Skip to content

Deployment update#222

Merged
Rufat00 merged 8 commits intodevfrom
deployment_update
Feb 26, 2026
Merged

Deployment update#222
Rufat00 merged 8 commits intodevfrom
deployment_update

Conversation

@Rufat00
Copy link
Collaborator

@Rufat00 Rufat00 commented Feb 12, 2026

Why

A lot of unused code and libraries.

What

Deleting them all

Satisfies

https://linear.app/acmutsa/issue/HK-222/remove-unnecessary-packages
#215

Summary by CodeRabbit

  • Refactor

    • Removed tRPC API/client and related real-time/ticket flows; several admin and ticket pages/components were removed.
    • Eliminated per-file Edge runtime flags (now default runtime).
    • Centralized many form field constants into a shared config module.
    • Removed email-sending/template and backup/migration utilities.
  • Chores

    • Environment variables cleaned up and HK_ENV -> NODE_ENV standardized.
    • Adjusted ignore rules and trimmed runtime dependencies; added start and db:seed scripts.

@coderabbitai
Copy link

coderabbitai bot commented Feb 12, 2026

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

  • Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between 2f44af4 and b00c111.

📒 Files selected for processing (1)
  • apps/web/src/app/admin/users/[slug]/page.tsx

📝 Walkthrough

Walkthrough

Removes backup microservice and infrastructure migrator, strips tRPC server/client and many ticket/chat features, deletes several utilities (SES, zfetch, email template), centralizes config constants, replaces HK_ENV with NODE_ENV, and removes numerous per-file Edge runtime exports across the web app.

Changes

Cohort / File(s) Summary
Microservice & Migrator
apps/backups/*, apps/infrastructure-migrator/*
Deleted backup Cloudflare Worker service and infrastructure-migrator tool, including configs, package manifests, env helpers, and implementation logic.
tRPC & API Layers
apps/web/src/server/api/*, apps/web/src/trpc/*, apps/web/src/app/api/trpc/[trpc]/route.ts
Removed server-side routers, context, trpc setup, client React integration, query client, and the API route handler.
Edge Runtime Removals
apps/web/src/app/**/*.tsx, apps/web/src/components/**/*.tsx
Removed ~40 per-file exports export const runtime = "edge" (pages/components) without other logic changes.
Web Runtime Dependencies
apps/web/package.json
Removed many runtime deps (tRPC, React Query, SES, Vercel packages, UI libs); moved build/dev packages to devDependencies.
Email & HTTP Utilities
apps/web/src/lib/utils/server/ses.ts, apps/web/src/lib/utils/client/zfetch.ts, apps/web/src/emails/RegistrationSuccessEmail.tsx, apps/web/src/lib/utils/server/types.ts
Deleted SES sendEmail, zod-based zfetch helpers, registration email component, and related email props type.
Tickets & Chats Removal
apps/web/src/components/dash/tickets/*, apps/web/src/app/dash/tickets/*, packages/db/schema.ts
Removed ticket UI (pages, TicketList, layout), deleted ticketsRouter, and commented/removed ticket/chat tables and relations in DB schema.
Config Restructure
packages/config/constants.ts (new), packages/config/hackkit.config.ts, packages/config/package.json
Extracted many form-option constants into new module; updated hackkit.config to import them; added devDependencies entry.
Timezone / Cloudflare Context
apps/web/src/app/*/page.tsx, apps/web/src/components/schedule/Day.tsx, apps/web/next.config.mjs
Replaced cf.timezone/getRequestContext usage with config-based timezone (c.hackathonTimezone); removed Cloudflare dev setup import.
Middleware & Env Changes
.env.example, apps/web/src/env.ts, apps/web/src/middleware.ts, apps/web/src/lib/utils/server/redis.ts, turbo.json, package.json
Commented many env vars in example, removed AWS SES keys from env schema, switched HK_ENV → NODE_ENV, narrowed middleware matcher to exclude trpc, added scripts and turbo start task.
Authorization & Restricted UI
apps/web/src/app/admin/users/[slug]/page.tsx, apps/web/src/components/admin/users/UpdateRoleDialog.tsx, apps/web/src/components/Restricted.tsx
Wrapped UpdateRoleDialog with Restricted checks, made UpdateRoleDialog synchronous, and tightened Restricted position comparisons (strict === checks).
Dashboard & Layout Changes
apps/web/src/app/dash/layout.tsx, apps/web/src/app/dash/*
Replaced user retrieval with getCurrentUser, added approval redirect, removed TRPC provider wrapper, restructured header/nav and bottom navigation; removed runtime exports.
Gitignore & Packaging
apps/web/.gitignore, apps/backups/.gitignore, apps/backups/package.json
Added certificates ignore to web; removed many entries from backups .gitignore; deleted backups package.json.
Misc Removal: zfetch of client, ses, TRPC route, query client, react TRPC provider
apps/web/src/lib/utils/client/zfetch.ts, apps/web/src/trpc/*, apps/web/src/server/api/*
Deleted assorted client/server utilities and integrations supporting API and serialization flows.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Poem

