[masterbots.ai] feat: Create Password Recovery #282
Conversation
…bots into feat-password-recovery
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
WalkthroughThe changes in this pull request introduce new API endpoints for handling password reset functionality, including a password reset request and a password reset process. Additionally, new React components for the user interface are created, allowing users to submit their email for password recovery and to reset their password using a token. The implementation also includes utility functions for email validation and password strength assessment, alongside email handling for sending password reset emails. Changes
Possibly related PRs
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (3)
✅ Files skipped from review due to trivial changes (1)
🚧 Files skipped from review as they are similar to previous changes (2)
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
Reviewer's Guide by SourceryThis pull request implements a password recovery feature for the Masterbots.ai application. It includes changes to the backend infrastructure, API routes for forgot password and reset password functionality, email sending capabilities, and frontend components for the password recovery process. Sequence diagram for password reset processsequenceDiagram
actor User
participant Frontend
participant Backend
participant EmailService
User->>Frontend: Clicks 'Forgot Password'
Frontend->>Backend: POST /api/auth/forgot-password
Backend->>Database: Check if user exists
alt User exists
Backend->>EmailService: Send password reset email
EmailService-->>User: Password reset email
end
User->>Frontend: Clicks link in email
Frontend->>Backend: POST /api/auth/reset-password
Backend->>Database: Validate token and update password
Backend-->>Frontend: Password reset successful
Frontend-->>User: Display success message
User journey diagram for password recoveryjourney
title Password Recovery User Journey
section Forgot Password
User: Clicks 'Forgot Password' - 5: User
User: Enters email and submits form - 4: User
System: Sends password reset email - 3: System
section Reset Password
User: Clicks link in email - 5: User
User: Enters new password and submits form - 4: User
System: Validates token and updates password - 3: System
User: Receives confirmation of password reset - 5: User
ER diagram for new token and user_token tableserDiagram
USER {
UUID user_id
TEXT email
TEXT password
BOOLEAN is_verified
}
TOKEN {
TEXT token
TIMESTAMPTZ token_expiry
}
USER_TOKEN {
UUID user_id
TEXT token
}
USER ||--o{ USER_TOKEN : "has"
TOKEN ||--o{ USER_TOKEN : "has"
USER_TOKEN }|..|{ TOKEN : "references"
USER_TOKEN }|..|{ USER : "references"
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey @Bran18 - I've reviewed your changes and found some issues that need to be addressed.
Blocking issues:
- Hardcoded Hasura admin secret found. (link)
Here's what I looked at during the review
- 🟢 General issues: all looks good
- 🔴 Security: 1 blocking issue, 2 other issues
- 🟢 Testing: all looks good
- 🟢 Complexity: all looks good
- 🟢 Documentation: all looks good
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 19
🧹 Outside diff range and nitpick comments (27)
apps/hasura/migrations/masterbots/1728339597164_alter_table_public_user_add_column_is_verified/up.sql (1)
1-2: LGTM! Consider the following suggestions for a smooth integration.The SQL migration to add the "is_verified" column to the "public"."user" table looks good. The column definition is appropriate, using a boolean type with a not null constraint and a default value of 'false'.
Here are some considerations for the team:
- Ensure that corresponding application code is updated to utilize this new column where necessary.
- Consider creating a "down" migration file to revert this change if needed in the future.
- Review and update any API endpoints or application logic related to user verification to incorporate this new column.
- If there's a need to verify existing users, plan for a separate data migration task.
apps/hasura/migrations/masterbots/1728335312982_alter_table_public_user_add_column_resetTokenExpiry/down.sql (1)
1-4: Security considerations for password reset featureWhile implementing the password reset feature, please consider the following security best practices:
- Ensure that reset tokens are sufficiently long and random to prevent guessing attacks.
- Implement rate limiting on the password reset request endpoint to prevent abuse.
- Use secure communication (HTTPS) for all password reset related operations.
- Invalidate the reset token immediately after it's used.
- Notify the user via email when a password reset is requested and when it's completed.
- Log all password reset attempts for auditing purposes.
Consider implementing a separate service or module to handle password reset logic, ensuring separation of concerns and easier maintenance of security-related code.
Would you like me to provide a code snippet or outline for implementing these security measures?
apps/hasura/metadata/databases/masterbots/tables/public_token.yaml (1)
1-3: LGTM! Consider using a separate schema for authentication-related tables.The table definition looks good. The name
tokenis appropriate for its purpose. However, for better organization and potentially improved security, consider creating a separate schema (e.g.,auth) for authentication-related tables instead of using thepublicschema.apps/hasura/migrations/masterbots/1728339569387_alter_table_public_user_drop_column_resetTokenExpiry/down.sql (1)
1-3: Review and revise the migration strategyAfter reviewing this "down" migration file, several concerns have been identified:
- Incorrect comment placement for the table description.
- Potential issues with dropping the NOT NULL constraint.
- Unusual sequence of operations for a "down" migration.
These issues suggest that the overall migration strategy for this change might need revision.
Consider the following recommendations:
- Review the corresponding "up" migration to ensure that this "down" migration correctly reverts all changes.
- Evaluate if the operations in this file achieve the intended purpose of the "down" migration.
- Consider reordering or modifying the operations to ensure they correctly and safely revert the database schema.
- Update comments to accurately describe the purpose of specific columns rather than the entire table.
- Assess the impact of allowing NULL values in the "resetTokenExpiry" column on the application logic.
A careful review and possible revision of this migration will help maintain data integrity and prevent potential issues during schema updates or rollbacks.
apps/masterbots.ai/app/auth/forgot-password/page.tsx (1)
5-7: LGTM: Styling and layout are appropriate, with room for enhancement.The use of Tailwind CSS utility classes is consistent with modern React development practices and creates a clean, centered layout. The styling is minimal but effective for a simple form page.
For potential improvement:
Consider adding more padding or margin to the container for better spacing on larger screens. For example:
- <div className="container max-w-md mx-auto mt-10"> + <div className="container max-w-md mx-auto mt-10 p-6">This change would add padding around the content, improving readability and visual appeal.
apps/hasura/migrations/masterbots/1728339501024_create_table_public_user_token/up.sql (1)
1-1: LGTM! Consider enhancing the table comment.The SQL statement for creating the
user_tokentable is well-structured and aligns with the PR objective of implementing password recovery functionality. The composite primary key and foreign key constraints are appropriately defined, ensuring data integrity and preventing orphaned records.Consider slightly modifying the table comment to be more explicit:
COMMENT ON TABLE "public"."user_token" IS E'Stores the relationship between users and tokens for one-time operations (password reset/account activation)';This change provides a clearer explanation of the table's purpose and the nature of the tokens stored.
apps/masterbots.ai/app/auth/reset-password/page.tsx (2)
9-17: Good use of Suspense, consider adding error boundary.The component structure is clean and the use of Suspense for handling loading states is excellent. However, consider wrapping the Suspense component with an error boundary to gracefully handle any errors that might occur during the password reset process.
Here's a suggested improvement:
+import { ErrorBoundary } from 'react-error-boundary' export default function ResetPasswordPage({ searchParams }: { searchParams: { token: string } }) { return ( <div className="container max-w-md mx-auto mt-10"> <h1 className="mb-4 text-2xl font-bold">Reset Password</h1> + <ErrorBoundary fallback={<div>Error occurred. Please try again.</div>}> <Suspense fallback={<div>Loading...</div>}> <ResetPasswordForm token={searchParams.token} /> </Suspense> + </ErrorBoundary> </div> ) }Don't forget to install and import the
react-error-boundarypackage if it's not already in use in your project.
1-17: Overall, good implementation with room for security enhancements.The
ResetPasswordPagecomponent is well-structured and makes good use of React features like Suspense. To further improve this implementation:
- Add input validation for the token parameter to enhance security.
- Implement an error boundary to gracefully handle potential errors.
- Consider adding logging or monitoring for password reset attempts to track any suspicious activities.
These enhancements will make the password reset functionality more robust and secure.
packages/mb-genql/package.json (1)
9-9: Acknowledge local development improvements while ensuring secure configurationsThe change to use a local GraphQL endpoint is beneficial for developers working on the project locally. It allows for easier testing and debugging without relying on external services.
However, it's crucial to maintain secure and appropriate configurations for different environments (local, test, production). Please ensure that:
- The production build process uses the correct, secure HTTPS endpoint.
- Sensitive information like admin secrets are properly managed and not exposed in the codebase.
- The changes are consistent across all related scripts and configurations.
Consider documenting the local setup process, including any necessary environment variables, in the project's README or a dedicated developer guide. This will help maintain consistency across the development team and ease the onboarding process for new developers.
