Conversation
📝 WalkthroughWalkthroughRemoved Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
src/routes/(authenticated)/projects/[id=idNumber]/ProductCard.svelte (1)
266-279:⚠️ Potential issue | 🟠 MajorMissing
{@html}directive forformatBuildEngineLinkoutput.
formatBuildEngineLinkreturns HTML strings (e.g.,<a href="...">...</a>), but it's used with regular interpolation{}. This will render the raw HTML as escaped text instead of a clickable link.Compare with line 260-262 which correctly uses
{@htmlm.tasks_archivedAt(...)}.Proposed fix
<span> - <b> - {formatBuildEngineLink( + <b> + {`@html` formatBuildEngineLink( linkToBuildEngine( isSuperAdmin(page.data.session!.user.roles) && product.WorkflowInstance && isBackground(product.WorkflowInstance.State as WorkflowState) ? product.BuildEngineUrl : undefined, product, product.WorkflowInstance?.State as WorkflowState ), product.ActiveTransition?.InitialState ?? '' )} - </b> + </b> —🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@src/routes/`(authenticated)/projects/[id=idNumber]/ProductCard.svelte around lines 266 - 279, The formatted build engine link is an HTML string but is currently interpolated with {formatBuildEngineLink(...)} which escapes HTML; change the usage in ProductCard.svelte to render raw HTML by using Svelte's {`@html` ...} directive around the call to formatBuildEngineLink (the call that wraps linkToBuildEngine(...) and uses product, product.WorkflowInstance, isSuperAdmin and isBackground). Ensure you replace the curly-brace interpolation for that expression with {`@html` formatBuildEngineLink(linkToBuildEngine(...), product.ActiveTransition?.InitialState ?? '')} so the anchor is rendered as clickable HTML.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@src/lib/locales/fr-FR.json`:
- Line 363: The tasks_waiting translation key currently contains an English
string; update the value for "tasks_waiting" to the proper French translation
(for example: "en attente de {allowedNames}") and ensure the placeholder
{allowedNames} is preserved exactly as-is in the new French string.
---
Outside diff comments:
In `@src/routes/`(authenticated)/projects/[id=idNumber]/ProductCard.svelte:
- Around line 266-279: The formatted build engine link is an HTML string but is
currently interpolated with {formatBuildEngineLink(...)} which escapes HTML;
change the usage in ProductCard.svelte to render raw HTML by using Svelte's
{`@html` ...} directive around the call to formatBuildEngineLink (the call that
wraps linkToBuildEngine(...) and uses product, product.WorkflowInstance,
isSuperAdmin and isBackground). Ensure you replace the curly-brace interpolation
for that expression with {`@html` formatBuildEngineLink(linkToBuildEngine(...),
product.ActiveTransition?.InitialState ?? '')} so the anchor is rendered as
clickable HTML.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 60d6e15e-5b58-487b-9cf9-27e23c5e4db2
📒 Files selected for processing (4)
src/lib/locales/en-US.jsonsrc/lib/locales/es-419.jsonsrc/lib/locales/fr-FR.jsonsrc/routes/(authenticated)/projects/[id=idNumber]/ProductCard.svelte
|
I when from Syncrhonize Data to Rebuild. Something when wrong: 
|
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
src/routes/(authenticated)/projects/[id=idNumber]/ProductCard.svelte (1)
267-278:⚠️ Potential issue | 🟠 MajorValidate
BuildEngineUrlbefore passing it intoformatBuildEngineLink()—and also in the build-engines admin page.The
infrastructureSchemavalidatesbuildEngineUrlas a plain string with no scheme checking. A poisoned value likejavascript:alert(1)//would pass through and become executable in the href attribute. This affects two display paths:
src/routes/(authenticated)/projects/[id=idNumber]/ProductCard.svelte(lines 267–278): rendered for super-admins viewing background workflowssrc/routes/(authenticated)/admin/settings/build-engines/+page.svelte(line 53): direct href binding for system status linksWhitelist
http:orhttps:schemes either in the schema or before rendering. Ideally add a validator toinfrastructureSchemato reject non-HTTPS URLs at the form level.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@src/routes/`(authenticated)/projects/[id=idNumber]/ProductCard.svelte around lines 267 - 278, Validate and whitelist BuildEngineUrl scheme before rendering and in the schema: add a URL-scheme check that only allows http: or https: (preferably enforce https-only) and reject anything else at input/validation time in infrastructureSchema, and additionally sanitize/validate the value just before rendering in ProductCard.svelte and the build-engines admin page—i.e., before calling formatBuildEngineLink(linkToBuildEngine(...)) and before binding any hrefs, ensure product.BuildEngineUrl (and the admin page's build engine URL) matches the allowed scheme and skip or neutralize the link when it doesn't, using the existing helpers (isSuperAdmin, linkToBuildEngine, formatBuildEngineLink) to locate where to add the guard.