🐰 I hopped through code, nibbling routers and queues,
Backups tucked away, and old envs bemuse.
Constants gathered in one tidy heap,
Tickets and chats now softly asleep.
NODE_ENV rises — a clean start to keep.

🚥 Pre-merge checks | ✅ 1 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check ❓ Inconclusive The title 'Deployment update' is vague and does not clearly convey the main objective of removing unnecessary packages and code. Consider a more descriptive title such as 'Remove unnecessary packages and dependencies' or 'Clean up unused code and libraries' to better reflect the changeset's primary goal.
✅ Passed checks (1 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
  • 📝 Generate docstrings (stacked PR)
  • 📝 Generate docstrings (commit on current branch)
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch deployment_update

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 8

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (4)
apps/web/src/components/admin/users/UpdateRoleDialog.tsx (1)

89-94: ⚠️ Potential issue | 🔴 Critical

Bug: Both badges display the current role name instead of showing the transition.

The footer is intended to show a visual "old role → new role" transition, but Line 93 renders currentRoleName again instead of the newly selected role's name. The second <Badge> should display the name of roleToSet.

🐛 Proposed fix
 				{roleToSet !== currentRoleId ? (
 					<div className="flex h-full w-full items-center justify-center gap-x-2 self-end sm:justify-start">
 						<Badge>{currentRoleName}</Badge>
 						<span>&rarr;</span>
-						<Badge>{currentRoleName}</Badge>
+						<Badge>
+							{titleCase(
+								roles.find((r) => r.id === roleToSet)?.name.replace("_", " ") || "",
+							)}
+						</Badge>
 					</div>
 				) : null}
apps/web/src/app/admin/users/[slug]/page.tsx (1)

149-156: ⚠️ Potential issue | 🟠 Major

Mobile UpdateRoleDialog is not wrapped in <Restricted> unlike the desktop version.

The desktop path (Lines 80–92) gates UpdateRoleDialog behind a <Restricted> permission check for CHANGE_USER_ROLES, but the mobile dropdown renders it unconditionally. This appears to be a pre-existing issue, but since both paths are being touched in this PR it would be a good time to fix it.

🛡️ Proposed fix — wrap the mobile role dialog in Restricted
-						<div className="cursor-pointer rounded-sm px-2 py-1.5 text-center text-sm hover:bg-accent">
-							<UpdateRoleDialog
-								name={`${subject.firstName} ${subject.lastName}`}
-								currentRoleId={subject.role_id}
-								userID={subject.clerkID}
-								roles={roles}
-							/>
-						</div>
+						<Restricted
+							user={admin}
+							permissions={PermissionType.CHANGE_USER_ROLES}
+							targetRolePosition={subject.role.position}
+							position="higher"
+						>
+							<div className="cursor-pointer rounded-sm px-2 py-1.5 text-center text-sm hover:bg-accent">
+								<UpdateRoleDialog
+									name={`${subject.firstName} ${subject.lastName}`}
+									currentRoleId={subject.role_id}
+									userID={subject.clerkID}
+									roles={roles}
+								/>
+							</div>
+						</Restricted>
packages/db/schema.ts (1)

61-72: ⚠️ Potential issue | 🟡 Minor

chatType is now dead code.