Taskfile.yml (5)
7-10: LGTM! Consider adding a description comment.The change to use the
cmdskey and the introduction of Turbo repo for running the dev script are good improvements. They enhance the structure of the Taskfile and suggest a more efficient monorepo setup.Consider adding a brief description comment above the task to explain what "masterbots.ai" refers to, for better clarity:
# Run the main app (masterbots.ai) with Turbo repo app: cmds: - turbo run dev --scope="masterbots.ai"
13-15: LGTM! Consider usingcmdskey for consistency.The addition of the
--admin-secretparameter enhances security for the Hasura console access. Sourcing the secret from an environment variable is a good practice.For consistency with other tasks, consider using the
cmdskey:console: cmds: - hasura console --project apps/hasura --admin-secret ${HASURA_GRAPHQL_ADMIN_SECRET}
18-25: LGTM! Consider usingdocker composehealth checks.The update to
docker composesyntax and the addition of sleep commands are good improvements. They ensure proper sequencing of service startup.While the sleep commands work, consider using Docker Compose's built-in health checks for a more robust solution. This would allow services to wait for dependencies to be truly ready, not just started. Here's an example of how you might modify your
docker-compose.yml:services: database: # ... other configuration ... healthcheck: test: ["CMD", "pg_isready", "-U", "postgres"] interval: 5s timeout: 5s retries: 5 hasura: # ... other configuration ... depends_on: database: condition: service_healthyThis approach would eliminate the need for arbitrary sleep durations in your Taskfile.
56-63: LGTM! Consider usingdocker compose upwith specific services.The updates to use
docker composesyntax and the addition of separate postgres startup and Hasura logging are good improvements. They provide more control over the startup process and better visibility into Hasura's state.Instead of using separate commands to start postgres and then all services, consider using
docker compose upwith specific service names. This approach is more idiomatic and easier to maintain. Here's a suggested modification:reload: cmds: - task down - docker compose up -d postgres - sleep 5 - docker compose up -d hasura - docker compose logs -f hasura - task migrate - task seedThis change makes the startup sequence more explicit and easier to modify if new services are added in the future.
🧰 Tools
🪛 yamllint
[error] 63-63: no new line character at the end of file
(new-line-at-end-of-file)
63-63: Add a newline at the end of the file.To adhere to common coding standards and prevent potential issues with certain tools, add a newline character at the end of the file.
🧰 Tools
🪛 yamllint
[error] 63-63: no new line character at the end of file
(new-line-at-end-of-file)
apps/masterbots.ai/components/auth/signin-form.tsx (1)
62-67: LGTM: Addition of "Forgot Password?" link enhances user experience.The new "Forgot Password?" link is a valuable addition to the sign-in form, providing users with a clear path to password recovery. The use of the Next.js
Linkcomponent ensures efficient client-side navigation.Consider adding an
aria-labelto the link for improved accessibility:<Link href="/auth/forgot-password" className="flex justify-end mt-6 text-sm text-purple-700 hover:underline" + aria-label="Forgot Password? Click here to reset" > Forgot Password? </Link>apps/hasura/metadata/databases/masterbots/tables/public_user.yaml (1)
47-53: Consider potential performance implications of the new relationship.While the addition of the
userTokensrelationship is beneficial for the password recovery feature, be mindful of its usage in GraphQL queries. Fetching user tokens along with user data in every query could impact performance unnecessarily.Consider implementing the following best practices:
- Use selective querying: Only request the
userTokenswhen specifically needed for password recovery operations.- Implement pagination if the number of tokens per user could grow large over time.
- Monitor query performance after deployment and optimize if necessary.
apps/masterbots.ai/components/auth/reset-password-form.tsx (3)
11-24: Consider adding password strength validation.While the current implementation checks if the passwords match, it doesn't validate the strength of the new password. Consider adding password strength validation to ensure users create secure passwords.
You could implement this by adding a function to check password strength and calling it before the password match check. For example:
const isPasswordStrong = (password: string): boolean => { // Implement your password strength logic here // e.g., check for minimum length, presence of uppercase, lowercase, numbers, and special characters return password.length >= 8 && /[A-Z]/.test(password) && /[a-z]/.test(password) && /[0-9]/.test(password) && /[^A-Za-z0-9]/.test(password); } // In handleSubmit function: if (!isPasswordStrong(password)) { toast.error('Password is not strong enough. It should be at least 8 characters long and contain uppercase, lowercase, numbers, and special characters.'); setIsLoading(false); return; }
26-47: Enhance error handling for network errors.The current implementation uses a generic error message for all types of errors. Consider providing more specific error messages for different types of errors, especially for network-related issues.
You could modify the catch block to differentiate between network errors and other types of errors:
} catch (error) { console.error('Error:', error); if (error instanceof TypeError && error.message === 'Failed to fetch') { toast.error('Network error. Please check your internet connection.'); } else { toast.error('An unexpected error occurred. Please try again later.'); } } finally { setIsLoading(false); }This will provide more informative error messages to the user, improving the overall user experience.
1-78: LGTM: Well-implemented password reset component. Consider adding tests.The ResetPasswordForm component is well-structured and implements the necessary functionality for a password reset flow. It follows React best practices and provides a good user experience with loading states and error handling.
To further improve the reliability of this component, consider adding unit tests to cover different scenarios such as:
- Successful password reset
- Password mismatch
- API error handling
- Network error handling
Would you like assistance in setting up a test file for this component?
apps/masterbots.ai/app/api/auth/forgot-password/route.ts (3)
10-10: Use consistent error responsesThe error message
"Email is required"is clear, but consider standardizing the error response format across your APIs. This could include consistent error codes, messages, and response structures to improve client-side error handling.
42-42: Use constants for configuration valuesHardcoding the token expiry duration as
3600000milliseconds can reduce code readability and maintainability. Consider defining a constant or using an environment variable to make the code clearer and easier to configure.Apply this diff to introduce a constant for the token expiry duration:
+ const TOKEN_EXPIRY_MS = 3600000; // 1 hour - const resetTokenExpiry = new Date(Date.now() + 3600000) // 1 hour from now + const resetTokenExpiry = new Date(Date.now() + TOKEN_EXPIRY_MS)
77-81: Improve error handling for insertion failuresThrowing a generic error with the message
"Failed to insert token"may not provide enough context for debugging. Consider capturing and logging specific error details or rethrowing the caught error to aid in troubleshooting.Apply this diff to enhance error handling:
if ( !result.insertToken?.returning.length || !result.insertUserToken?.returning.length ) { - throw new Error('Failed to insert token') + throw new Error('Failed to insert token or associate it with the user') }apps/masterbots.ai/app/api/auth/reset-password/route.ts (2)
106-112: Ensure consistent error responsesWhen an unexpected error occurs, the error message returned to the client is generic. Providing more specific error messages can help the client understand what went wrong.
Consider returning the error message or a specific code that indicates the nature of the error, while still avoiding the exposure of sensitive information.
Example modification:
107| console.error('Error resetting password:', error) -108| return NextResponse.json( -109| { error: 'An error occurred while resetting the password' }, -110| { status: 500 } -111| ) +108| return NextResponse.json( +109| { error: error.message || 'An internal server error occurred' }, +110| { status: 500 } +111| )
5-113: Add unit tests for the password reset endpointTo ensure the reliability and correctness of the new password reset functionality, it's important to have unit tests that cover various scenarios, including success cases and error handling.
Would you like assistance in creating unit tests for this endpoint or opening a GitHub issue to track this task?
apps/masterbots.ai/lib/email.ts (3)
19-19: Address the TODO: Update SendGrid configurationThe TODO comment indicates that the SendGrid configuration needs to be updated for the chosen email provider. It's important to update this configuration to ensure emails are sent correctly in the production environment.
Would you like assistance in updating the SendGrid configuration? I can help generate the updated code based on the chosen email provider.
90-90: Avoid logging sensitive user informationLogging the recipient's email address may expose sensitive user information in logs. Consider modifying the log statement to enhance user privacy.
Apply this diff to remove the email address from the log:
await transporter.sendMail(mailOptions) - console.log(`Password reset email sent to ${email}`) + console.log('Password reset email sent successfully')
92-93: Include the original error message when throwingWhen re-throwing an error, including the original error message can aid in debugging and provide more context about the failure.
