatestURL=${checked}` and `domain`) to append `;
SameSite=Lax` and, when running under HTTPS (check window.location.protocol ===
'https:'), append `; Secure`; ensure you still include path and max-age and
preserve the existing domain variable.
Member
|
no problem 💖 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
useLatestURLcookie state.nerimity.comdomain so that the desktop and mobile clients can correctly read it regardless of current subdomainScreenshots
Did you test your code?
Additional context
Checklist
Side note
This is a draft PR, because I'm still working on the Mobile Implementation for this feature.The updated code for the desktop App can be found here: https://github.com/mathiiiiiis/nerimity-desktop(I'm going to open a PR for the mobile and desktop app at the same time)I opened both PR's for Mobile and Desktop App:
Nerimity/NerimityReactNative#4
Nerimity/nerimity-desktop#28
Summary by CodeRabbit
New Features
Localization