The only consumer of chatType was the chats table definition, which is now commented out. This custom type should be removed along with the commented-out schema.

apps/web/src/app/dash/layout.tsx (1)

20-25: ⚠️ Potential issue | 🟠 Major

Duplicate getUser call — fetch once and reuse.

getUser(clerkUser.id) is called on line 20 and again on line 24 with the same argument. The second call is redundant since the first already guards against undefined. Store the result once:

🔧 Proposed fix
-	if (!clerkUser || (await getUser(clerkUser.id)) == undefined) {
+	if (!clerkUser) {
 		return redirect("/register");
 	}
 
 	const user = await getUser(clerkUser.id);
 	if (!user) return redirect("/register");
🤖 Fix all issues with AI agents
In `@apps/web/src/components/admin/users/UpdateRoleDialog.tsx`:
- Around line 42-44: The currentRoleName computation (and the similar code
around the role label rendering) uses .replace("_", " ") which only replaces the
first underscore; change those to use either .replaceAll("_", " ") or
.replace(/_/g, " ") so all underscores in the role name (e.g.,
"super_admin_user") are replaced; update the expression where currentRoleName is
set (roles.find((r) => r.id === currentRoleId)?.name.replace(...)) and the
analogous code used later (the role label/rendering block) to use the global
replace variant.

In `@apps/web/src/components/Restricted.tsx`:
- Around line 26-43: The position checks in the Restricted component are
inverted: replace the current truthy/inequality checks with explicit comparisons
to compareUserPosition(user, targetRolePosition) so "higher" uses === 1, "lower"
uses === -1, and "equal" uses === 0 (locate the checks using the position
variable and compareUserPosition call in the Restricted component and update
those three conditionals to the explicit numeric comparisons so children render
only for the correct authorization cases).

In `@Dockerfile`:
- Around line 40-43: The Next.js build isn't producing .next/standalone because
the Next config lacks output: "standalone"; open next.config.js and add the
property output: "standalone" to the exported nextConfig (e.g., in the
nextConfig object or default export) so the build generates .next/standalone and
.next/static that the Dockerfile's COPY --from=builder commands (referencing
.next/standalone and .next/static) can use.
- Around line 12-14: The Dockerfile's deps stage only copies root
package.json/pnpm-lock and runs RUN pnpm install --frozen-lockfile, but pnpm
needs all workspace package.json manifests to resolve workspace packages; update
the COPY step (the COPY package.json pnpm-lock.yaml pnpm-workspace.yaml* .npmrc*
./ line) to also copy each workspace manifest (e.g., apps/web/package.json,
apps/bot/package.json, packages/config/package.json, packages/db/package.json,
packages/devtunnel/package.json, packages/tsconfig/package.json) into the build
context before RUN pnpm install, or alternatively replace this approach with a
turborepo prune flow (e.g., using turbo prune --scope=web --docker to produce a
pruned lockfile) so RUN pnpm install --frozen-lockfile can succeed.

In `@packages/config/constants.ts`:
- Line 444: The string constant option "Cinematography/Film/Vide Production" in
packages/config/constants.ts contains a typo; update that option value to
"Cinematography/Film/Video Production" wherever it's defined (search for the
exact string "Cinematography/Film/Vide Production" in the file and replace it
with "Cinematography/Film/Video Production") so the user-facing form selection
shows the correct "Video" spelling.

In `@packages/config/hackckit.deploy.ts`:
- Around line 1-54: The file name contains a typo: rename the file from
hackckit.deploy.ts to hackkit.deploy.ts and update any imports that reference it
so modules continue to import the deployConfig export; specifically ensure
references to the exported symbol deployConfig (from this file) are updated to
the new filename and verify consistency with the sibling hackkit.config.ts.