Apply this diff to include the original error message:
console.error('Error sending password reset email:', error) - throw new Error('Failed to send password reset email') + throw new Error(`Failed to send password reset email: ${error.message}`)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
⛔ Files ignored due to path filters (5)
bun.lockbis excluded by!**/bun.lockbpackages/mb-genql/generated/index.tsis excluded by!**/generated/**packages/mb-genql/generated/schema.graphqlis excluded by!**/generated/**packages/mb-genql/generated/schema.tsis excluded by!**/generated/**packages/mb-genql/generated/types.tsis excluded by!**/generated/**
📒 Files selected for processing (35)
- .env_sample (0 hunks)
- Taskfile.yml (2 hunks)
- apps/hasura/metadata/databases/masterbots/tables/public_token.yaml (1 hunks)
- apps/hasura/metadata/databases/masterbots/tables/public_user.yaml (1 hunks)
- apps/hasura/metadata/databases/masterbots/tables/public_user_token.yaml (1 hunks)
- apps/hasura/metadata/databases/masterbots/tables/tables.yaml (1 hunks)
- apps/hasura/migrations/masterbots/1728335280788_alter_table_public_user_add_column_resetToken/down.sql (1 hunks)
- apps/hasura/migrations/masterbots/1728335280788_alter_table_public_user_add_column_resetToken/up.sql (1 hunks)
- apps/hasura/migrations/masterbots/1728335312982_alter_table_public_user_add_column_resetTokenExpiry/down.sql (1 hunks)
- apps/hasura/migrations/masterbots/1728335312982_alter_table_public_user_add_column_resetTokenExpiry/up.sql (1 hunks)
- apps/hasura/migrations/masterbots/1728339304083_create_table_public_token/down.sql (1 hunks)
- apps/hasura/migrations/masterbots/1728339304083_create_table_public_token/up.sql (1 hunks)
- apps/hasura/migrations/masterbots/1728339501024_create_table_public_user_token/down.sql (1 hunks)
- apps/hasura/migrations/masterbots/1728339501024_create_table_public_user_token/up.sql (1 hunks)
- apps/hasura/migrations/masterbots/1728339524677_alter_table_public_token_update_comment/down.sql (1 hunks)
- apps/hasura/migrations/masterbots/1728339524677_alter_table_public_token_update_comment/up.sql (1 hunks)
- apps/hasura/migrations/masterbots/1728339560012_alter_table_public_user_drop_column_resetToken/down.sql (1 hunks)
- apps/hasura/migrations/masterbots/1728339560012_alter_table_public_user_drop_column_resetToken/up.sql (1 hunks)
- apps/hasura/migrations/masterbots/1728339569387_alter_table_public_user_drop_column_resetTokenExpiry/down.sql (1 hunks)
- apps/hasura/migrations/masterbots/1728339569387_alter_table_public_user_drop_column_resetTokenExpiry/up.sql (1 hunks)
- apps/hasura/migrations/masterbots/1728339597164_alter_table_public_user_add_column_is_verified/down.sql (1 hunks)
- apps/hasura/migrations/masterbots/1728339597164_alter_table_public_user_add_column_is_verified/up.sql (1 hunks)
- apps/hasura/migrations/masterbots/1728339605396_alter_table_public_user_alter_column_is_verified/down.sql (1 hunks)
- apps/hasura/migrations/masterbots/1728339605396_alter_table_public_user_alter_column_is_verified/up.sql (1 hunks)
- apps/masterbots.ai/app/api/auth/forgot-password/route.ts (1 hunks)
- apps/masterbots.ai/app/api/auth/reset-password/route.ts (1 hunks)
- apps/masterbots.ai/app/auth/forgot-password/page.tsx (1 hunks)
- apps/masterbots.ai/app/auth/reset-password/page.tsx (1 hunks)
- apps/masterbots.ai/components/auth/forgot-password-form.tsx (1 hunks)
- apps/masterbots.ai/components/auth/reset-password-form.tsx (1 hunks)
- apps/masterbots.ai/components/auth/signin-form.tsx (3 hunks)
- apps/masterbots.ai/lib/email.ts (1 hunks)
- apps/masterbots.ai/package.json (2 hunks)
- packages/mb-genql/.env-sample (0 hunks)
- packages/mb-genql/package.json (1 hunks)
💤 Files with no reviewable changes (2)
- .env_sample
- packages/mb-genql/.env-sample
✅ Files skipped from review due to trivial changes (11)
- apps/hasura/migrations/masterbots/1728335280788_alter_table_public_user_add_column_resetToken/down.sql
- apps/hasura/migrations/masterbots/1728335280788_alter_table_public_user_add_column_resetToken/up.sql
- apps/hasura/migrations/masterbots/1728335312982_alter_table_public_user_add_column_resetTokenExpiry/up.sql
- apps/hasura/migrations/masterbots/1728339304083_create_table_public_token/down.sql
- apps/hasura/migrations/masterbots/1728339304083_create_table_public_token/up.sql
- apps/hasura/migrations/masterbots/1728339501024_create_table_public_user_token/down.sql
- apps/hasura/migrations/masterbots/1728339524677_alter_table_public_token_update_comment/down.sql
- apps/hasura/migrations/masterbots/1728339524677_alter_table_public_token_update_comment/up.sql
- apps/hasura/migrations/masterbots/1728339560012_alter_table_public_user_drop_column_resetToken/up.sql
- apps/hasura/migrations/masterbots/1728339569387_alter_table_public_user_drop_column_resetTokenExpiry/up.sql
- apps/hasura/migrations/masterbots/1728339597164_alter_table_public_user_add_column_is_verified/down.sql
🧰 Additional context used
🪛 yamllint
Taskfile.yml
[error] 63-63: no new line character at the end of file
(new-line-at-end-of-file)
🪛 Biome
apps/masterbots.ai/lib/email.ts
[error] 10-10: Useless case clause.
because the default clause is present:
Unsafe fix: Remove the useless case.
(lint/complexity/noUselessSwitchCase)
🔇 Additional comments (31)
apps/hasura/migrations/masterbots/1728339605396_alter_table_public_user_alter_column_is_verified/down.sql (1)
1-1: Verify data integrity and application logic foris_verifiedcolumnThe SQL statement alters the
is_verifiedcolumn in thepublic.usertable to beNOT NULL. This change enforces data integrity by ensuring every user record has a value foris_verified. However, please consider the following points:
Existing Data: Ensure there are no null values in the
is_verifiedcolumn before applying this migration. If null values exist, they need to be updated first.Application Logic: Verify that all code paths in the application that create or update user records set a value for
is_verified.Rollback Strategy: As this is a 'down' migration, it's reverting the column to be non-nullable. Ensure this aligns with your rollback strategy and doesn't conflict with application expectations.
To check for existing null values and verify the current state of the column, you can run the following script:
This script will show the count of null values (if any) and display the current table structure.
apps/hasura/migrations/masterbots/1728339605396_alter_table_public_user_alter_column_is_verified/up.sql (1)
1-1: Clarify the implications of makingis_verifiednullableThe change to drop the NOT NULL constraint on the
is_verifiedcolumn in thepublic.usertable could have significant implications:
- It may impact data integrity if the application logic relies on this column always having a value.
- Existing queries or application code might need updates to handle potential NULL values.
- This could affect the user verification process and potentially have security implications depending on how
is_verifiedis used in the application.Given that this PR is about password recovery, could you please clarify:
- What is the reasoning behind allowing NULL values for
is_verified?- How will this change be reflected in the application logic, especially in terms of user verification and authentication processes?
- Are there any security considerations that need to be addressed with this change?
- Will existing queries and application code be updated to handle potential NULL values?
To help assess the impact, let's check for usage of
is_verifiedin the codebase:This will help us understand where updates might be needed to accommodate the new nullable status of
is_verified.✅ Verification successful
Confirmed: Making
is_verifiednullable does not impact application code.
- The
is_verifiedcolumn is only altered in migration SQL files.- No usage found in TypeScript/JavaScript files.
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Search for usage of 'is_verified' in SQL files and TypeScript/JavaScript files echo "SQL usage:" rg --type sql "is_verified" echo "TypeScript/JavaScript usage:" rg --type ts --type js "is_verified"Length of output: 842
apps/hasura/metadata/databases/masterbots/tables/public_user_token.yaml (4)
1-3: LGTM: Table definition is clear and follows conventions.The table name
user_tokenin thepublicschema is appropriate for storing user tokens, which aligns with the password recovery feature being implemented.
8-10: LGTM:userrelationship is well-defined.The relationship is correctly set up using a foreign key constraint on the
user_idfield, ensuring referential integrity.Please verify that the referenced
usertable exists and has a matching primary key. Run the following script to check:#!/bin/bash # Description: Verify the existence of the 'user' table and its primary key # Test: Check for the 'user' table definition rg --type yaml 'name: user' apps/hasura/metadata/databases/masterbots/tables/ # Test: Check for a primary key in the 'user' table (assuming it's defined in a SQL migration) rg --type sql 'CREATE TABLE.*user' apps/hasura/migrations/ rg --type sql 'PRIMARY KEY.*user' apps/hasura/migrations/
1-10: Consider additional columns for theuser_tokentable.The current structure looks good for basic token management. However, for a robust password recovery system, consider adding the following columns if they're not already present:
created_at: Timestamp for when the token was created.expires_at: Timestamp for token expiration.is_used: Boolean flag to mark if the token has been used.These additions would enhance security and provide better control over token lifecycle.
