Make GET-style skin the default and fix scan card flow#20
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 626cec8069
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const [newPool] = await db | ||
| .insert(schema.weeklyPools) |
There was a problem hiding this comment.
This insert is now in the claim-generation hot path, but weekly_pools.week_start is unique and there is no onConflict... or retry here. On the first request of a new week (or after a reset), two callers can both observe weeklyPool.length === 0; one succeeds and the other will hit a unique-key error, surfacing a 500 instead of returning a claim.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 131bed5f1c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
apps/mobile/app/scan-card.tsx
Outdated
| let resolvedUserId = initialUserId; | ||
|
|
||
| if (!resolvedUserId) { | ||
| const { | ||
| data: { user }, |
There was a problem hiding this comment.
ScanCardScreen prefers the userId query param over supabase.auth.getUser(), and then posts that value unchanged to generateClaimCode. Because the client/API still treat userId as the requester identity, any signed-in user who opens a crafted slugswap://scan-card?userId=<victim> link can mint and refresh claim codes against the victim's allowance instead of their own.
Useful? React with 👍 / 👎.
| if (userAllowance.length === 0) { | ||
| return NextResponse.json( | ||
| { error: "No allowance found for this week" }, | ||
| { status: 400 } | ||
| ); | ||
| const { config } = await getAdminConfig(); | ||
| const defaultWeeklyLimit = config.defaultWeeklyAllowance; | ||
| const [newAllowance] = await db | ||
| .insert(schema.userAllowances) |
There was a problem hiding this comment.
This new insert runs in the claim-generation path, but user_allowances has no unique (user_id, weekly_pool_id) constraint. If a first-time requester double-submits while their allowance is still missing, both requests can create separate rows; later redemption handling in this same route only loads limit(1), so one row becomes invisible and the user's remaining balance/usage can drift.
Useful? React with 👍 / 👎.
|
is everything resolved @codex? |
StatusNo — not everything is resolved yet. Based on the current What is resolved1) Scan Card no longer trusts route-supplied
|
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 16338e635a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| tabBarStyle: { | ||
| display: 'none', |
There was a problem hiding this comment.
Fresh evidence beyond the earlier thread: I searched apps/mobile for routes into /(tabs)/(request) and only found the tab registration plus the request screen's own self-router.replace; lib/auth-context.tsx:80-82 still sends every signed-in user to /(tabs)/(share), and apps/mobile/app/(tabs)/(share)/index.tsx:530-536 only opens /scan-card when isGetLinked is true (otherwise it starts GET linking). With the tab bar hidden here, non-donor/requester users now have no in-app path to the request flow at all.
Useful? React with 👍 / 👎.
| const auth = await authenticateAppUser(req); | ||
| if ("response" in auth) { | ||
| return auth.response; | ||
| } |
There was a problem hiding this comment.
Checked apps/dashboard/app/admin-dashboard-client.tsx:733-744: the admin UI still deletes claims by POSTing the selected userId plus claimCodeId and relies on the admin session cookie. This new auth gate rejects any request without a Supabase bearer token before the body is read, so deleting claims from the admin dashboard now returns 401 and bounces admins to /admin/login instead of removing the claim.
Useful? React with 👍 / 👎.
# Conflicts: # apps/dashboard/lib/server/claims/donor-usage.ts
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
1 participant
Summary
Testing