In `@packages/db/index.ts`:
- Line 5: The shared package's top-level import "server-only" in
packages/db/index.ts breaks non-RSC Node scripts like
packages/db/seeders/seed.ts; remove that import from the package entrypoint and
either (A) move the import into the consuming app (e.g., add import
"server-only" to the server entry in apps/web where DB is used in RSC), or (B)
add a separate server-only entrypoint (e.g., packages/db/server.ts) that imports
"server-only" and re-exports the same exports as packages/db/index.ts, then
update RSC consumers to import from that server-only entrypoint while seed
scripts continue to import the plain packages/db export. Ensure all references
to the original index remain valid or update them to the new server entry where
RSC-only behavior is required.

In `@turbo.json`:
- Around line 40-44: The "start" task in turbo.json is marked as persistent
(persistent: true) but also has caching enabled (cache: true), which is invalid
for long-running tasks; update the "start" task configuration to set cache to
false so Turborepo doesn't attempt to cache a persistent task — locate the
"start" task entry and change its "cache" value from true to false while leaving
"persistent": true and "dependsOn": ["^build"] as-is.
🧹 Nitpick comments (5)
packages/db/schema.ts (1)

74-82: Prefer deleting dead code over commenting it out.

These ~100 lines of commented-out schema definitions (ticket/chat tables, relations, enums) add noise. Git history preserves the old code if it's ever needed again. Consider removing the comments entirely.

Also applies to: 333-433

packages/db/index.ts (1)

9-12: Non-null assertion on env vars with no validation.

process.env.TURSO_DATABASE_URL! will silently pass undefined to the client if the env var is missing, likely causing a cryptic runtime error. This is pre-existing code, but since you're touching this file, consider adding a startup check or using a schema validator (e.g., Zod) for env vars.

Dockerfile (1)

49-50: HOSTNAME should use the ENV key-value form consistently.

Minor: HOSTNAME="0.0.0.0" works but the quotes are unnecessary in Dockerfile ENV directives (unlike lines 32, 35, 49 which don't use quotes). This is purely cosmetic — no functional issue.

packages/config/hackckit.deploy.ts (1)

1-54: Silent empty-string fallbacks for secrets can mask misconfiguration.

Every secret (AWS credentials, Clerk secret key, Discord bot token, etc.) falls back to "" if the env var is missing. This means the app will start successfully but fail at runtime with opaque errors (e.g., unauthorized API calls). Consider throwing at startup if required secrets are absent, or at minimum use a schema validator like @t3-oss/env-nextjs (already a dependency) to enforce required variables.

packages/config/hackkit.config.ts (1)

136-137: Pre-existing bug: Sunday is outside the days object.

Not introduced in this PR, but Sunday (line 137) sits at the top level of c rather than inside days alongside Saturday. This is likely unintentional.

	days: {
		Saturday: new Date(2023, 6, 15),
	},
	Sunday: new Date(2023, 6, 16),  // ← should be inside `days`

@cloudflare-workers-and-pages
Copy link

cloudflare-workers-and-pages bot commented Feb 12, 2026

Deploying hackkit with  Cloudflare Pages  Cloudflare Pages

Latest commit: b00c111
Status:🚫  Build failed.

View logs

Copy link
Contributor

@joshuasilva414 joshuasilva414 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please address the issues that coderabbit added (especially the misspellings and the critical/major issues). Everything else looks good, so I will approve the PR as soon as those are resolved

Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (2)
apps/web/package.json (2)

51-51: ⚠️ Potential issue | 🔴 Critical

Remove unused and invalid link: dependency entry.

"nextjs@4": "link:clerk/nextjs@4" will break pnpm install. The pnpm link: protocol resolves to a local filesystem path, but ./clerk/nextjs@4 does not exist in this repository. Additionally, this alias is not referenced anywhere in the codebase, so it can be safely removed.

🐛 Proposed fix
-    "nextjs@4": "link:clerk/nextjs@4",
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@apps/web/package.json` at line 51, Remove the invalid unused dependency entry
"nextjs@4": "link:clerk/nextjs@4" from the package.json dependencies; locate the
string "nextjs@4" in the dependencies section, delete that key/value pair, and
then run your package manager (pnpm install) to ensure the lockfile and
node_modules are updated.

30-30: ⚠️ Potential issue | 🟡 Minor

Remove unused @react-email/components dependency.