To verify the complete table structure, please run the following script:
#!/bin/bash # Description: Retrieve the complete structure of the user_token table # Test: Find and display the SQL migration that creates the user_token table rg --type sql 'CREATE TABLE.*user_token' apps/hasura/migrations/Could you please confirm if these columns are present in the actual table definition?
5-7: LGTM:tokenByTokenrelationship is well-defined.The relationship is correctly set up using a foreign key constraint on the
tokenfield, ensuring referential integrity.Please verify that the referenced
tokentable exists and has a matching primary key. Run the following script to check:✅ Verification successful
Verified:
tokenByTokenrelationship is correctly defined.The
tokentable exists with the necessary primary key constraints, and the foreign key relationship inuser_tokenis properly set up, ensuring referential integrity.🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Verify the existence of the 'token' table and its primary key # Test: Check for the 'token' table definition rg --type yaml 'name: token' apps/hasura/metadata/databases/masterbots/tables/ # Test: Check for a primary key in the 'token' table (assuming it's defined in a SQL migration) rg --type sql 'CREATE TABLE.*token' apps/hasura/migrations/ rg --type sql 'PRIMARY KEY.*token' apps/hasura/migrations/Length of output: 801
Script:
#!/bin/bash # Description: Verify the existence of the 'token' table by searching for its references # Search for any CREATE TABLE statements for 'token' rg --type sql 'CREATE TABLE.*\btoken\b' apps/hasura/migrations/ # Search for FOREIGN KEY references to 'token' table in SQL migrations rg --type sql 'FOREIGN KEY.*REFERENCES\s+"public"\."token"' apps/hasura/migrations/ # Search for YAML definitions that might reference the 'token' table indirectly rg --type yaml 'foreign_key_constraint_on: token' apps/hasura/metadata/databases/masterbots/tables/Length of output: 1609
apps/hasura/metadata/databases/masterbots/tables/public_token.yaml (1)
4-11: LGTM! Please clarify the purpose of theuser_tokentable.The array relationship
userTokensis well-defined and correctly uses a foreign key constraint. This setup allows for a many-to-many relationship between users and tokens, which is a common pattern in authentication systems.However, to ensure this design aligns with the intended functionality:
- Could you please clarify the purpose of the
user_tokentable?- How does it differ from the
tokentable we're defining here?This information will help validate that the relationship structure supports the password recovery feature effectively.
To better understand the table structure, let's examine the
user_tokentable definition:✅ Verification successful
To gain a more comprehensive understanding of the user_token table structure and purpose, we need to retrieve its complete definition. Let's run a script to fetch this information.
It seems our previous script encountered an error due to the newline character in the regex pattern. Let's adjust our approach and try again with a modified script.
It seems our modified script didn't find the user_token table definition. Let's broaden our search to find any mentions of "user_token" in the YAML files. This will help us understand if the table is defined differently or if there are any references to it.
The
userTokensrelationship is correct and serves an important purpose in the authentication system.The
user_tokentable acts as a junction table, establishing a many-to-many relationship between users and tokens. This design allows for flexible token management, where:
- A user can have multiple tokens (e.g., for different devices or sessions).
- A token can potentially be associated with multiple users (although this is less common in typical authentication systems).
The relationship defined in
public_token.yamlis consistent with this structure, allowing the system to retrieve all user tokens associated with a particular token.Key points about the
user_tokentable:
- It's defined in the public schema.
- It has a relationship with both the
userandtokentables.- It likely contains columns for
id(primary key),user_id(foreign key to user table), andtoken(foreign key to token table).This structure supports various authentication scenarios, such as:
- Managing multiple active sessions for a user
- Implementing token-based authentication for API access
- Handling password reset or email verification tokens
The relationship you've defined is well-structured and appropriate for the password recovery feature, as it allows the system to efficiently link tokens to users during the recovery process.
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Retrieve the user_token table definition # Expected result: YAML definition of the user_token table fd -e yaml -x cat {} \; | rg -A 20 'name: user_token'Length of output: 1549
Script:
#!/bin/bash # Description: Retrieve the complete user_token table definition # Expected result: Detailed YAML definition of the user_token table, including columns and constraints fd -e yaml -x cat {} \; | rg -A 50 'name: user_token\n schema: public$'Length of output: 269
Script:
#!/bin/bash # Description: Retrieve the complete user_token table definition (modified approach) # Expected result: Detailed YAML definition of the user_token table, including columns and constraints fd -e yaml -x cat {} \; | rg -A 50 'name: user_token\s+schema: public$'Length of output: 76
Script:
#!/bin/bash # Description: Search for any mentions of "user_token" in YAML files # Expected result: Any content related to user_token table or references to it fd -e yaml -x cat {} \; | rg -i 'user_token' -C 5Length of output: 850
apps/hasura/migrations/masterbots/1728339569387_alter_table_public_user_drop_column_resetTokenExpiry/down.sql (2)
3-3: Verify the migration sequenceThe sequence of operations in this migration is unusual for a "down" migration:
- Altering an existing column to drop NOT NULL
- Adding a new column with the same name
This suggests that the migration might be attempting to revert changes made in an "up" migration. However, the order and nature of these operations might not correctly revert the changes.
Please review and confirm:
- Is this the intended sequence of operations for the "down" migration?
- Does this correctly revert the changes made in the corresponding "up" migration?
- Should the operations be in reverse order, or is a different approach needed to correctly revert the changes?
To help verify the migration, you can run the following script to check the corresponding "up" migration:
✅ Verification successful
Migration sequence is correct
The
down.sqlmigration appropriately adds theresetTokenExpirycolumn, reverting theup.sqlmigration which removes it.🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Find and display the content of the corresponding "up" migration up_migration=$(find ./apps/hasura/migrations/masterbots -name "1728339569387_alter_table_public_user_drop_column_resetTokenExpiry" -type d) if [ -n "$up_migration" ]; then echo "Content of the corresponding up.sql:" cat "$up_migration/up.sql" else echo "Corresponding up migration not found." fiLength of output: 625
2-2: Verify the intention of dropping NOT NULL constraintDropping the NOT NULL constraint on the "resetTokenExpiry" column allows it to accept NULL values. This change might have implications for the application logic that depends on this column.
Please confirm:
- Is this change intentional?
- Has the application logic been updated to handle potential NULL values in this column?
- Are there any existing queries or constraints that might be affected by this change?
To help verify the impact, you can run the following script to check for usage of this column:
✅ Verification successful
NOT NULL Constraint Dropped Successfully
The NOT NULL constraint on the "resetTokenExpiry" column has been removed. Current application code consistently assigns non-null values to this field, minimizing potential issues.
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Search for usage of resetTokenExpiry in SQL files and application code echo "Searching for resetTokenExpiry usage in SQL files:" rg --type sql "resetTokenExpiry" ./apps/hasura echo "\nSearching for resetTokenExpiry usage in application code:" rg --type-not sql "resetTokenExpiry" ./appsLength of output: 1702
Script:
#!/bin/bash # Search for assignments of NULL to resetTokenExpiry in application code echo "Searching for assignments of NULL to resetTokenExpiry in application code:" rg 'resetTokenExpiry\s*=\s*null' ./appsLength of output: 200
Script:
#!/bin/bash # Search for all assignments to resetTokenExpiry in application code echo "Searching for all assignments to resetTokenExpiry in application code:" rg 'resetTokenExpiry\s*=' ./appsLength of output: 321
apps/masterbots.ai/app/auth/forgot-password/page.tsx (2)
1-1: LGTM: Import statement is correct and follows best practices.The import statement correctly uses the
@alias for the project root, which is a common practice in Next.js projects. The imported component name matches its usage in the render method.
3-10: LGTM: Component structure and implementation are well-designed.The
ForgotPasswordPagecomponent is well-structured and follows React best practices:
- It's a functional component using the default export.
- The naming convention (PascalCase) is correct for React components.
- The component is focused on layout, delegating form handling to the
ForgotPasswordFormcomponent.This separation of concerns enhances maintainability and reusability.
apps/masterbots.ai/app/auth/reset-password/page.tsx (1)
1-2: LGTM: Imports are correct and appropriate.The import statements are well-structured, importing only the necessary components. The use of Suspense from React is a good practice for handling asynchronous loading states.
apps/hasura/metadata/databases/masterbots/tables/tables.yaml (1)
17-21: Significant changes to database schema detected. Verify impact on application functionality.The changes in this file indicate a major restructuring of the database schema:
- Multiple table definitions have been removed, including those for categories, chats, chatbots, messages, prompts, and other core entities.