🧹 Nitpick comments (1)
src/routes/(authenticated)/projects/[id=idNumber]/ProductCard.svelte (1)
266-280: Only show the activity prefix whenInitialStateexists.
product.ActiveTransitionis optional here, so the?? ''fallback can still render an empty bold tag followed by—. Consider gating the<b>...</b> —prefix onproduct.ActiveTransition?.InitialStateto avoid rows that start with a dangling separator.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@src/routes/`(authenticated)/projects/[id=idNumber]/ProductCard.svelte around lines 266 - 280, Only render the bold activity prefix and the following em-dash when an InitialState exists: wrap the current <b>{`@html` formatBuildEngineLink(..., product.ActiveTransition?.InitialState ?? '')}</b> — block with a conditional that checks product.ActiveTransition?.InitialState (or explicitly use product.ActiveTransition?.InitialState !== undefined && product.ActiveTransition?.InitialState !== '') so you call formatBuildEngineLink and linkToBuildEngine only when InitialState is present; keep existing helpers (formatBuildEngineLink, linkToBuildEngine, isSuperAdmin, product.WorkflowInstance) unchanged and just gate the entire prefix output on that InitialState presence to avoid rendering an empty bold tag and dangling —.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In `@src/routes/`(authenticated)/projects/[id=idNumber]/ProductCard.svelte:
- Around line 267-278: Validate and whitelist BuildEngineUrl scheme before
rendering and in the schema: add a URL-scheme check that only allows http: or
https: (preferably enforce https-only) and reject anything else at
input/validation time in infrastructureSchema, and additionally
sanitize/validate the value just before rendering in ProductCard.svelte and the
build-engines admin page—i.e., before calling
formatBuildEngineLink(linkToBuildEngine(...)) and before binding any hrefs,
ensure product.BuildEngineUrl (and the admin page's build engine URL) matches
the allowed scheme and skip or neutralize the link when it doesn't, using the
existing helpers (isSuperAdmin, linkToBuildEngine, formatBuildEngineLink) to
locate where to add the guard.
---
Nitpick comments:
In `@src/routes/`(authenticated)/projects/[id=idNumber]/ProductCard.svelte:
- Around line 266-280: Only render the bold activity prefix and the following
em-dash when an InitialState exists: wrap the current <b>{`@html`
formatBuildEngineLink(..., product.ActiveTransition?.InitialState ?? '')}</b>
— block with a conditional that checks
product.ActiveTransition?.InitialState (or explicitly use
product.ActiveTransition?.InitialState !== undefined &&
product.ActiveTransition?.InitialState !== '') so you call formatBuildEngineLink
and linkToBuildEngine only when InitialState is present; keep existing helpers
(formatBuildEngineLink, linkToBuildEngine, isSuperAdmin,
product.WorkflowInstance) unchanged and just gate the entire prefix output on
that InitialState presence to avoid rendering an empty bold tag and dangling
—.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 417de205-241b-430c-bfcf-f17fc890ebc9
📒 Files selected for processing (1)
src/routes/(authenticated)/projects/[id=idNumber]/ProductCard.svelte
2 participants
Summary by CodeRabbit
New Features
UI/UX Improvements
Localization