- New tables for
tokenanduser_tokenhave been added, which aligns with the implementation of password recovery functionality.While these changes support the new password recovery feature, the removal of so many table definitions raises concerns:
Please verify that:
- The removed tables are no longer needed or have been moved elsewhere.
- All affected parts of the application have been updated to reflect these schema changes.
- There are no unintended consequences on existing features due to the removal of these tables.
Run the following script to check for any remaining references to the removed tables:
This script will help identify any lingering references to the removed tables, which may need to be addressed.
Consider documenting these significant schema changes, including the rationale behind removing so many tables and how it affects the overall architecture of the application. This documentation will be valuable for future maintenance and onboarding of new developers.
apps/masterbots.ai/components/auth/forgot-password-form.tsx (2)
1-9: LGTM: Imports and component declaration are correct.The 'use client' directive, imports, and component declaration are all properly implemented. The necessary UI components and hooks are imported, and the component is correctly exported as default.
10-11: LGTM: State management is implemented correctly.The component uses appropriate state management with useState for both the email input and loading state. The initial values are set correctly.
Taskfile.yml (4)
39-41: LGTM! Consistent use ofdocker compose.The update to
docker composesyntax is correct and consistent with other tasks.
44-46: LGTM! Consistent use ofdocker compose.The update to
docker composesyntax is correct and consistent with other tasks.
49-52: LGTM! Enhanced security for migration operations.The addition of
--admin-secretparameters for both migrate and metadata commands improves security. Consistently using the environment variable for the admin secret is a good practice.
34-36: LGTM! Consistent security improvement.The addition of the
--admin-secretparameter to the seed command enhances security and maintains consistency with other tasks.apps/masterbots.ai/components/auth/signin-form.tsx (3)
9-9: LGTM: New import for Next.js Link component.The addition of the
Linkimport from 'next/link' is appropriate for implementing client-side navigation in a Next.js application.
42-44: LGTM: Improved formatting for email label.The reformatting of the
Labelcomponent improves code readability without affecting functionality.
54-57: LGTM: Improved formatting for password label and input.The reformatting of the
LabelandInputcomponents for the password field improves code readability and consistency without affecting functionality.apps/hasura/metadata/databases/masterbots/tables/public_user.yaml (1)
47-53: LGTM! Verify the existence of theuser_tokentable.The addition of the
userTokensrelationship looks good and aligns with the PR objective of creating a password recovery feature. This relationship will allow querying user tokens associated with a user, which is essential for password reset functionality.To ensure the
user_tokentable exists and has the correct structure, run the following script:This script will confirm that the
user_tokentable exists and display its structure, allowing us to verify that it has the necessaryuser_idcolumn for the foreign key relationship.apps/masterbots.ai/components/auth/reset-password-form.tsx (1)
1-14: LGTM: Imports and component declaration are well-structured.The 'use client' directive is correctly used, and all necessary imports are present. The component declaration with the token prop is appropriate for the password reset functionality.
apps/masterbots.ai/package.json (3)
64-64: LGTM: Addition of nodemailer dependencyThe addition of the
nodemailerpackage is appropriate for implementing email functionality, which is likely needed for the password recovery feature mentioned in the PR objectives. The version^6.9.15is recent and allows for compatible updates.
86-86: LGTM: Addition of @types/nodemailer dev dependencyThe addition of
@types/nodemaileras a dev dependency is a good practice for TypeScript projects. It provides type definitions for the nodemailer package, enhancing type safety and improving the development experience. The version^6.4.16is appropriate and allows for compatible updates.
64-64: Summary: Appropriate dependencies added for email functionalityThe additions of
nodemailerand@types/nodemailerare well-aligned with the PR objective of creating a password recovery feature. These changes:
- Introduce email sending capabilities with
nodemailer.- Provide TypeScript type support for
nodemailerwith@types/nodemailer.The versions used are recent and allow for compatible updates. These minimal changes focus on the task at hand without introducing any apparent conflicts or security issues.
Also applies to: 86-86
apps/masterbots.ai/app/api/auth/forgot-password/route.ts (2)
31-37: Good practice in preventing user enumerationReturning a generic success message when a user is not found prevents attackers from determining if an email address is registered. This is a solid security practice to mitigate user enumeration attacks.
84-84: Handle potential errors when sending the password reset emailWhile the
sendPasswordResetEmailfunction is awaited, any errors it throws will be caught by thecatchblock. Ensure that this function properly handles potential exceptions (e.g., email service failures) and provides meaningful error messages without exposing sensitive information.To confirm that
sendPasswordResetEmailhandles errors appropriately, you can review its implementation.apps/masterbots.ai/app/api/auth/reset-password/route.ts (1)
51-52: Use asynchronous bcrypt functions efficientlyWhile using
bcryptjs, it's more efficient to use the synchronous version ofgenSaltwhen hashing passwords asynchronously.Modify the salt generation to be synchronous since you're already using
awaitwithbcryptjs.hash:Apply this diff:
51| const salt = await bcryptjs.genSalt(10) -52| const hashedPassword = await bcryptjs.hash(password, salt) +52| const hashedPassword = await bcryptjs.hash(password, salt)Correction: Upon further review, both
genSaltandhashmethods are already appropriately used withawait. No change is necessary here.apps/masterbots.ai/lib/email.ts (1)
48-48: Ensure the 'from' email address is correctly configuredThe
fromfield usesprocess.env.EMAIL_FROM. Please verify that this environment variable is set correctly across all environments to avoid issues with email delivery.Run the following script to check if
EMAIL_FROMis defined in your environment configuration files:
...ations/masterbots/1728335312982_alter_table_public_user_add_column_resetTokenExpiry/down.sql
Show resolved
Hide resolved
.../migrations/masterbots/1728339560012_alter_table_public_user_drop_column_resetToken/down.sql
Show resolved
Hide resolved
...tions/masterbots/1728339569387_alter_table_public_user_drop_column_resetTokenExpiry/down.sql
Show resolved
Hide resolved
There was a problem hiding this comment.
Actionable comments posted: 10
🧹 Outside diff range and nitpick comments (11)
apps/masterbots.ai/components/shared/password-strength-meter.tsx (4)
1-2: LGTM! Consider using named import for React.The imports look good and promote code reusability by leveraging utility functions. However, you might consider using a named import for React if you're not using default import elsewhere.
You could update the React import like this:
-import React from 'react'; +import { FC } from 'react';This change would require updating the component definition to use
FCdirectly instead ofReact.FC.
4-6: Add JSDoc comments to the interface.The interface is clear and concise. To improve documentation, consider adding JSDoc comments.
Here's a suggested improvement:
+/** + * Props for the PasswordStrengthMeter component. + */ interface PasswordStrengthMeterProps { + /** The password string to evaluate. */ password: string; }
8-29: LGTM! Consider using object destructuring for props.The component implementation looks good. It effectively uses the utility functions and provides a clear visual representation of password strength. For consistency with modern React practices, consider using object destructuring for props.
Here's a suggested minor improvement:
-const PasswordStrengthMeter: React.FC<PasswordStrengthMeterProps> = ({ password }) => { +const PasswordStrengthMeter: React.FC<PasswordStrengthMeterProps> = ({ password }) => {This change makes the component more consistent with modern React practices and improves readability.
31-31: LGTM! Consider using named export for better tree-shaking.The default export is correct and commonly used. However, for better tree-shaking and more explicit imports, you might consider using a named export.
Here's an alternative approach:
-export default PasswordStrengthMeter; +export { PasswordStrengthMeter };This change would require updating the import statements where this component is used, but it can lead to better tree-shaking in larger applications.
apps/masterbots.ai/lib/password.ts (4)
2-11: Good implementation, consider additional security measures.The
calculatePasswordStrengthfunction provides a solid foundation for assessing password strength. It considers important factors such as length and character variety.To enhance security further, consider these improvements:
- Check for common patterns (e.g., '123', 'qwerty') or dictionary words.
- Implement a penalty for consecutive repeated characters.
- Use a library like zxcvbn for more comprehensive strength calculation.
Example implementation for checking repeated characters:
function hasRepeatedCharacters(password: string): boolean { return /(.)\1{2,}/.test(password); } // In calculatePasswordStrength: if (!hasRepeatedCharacters(password)) strength += 1;
13-27: Effective color mapping, consider handling edge cases.The
getPasswordStrengthColorfunction provides a clear and intuitive color scheme for different password strengths.Consider handling the edge case of negative strength values:
export function getPasswordStrengthColor(strength: number): string { if (strength < 0) { return '#EF4444'; // red-500 for invalid strength } // ... rest of the function remains the same }
29-43: Clear labeling, ensure consistency with color function.The
getPasswordStrengthLabelfunction provides clear and appropriate labels for different password strengths.For consistency with the
getPasswordStrengthColorfunction, consider handling negative strength values:export function getPasswordStrengthLabel(strength: number): string { if (strength < 0) { return 'Invalid'; } // ... rest of the function remains the same }
1-48: Solid implementation of password strength utilities.This file provides a comprehensive set of functions for assessing and categorizing password strength, which is crucial for the password recovery feature. The implementation is generally well-structured and follows good practices.
Key strengths:
- Clear and intuitive strength calculation
- Consistent color and label mapping
- Easy-to-use strength check function
While there are some minor suggestions for improvements (handling edge cases, additional security checks), the current implementation forms a strong foundation for password-related functionality in the application.
Consider creating a separate configuration file for password policy settings (e.g., minimum length, required character types) to make it easier to adjust the policy in the future without modifying the core logic.
apps/masterbots.ai/lib/utils.ts (2)
Line range hint
36-61: LGTM! Consider enhancing error handling.The changes to
extractBetweenMarkersfunction improve its flexibility by making theendMarkerparameter optional. The logic correctly handles cases whereendMarkeris not provided, maintaining backward compatibility.Consider enhancing the error handling by throwing a custom error when the start marker is not found, instead of returning the whole string. This would make the function's behavior more predictable and easier to debug. For example:
if (startIndex === -1) { throw new Error('Start marker not found in the string'); }
238-241: LGTM! Consider minor improvements for robustness.The
validateEmailfunction is a good addition for email validation. The implementation is correct and uses a common regex pattern for email validation.Consider the following improvements for increased robustness:
- Trim the input email to handle leading/trailing whitespace:
export const validateEmail = (email: string) => { const re = /^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/ return re.test(email.trim()) }
- For more comprehensive email validation, you might want to use a more robust regex pattern or consider using a well-maintained email validation library like
validator.js.apps/masterbots.ai/lib/email.ts (1)
18-18: Address the TODO: Update SendGrid configurationThe TODO comment indicates that the SendGrid configuration is temporary and needs to be updated for the chosen email provider. Please ensure the SMTP settings are correctly configured for production to avoid email delivery issues.
Would you like assistance in updating the SendGrid configuration to match your email provider's recommended settings?
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
📒 Files selected for processing (9)
- apps/masterbots.ai/app/api/auth/forgot-password/route.ts (1 hunks)
- apps/masterbots.ai/app/api/auth/reset-password/route.ts (1 hunks)
- apps/masterbots.ai/components/auth/forgot-password-form.tsx (1 hunks)
- apps/masterbots.ai/components/auth/reset-password-form.tsx (1 hunks)
- apps/masterbots.ai/components/auth/signin-form.tsx (3 hunks)
- apps/masterbots.ai/components/shared/password-strength-meter.tsx (1 hunks)
- apps/masterbots.ai/lib/email.ts (1 hunks)
- apps/masterbots.ai/lib/password.ts (1 hunks)
- apps/masterbots.ai/lib/utils.ts (1 hunks)
🚧 Files skipped from review as they are similar to previous changes (3)
- apps/masterbots.ai/app/api/auth/forgot-password/route.ts
- apps/masterbots.ai/app/api/auth/reset-password/route.ts
- apps/masterbots.ai/components/auth/signin-form.tsx
🧰 Additional context used
🔇 Additional comments (4)
apps/masterbots.ai/lib/password.ts (1)
45-48: Well-implemented strength check.The
isPasswordStrongfunction effectively utilizes thecalculatePasswordStrengthfunction and sets a reasonable threshold for strong passwords. The comment clearly explains the requirement.apps/masterbots.ai/components/auth/forgot-password-form.tsx (2)
1-10: LGTM: Imports and component declaration are well-structured.The use of the 'use client' directive and the imports are appropriate for the component's functionality. The default export of the component follows React best practices.
1-70: Overall assessment: Well-structured component with room for enhancement.The ForgotPasswordForm component is generally well-implemented, providing the necessary functionality for password reset requests. However, there are several areas where the component can be improved:
- Implement rate limiting to prevent abuse of the password reset functionality.
- Enhance error handling and user feedback during the form submission process.
- Improve accessibility features for better screen reader support.
- Strengthen client-side email validation for a more responsive user experience.
By addressing these points, you can significantly enhance the robustness, security, and user-friendliness of the password reset feature. The suggested improvements align with best practices in React development and web accessibility standards.
apps/masterbots.ai/components/auth/reset-password-form.tsx (1)
1-12: LGTM: Imports and component declaration are well-structured.The imports cover all necessary dependencies, including UI components and custom utilities. The 'use client' directive is correctly used for client-side rendering, and the component prop is appropriately defined.
There was a problem hiding this comment.
Excellent work! 🚀 The additional functionalities to verify PW strength feature and the UX improvements looks very good and functionality looks good too 😄 I notice though some few improvements that we can do before to do the merge. After those updates, we are good to go!
Thaks @AndlerRL all suggestions are done 🚀 |
* devops: force deploy * devops: trigger automated build * devops: trigger automated build * devops: trigger automated build * devops: trigger automated build * devops: trigger automated build * devops: trigger automated build * devops: trigger automated build * impr(masterbots.ai): add return to browse on bot thread page view (#204) * ✨ Added back button to thread details page * ⚡️ changed char to svg * feat: ai gen 404 image for custom 404 error page (#210) * ⚡️ added custom error page * ⚡️ clean up * fix(masterbots.ai): terms page visibility and access * feat(masterbots.ai): consistent og image style design and dynamic metadata (#215) * feat: added og api endpoint * feat: design og image for dark mode * fix: file formated * fix: amend og image to pick current theme color and adapt * feat: added custom metadata to thread page * feat: added custom metadata to bot page * fix: clean up * fix: move bg to a component * fix: move og-image design to a component * fix: use variable for URL * fix: to slug func * ⚡️ Move and clean up UrlToSlug * fix(masterbots.ai): zod dependecy * fix: type error * fix: type error for metadata * fix: clean and build fix --------- Co-authored-by: Roberto Lucas <[email protected]> * fix(masterbots.ai): OG not redering (#224) * fix: og to render first letter of username if there's no avatar * fix: clean up * fix: clean up * fix(masterbots.ai): share function (#225) * feat: create action.ts * fix: upt share button * fix: add axios module * fix: add resend module * fix: update vercel env config * fix: split share function * fix: update share component * [coderabbitai] style: upt thread-user-actions condition Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> --------- Co-authored-by: Roberto Lucas <[email protected]> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * feat(hasura): update user db schema for pro users (#227) * feat: add get_free_month column to user table * feat: create referral table * feat: add is_blocked column to user table * feat: add pro_user_subscription_id column to user table * fix: upt metadata * fix: update relationship name * feat(hasura): add Ai Model Tracker To Threads (#229) * feat: create 'models' table AI models * fix: add 'model' column to 'thread' table with foreign key constraint * feat: add model_value into models * [masterbots.ai] feat: multi AI models integration (#228) * [masterbots.ai]feat:(multimodels-integration)add actions - helpers - routes * [masterbots.ai]feat:(multimodels-integration)add NextTopLoader * [masterbots.ai]feat:(multimodels-integration)add NextTopLoaders * [masterbots.ai]feat:(multimodels-integration)add new chat components * [masterbots.ai]chore:next version * [masterbots.ai]feat:(multimodels-integration)update use context * [masterbots.ai]feat:(multimodels-integration)icons update * [masterbots.ai]chore:command ui * [masterbots.ai]refactor:moving chat componets to folder * [masterbots.ai]feat:env checker * [masterbots.ai]feat:env guard * docs: site map diagram * [masterbots.ai] fix: multi AI models guard (#235) * fix-guards + dom warning * fix-rename env var - vercel name * chore(masterbots.ai): update payment terms & conditions (#233) * fix: update terms * fix: building error * fix: update terms content * fix: rm the older part at the bottom * feat(masterbots.ai): pro subscription payment + wizard (#226) * feat: added free card * feat: added animation to the plan card * feat: added more plan card and referral code link * fix: clean up * wip: wizard * feat: wizard & modal * feat: plan Design theme and modal Header and Footer * feat: plan clean up * update * clean up * fix: rm plan comp on browse page * fix: wizard clean up * feat: succes & error modal * feat: loading comp * feat: added checkout comp * feat: set up stripe and context * wip: implementing subscription * feat: implementing subscription * feat: payment reciept * fix: clean up receipt * fix: modal not showing & shallow routing * fix: small fix * fix: receipt comp * fix: clean up * fix: shallow rerouting * feat: check if user has an active subscription * fix: coderabbit ob * fix: coderabbit ob * fix: coderabbit clean up update * fix: coderabbit clean up update * fix: coderabbit clean up update * fix: clean up * fix: clean up * fix: page restructuring and status on the receipt * fix: revamp receipt and structure * fix: rm unused file * fix: clean up * fix: update & clean up * fix: update * fix: rm the svg * fix: revamp formatSystemPrompts * fix: revamp msg to formatSystemPrompts * fix: update * fix: refactor the receipt page * fix: rm public key * fix: update * fix: update * fix: update * fix: code refactor for error and loading rendering * ref: calling secret keys from server * ref: receipt page and small fix * fix: rm file * fix(impr): subs & flow ux + cleanup * fix(masterbots.ai): OG not redering (#224) * fix: og to render first letter of username if there's no avatar * fix: clean up * fix: clean up * fix(masterbots.ai): share function (#225) * feat: create action.ts * fix: upt share button * fix: add axios module * fix: add resend module * fix: update vercel env config * fix: split share function * fix: update share component * [coderabbitai] style: upt thread-user-actions condition Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> --------- Co-authored-by: Roberto Lucas <[email protected]> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * feat(hasura): update user db schema for pro users (#227) * feat: add get_free_month column to user table * feat: create referral table * feat: add is_blocked column to user table * feat: add pro_user_subscription_id column to user table * fix: upt metadata * fix: update relationship name * feat(hasura): add Ai Model Tracker To Threads (#229) * feat: create 'models' table AI models * fix: add 'model' column to 'thread' table with foreign key constraint * feat: add model_value into models * [masterbots.ai] feat: multi AI models integration (#228) * [masterbots.ai]feat:(multimodels-integration)add actions - helpers - routes * [masterbots.ai]feat:(multimodels-integration)add NextTopLoader * [masterbots.ai]feat:(multimodels-integration)add NextTopLoaders * [masterbots.ai]feat:(multimodels-integration)add new chat components * [masterbots.ai]chore:next version * [masterbots.ai]feat:(multimodels-integration)update use context * [masterbots.ai]feat:(multimodels-integration)icons update * [masterbots.ai]chore:command ui * [masterbots.ai]refactor:moving chat componets to folder * [masterbots.ai]feat:env checker * [masterbots.ai]feat:env guard * docs: site map diagram * feat: set up stripe and context * wip: implementing subscription * fix: rm the svg * fix: replace secret with variable * fix: chat restructure * fix(update): chat restructure * fix(deployment error): can't find an icon or not exported * fix: deployment issues * fix: deployment issues * fix: deployment issues * fix: adjust design * fix: clean up * fix: clean up * fix: color var updaye * [coderabbitai] impr: update apps/masterbots.ai/components/stripe-element.tsx Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * [coderabitai] impr: update apps/masterbots.ai/components/succes-content.tsx Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * fix: success close button * fix: bg image for yearly card * fix: move func to util * ref: receipt page function to use reac-use * fix: move depencies to the app * fix: clean up * ref: wizard to use radix dialog components * update * fix: coderabitai update --------- Co-authored-by: Roberto Lucas <[email protected]> Co-authored-by: Nathanael Liu <[email protected]> Co-authored-by: Roberto Lucas <[email protected]> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: Brandon Fernández <[email protected]> * [masterbots.ai] fix: llama3 models (#236) * fix-guards + dom warning * fix-rename env var - vercel name * fix-changed PERPLEXITY-LLama model * [masterbots.ai] impr(fix): ui tweaks (#237) * fix(UI):varius UI fixes * fix(UI):varius UI fixes * fix(UI): Tailwind class corrections, conflict resolution, text alignent to the left * fix(UI):update * fix(masterbots.ai): payment feedbacks (#240) * fix: make the dialog content responsive * fix: free plan card adjusted * fix: update * fix: update receipt styles * fix: build error * fix: build error * fix: build error update * fix: update * fix: observation * fix(masterbots.ai): update env variable (#244) * feat: sitemap (#238) * feat: add redirection rules * fix: update all links with new shorten urls * fix: update all links with new shorten urls * feat: make folder structure according to sitemap * [coderabbitai] impr(masterbots.ai): update app/c/page.tsx error handling Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * [coderabbitai] impr(masterbots.ai): update app/c/[category]/[chatbot]/page.tsx error handling Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * fix: build error * [coderabbitai] impr(masterbots.ai): update app/c/[category]/[chatbot]/page.tsx error handling Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * feat: add sitemap and metagraph * fix: use original generateMetadata * fix: update page links * fix: show only filtered threads on page reload * fix: build error --------- Co-authored-by: Roberto Lucas <[email protected]> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * fix(masterbots.ai): show first question & answer in thread list (#246) * feat: add 'disabled' state to ChatAccordion * fix: show default question's answer in thread list * fix: use braces and create explicit statement blocks * fix: subscription mobile responsive tweaks (#245) * update * fix: update * fix: responsiveness * fix: update * fix: few clean up * fix: rm unused image * fix: rm unused image * fix(impr): models enum table migrations (#247) * impr(hasura): db tables * impr(hasura): db tables * fix(hasura): user permissions * impr(hasura): sql models enum migration * fix(hasura): models_enum pk * fix(hasura): ci/cd default regional log bucket * docs: bun to requirements (#250) Co-authored-by: b <b> * feat: next auth, email/pw strategy (#249) * (masterbots.ia)-chore-auth-dependencies * (masterbots.ia)-feat-webauth-nextauth * wip(masterbots.ai): email/pw login + signup * feat-login ui * feat-login-component+page * feat-login-component+page * feat-auth-middleware.ts * feat-auth-nextauth + googleauth * feat-auth-coderabit-feedback * feat-auth-callback + elements added * wip(webapp): email/pw login+signup * feat:add toke storage for webauth * feat:updates webauth * feat:updates webauth * fix(masterbots.ai): blankBot fetch --------- Co-authored-by: Roberto Lucas <[email protected]> Co-authored-by: Roberto Romero Lucas <[email protected]> * docs: mb sytem diagram v1.0a * feat(impr): next auth environment helper function (#251) * (masterbots.ia)-chore-auth-dependencies * (masterbots.ia)-feat-webauth-nextauth * wip(masterbots.ai): email/pw login + signup * feat-login ui * feat-login-component+page * feat-login-component+page * feat-auth-middleware.ts * feat-auth-nextauth + googleauth * feat-auth-coderabit-feedback * feat-auth-callback + elements added * wip(webapp): email/pw login+signup * feat:add toke storage for webauth * feat:updates webauth * feat:updates webauth * fix(masterbots.ai): blankBot fetch * feat:protecting env --------- Co-authored-by: Roberto Lucas <[email protected]> Co-authored-by: Roberto Romero Lucas <[email protected]> * impr(masterbots.ai): sign up form + sign in session data * docs: claude3 project knowledge docs * fix(masterbots.ai): devMode conditional * chore(masterbots.ai): rm console.log * chore: upt default hardcoded gpt model * fix: toSlug imports * fix: typo * fix(hasura): seeds * chore(impr): MB seeds update and upgrade (#253) * wip: upt seeds * chore: rm alter and table creations * chore(impr): MB seeds update and upgrade * fix: set thread to private by default * fix: prompt row typo * chore(hasura): seeds update default thread publicity * fix(masterbots.ai): adjust arrow direction in thread list (#255) * feat(impr): Vercel AI SDK Update (#256) * chore:ai version upt * chore:ai version upt * upt-ai delete * upt-ai versions * upt-sdk-actions * upt-complete-sdk-3.3 + dev notes * upt-@anthropic-ai/sdk + MessageParam * Delete apps/masterbots.ai/apps/masterbots.ai/package.json * Delete apps/masterbots.ai/apps/masterbots.ai/package-lock.json * impr-convertToCoreMessages ternary * Leandro/develop (#257) * chore: create thread-component to avoid to become thread list into a client component * refactor: remove unnecesary hooks from thread component * refactor: remove unnecesary hooks on thread componen * impr(masterbots): components folder structur (#259) * impr:refactor components folders + names + imports * hotfix:chat-list useEffect dependency removal * fix(masterbots): google signIn (#260) * fix(masterbots.ai): fix thread-component loop (#261) * fix:(masterbots.ai) add useScroll hook (#263) * fix:introducing Two-phase scroll * impr: new hook to handle scrolling * impr: useScroll + respo * feat(masterbots.ai): chat sidebar filtering (#264) * sidebar refactor with ai * fix: sidebar AI V - Prev Jun (#262) * fix:semistable * fix:stable v * impr:delete nonused component * fix: upt category filtering * fix typo --------- Co-authored-by: Roberto Lucas <[email protected]> * feat: sidebar state * fix(masterbots.ai): logic typo * fix(masterbots.ai): ts typo --------- Co-authored-by: Jun Dam <[email protected]> Co-authored-by: Brandon Fernández <[email protected]> * fix(masterbots.ai): bot button redirect change (#265) * wip(masterbots.ai): seo data impr (#267) * wip: seo data impr * impr(chore): ga tags * feat: add chat publicity trigger (#258) * update * feat: design thread visibilty * fix: added the backend * fix: added the backend * fix: rm files * fix: few clean up * fix(masterbots): google signIn (#260) * feat: design thread visibilty * fix: added the backend * fix: few clean up * Leandro/develop (#257) * chore: create thread-component to avoid to become thread list into a client component * refactor: remove unnecesary hooks from thread component * refactor: remove unnecesary hooks on thread componen * impr(masterbots): components folder structur (#259) * impr:refactor components folders + names + imports * hotfix:chat-list useEffect dependency removal * feat: design thread visibilty * fix: added the backend * fix: few clean up * fix: update * fix: add permission * fix: update query * fix(masterbots.ai): fix thread-component loop (#261) * feat: design thread visibilty * fix: added the backend * fix: few clean up * feat: design thread visibilty * fix: added the backend * fix: few clean up * Leandro/develop (#257) * chore: create thread-component to avoid to become thread list into a client component * refactor: remove unnecesary hooks from thread component * refactor: remove unnecesary hooks on thread componen * impr(masterbots): components folder structur (#259) * impr:refactor components folders + names + imports * hotfix:chat-list useEffect dependency removal * feat: design thread visibilty * fix: added the backend * fix: few clean up * update * fix: update * fix: publicity toggle * fix: error catch in the functions * fix: observations * fix: design impr * fix: thread pop-up height * chore(masterbots.ai): log rm & app version upt --------- Co-authored-by: Roberto Lucas <[email protected]> Co-authored-by: Leandro Gavidia Santamaria <[email protected]> Co-authored-by: Brandon Fernández <[email protected]> Co-authored-by: Roberto Lucas <[email protected]> * feat(masterbots.ai): user messages ai refactor (#266) * feat:userMessages refactor + hooks and utils * upt:rm console.log * fix:rollback useAiChat hook * fix:rollback - actions * fix(masterbots.ai): sidebar trigger * chore(hasura: s --------- Co-authored-by: Roberto Lucas <[email protected]> * wip: browse sidebar * impr(masterbots.ai): browse sidebar (#270) * fix: browse layout * feat(masterbots.ai): browse sidebar * fix: browse sidebar link condition * chore: upt signup default profile pic * chore: seeds upt (#269) * wip: seeds upt * chore(hasura): seeds review * feat(hasura): add "is_approved" thread field + seeds * chore: mb-genql upt * fix(hasura): thread param permission * fix(masterbots.ai): typo * fix(masterbots.ai): allow svg content-type * fix: chat + browse layout * style: clean up * Seo data (#273) * fix: build error * feat: Add SEO data to the chat page * feat: add default image, if not found * feat: Add SEO data to the browse page * fix: generates the image with error, in api/og * Update route.tsx fix: generates the image with error, in api/og * impr(masterbots.ai): title impr prompt * impr(masterbots.ai): improve current features v2 (#274) * add-impr-chat-prompt-footer-header-disclaimer * add-impr-chat-prompt-footer-header-disclaimer * add-UI-upt * add-UI-upt * add-action-prompt * add-clickable-upt * add-clickable-upt * Masterbots/fix redirects (#275) * fix:avatar-redirects * fix:avatar-redirect * fix(masterbots.ai): upt components/ui/button.tsx Coderabbitai suggestion. Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * fix:URL correction --------- Co-authored-by: Roberto Lucas <[email protected]> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * [masterbots.ai] feat: wordware api (#276) * feat: add wordware api + vercel sdk strategy * feat: add wordware api + vercel sdk * wordware describe feat * wordware run + interface * impr(masterbots.ai): upt /api/wordware/describe/route.ts coderabbitai code suggestion. Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * impr(masterbots.ai): upt /api/wordware/describe/route.ts coderabbitai code suggestion. Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * fix(masterbots.ai): typo /api/wordware/describe/route.ts coderabbitai code suggestion. Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> --------- Co-authored-by: Roberto Lucas <[email protected]> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * doc: mb system diagram upt * wip: icl calls integrations * impr(masterbots.ai): permission for thread & user action mode (#281) * update * feat: added permissions & new column * fix: rm unnessecary files * fix: rm permission check * feat(masterbots.ai): create password recovery (#282) * feat:add-recovery-strategy * chore:add nodeemailer * upt:hasura * upt:hasura * upt:gmail service * feat(hasura): otp, token table + junction w/user + mb-genql gen * feat:add recovery password API * fix:ai suggestion + UX * feat:improve ux show password feat * chore:env sample * chore:useSetState * chore:roles --------- Co-authored-by: Roberto Lucas <[email protected]> * [masterbots.ai] impr: WW API sanitize and keep alive (#284) * keep-alive + API sanitize + timeOut guard * impr streamAndValidateResponse fn * wip(masterbots.ai): impr createImprovementPrompt * style(masterbots.ai): chat loading states comments * feat(masterbots.ai): add admin mode to approve thread (#283) * feat:added mode toggle and approve btn * feat: added migration for user role * feat: user role flow implet * fix: impr admin approve process * fix: clean up * fix: toggle CTA changed * fix: update * fix: update * fix: observ * fix: obs clean up * fix: update * fix: clean up * impr(masterbots.ai): alpha metadata chatbot labels (#288) * wip: metadata chatbot labels * wip(masterbots.ai): chatbot metadata labels * impr(masterbots.ai): gen chatMetadata * impr: simplifying prompt defitions + biome.json base config * impr(masterbots.ai): recursive improved text prompt * style: code comments + eslint chk * impr: biome.json config * fix(masterbots.ai): conflicts typo fix * style(impr): cleanPrompt + followingQuestionsPrompt relocation & cleanup * doc: map system (simplified) * fix(masterbots.ai): sideBar updating URL (#286) * fix:sideBar updating URL * feat: coderabbit-ai suggestions * fix: Implement auto-expanding sidebar categories and chatbot highlighting based on URL * feat: optimize sidebar navigation with Link * feat: thread options (#287) * feat: added verified and label to the options * usethreadvisibility as context * feat: added option design and functions * fix: clean up * fix: update * fix: update * fix: obsv * fix: merge and update * fix: update the delete popup * fix: observ * fix: update * fix: delete thread flow * update * fix: update * fix: types * fix: chatbot not required * fix: testing * fix: rm bun.lock * fix: clean up * fix: update * fix(masterbots.ai): temp freezing next version --------- Co-authored-by: Roberto Lucas <[email protected]> * [masterbots.ai] feat: email verification (#289) * feat: email verification * feat: email verification * feat: email verification * upt:build * feat: handle error redirection * chore:cron task * upt: cron blocking instead erasing * feat(hasura): create social following table. (#292) * feat(db): create social following table. * create user following and followers relationships. * fix(db): ensure users can only manage their own follow relationships. * feat(db): social following and user table permissions improvements. * feat(db): improving social following table with timestamp and idx. * impr(db): permissions and tracked object relationships. * impr(db): avoid self follow. * chore(masterbots.ai): guard WordWare for prod routing * [masterbots.ai] fix: public/private tag bg on dark mode (#294) * fix: tag bg * fix: text color * fix: browse page error * fix: debugging * fix: debugging * fix: debugging * fix: added func to generate short link * fix(hasura): upt user permissions (#296) * update user permission * fix: reverse the following table * fix(hasura): build error (#297) * fix: error build * fix: reverse select perm --------- Co-authored-by: Gabo Esquivel <[email protected]> Co-authored-by: Jimoh sherifdeen <[email protected]> Co-authored-by: Nathanael Liu <[email protected]> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: Brandon Fernández <[email protected]> Co-authored-by: Anouk Rímola <[email protected]> Co-authored-by: Trivium <[email protected]> Co-authored-by: Leandro Gavidia Santamaria <[email protected]> Co-authored-by: Jun Dam <[email protected]> Co-authored-by: Luis Carrión <[email protected]> Co-authored-by: Marco Ledezma <[email protected]>
Summary
Introduce a password recovery feature with endpoints for requesting and resetting passwords, along with UI components for user interaction. Implement email functionality to facilitate password reset requests. Update Hasura metadata to support the new feature and refactor Taskfile.yml for improved consistency.
New Features:
Enhancements:
Note: MAILTRAP_USER and MAILTRAP_PASS are added as env variables and are crucial for testing
Summary by CodeRabbit
Summary by CodeRabbit
Release Notes
New Features
Bug Fixes
Chores
Dependencies
nodemailerfor email handling functionality.Preview video:
Screen.Recording.2024-10-07.at.11.42.04.PM.mov
Password Strength - UX
Screen.Recording.2024-10-08.at.1.26.55.AM.mov
Password Reveal - UX
Screen.Recording.2024-10-08.at.2.36.53.PM.mov