This package is no longer imported anywhere in the codebase after email template removal. Remove it from package.json.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@apps/web/package.json` at line 30, Remove the unused dependency entry
"@react-email/components" from the apps/web package.json and update the lockfile
by running your package manager (npm install or yarn install) so the dependency
is fully removed from node_modules and lock files; verify no imports reference
"@react-email/components" and run the test/build to ensure nothing breaks.
🧹 Nitpick comments (1)
apps/web/package.json (1)

81-81: Inconsistent version pinning: esbuild-register uses ^ while all other devDependencies are exact-pinned.

♻️ Proposed fix
-    "esbuild-register": "^3.5.0",
+    "esbuild-register": "3.5.0",
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@apps/web/package.json` at line 81, The devDependency "esbuild-register" is
using a caret range (^3.5.0) while other devDependencies are pinned exactly;
update the package.json entry for "esbuild-register" to an exact version string
(e.g., "3.5.0") to match the project's exact-pinning convention so version
resolution is consistent across environments.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@apps/web/package.json`:
- Line 75: Remove the orphaned dependency "@cloudflare/next-on-pages" from
devDependencies in package.json (it's a leftover from Cloudflare Workers);
delete the entry for "@cloudflare/next-on-pages": "^1.13.10", run your package
manager to update the lockfile (npm/yarn/pnpm install) and ensure there are no
remaining imports or references to "@cloudflare/next-on-pages" anywhere in the
codebase (search for the package name) before committing.

---

Outside diff comments:
In `@apps/web/package.json`:
- Line 51: Remove the invalid unused dependency entry "nextjs@4":
"link:clerk/nextjs@4" from the package.json dependencies; locate the string
"nextjs@4" in the dependencies section, delete that key/value pair, and then run
your package manager (pnpm install) to ensure the lockfile and node_modules are
updated.
- Line 30: Remove the unused dependency entry "@react-email/components" from the
apps/web package.json and update the lockfile by running your package manager
(npm install or yarn install) so the dependency is fully removed from
node_modules and lock files; verify no imports reference
"@react-email/components" and run the test/build to ensure nothing breaks.

---

Nitpick comments:
In `@apps/web/package.json`:
- Line 81: The devDependency "esbuild-register" is using a caret range (^3.5.0)
while other devDependencies are pinned exactly; update the package.json entry
for "esbuild-register" to an exact version string (e.g., "3.5.0") to match the
project's exact-pinning convention so version resolution is consistent across
environments.

Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
apps/web/src/components/admin/users/UpdateRoleDialog.tsx (1)

82-88: ⚠️ Potential issue | 🟡 Minor

Incomplete fix: replace() still used in SelectItem rendering.

Lines 43 and 48 now correctly use replaceAll("_", " "), but line 85 still uses replace("_", " ") which only replaces the first underscore. This creates inconsistent display between the dropdown items and the badges.

🔧 Proposed fix
 {roles.map(({ id, name }) => {
 	return (
 		<SelectItem key={id} value={String(id)}>
-			{titleCase(name.replace("_", " "))}
+			{titleCase(name.replaceAll("_", " "))}
 		</SelectItem>
 	);
 })}
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@apps/web/src/components/admin/users/UpdateRoleDialog.tsx` around lines 82 -
88, In UpdateRoleDialog.tsx inside the roles.map rendering (the SelectItem
returned in the map), replace the call titleCase(name.replace("_", " ")) with
titleCase(name.replaceAll("_", " ")) so underscores are consistently converted
to spaces across the dropdown items (matching the other fixes) — update the
SelectItem rendering in the roles.map callback to use replaceAll on the name
before passing it to titleCase.
🧹 Nitpick comments (2)
packages/db/schema.ts (1)

150-152: Remove commented-out relation stubs to avoid schema drift.

Leaving these as comments keeps obsolete model paths in the source and makes the schema harder to trust as the single source of truth. Prefer deleting them entirely.

♻️ Proposed cleanup
-		// tickets: many(ticketsToUsers),
-		// chats: many(chatsToUsers),
-		// messages: many(chatMessages),
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@packages/db/schema.ts` around lines 150 - 152, Remove the commented-out
relation stubs in packages/db/schema.ts (the lines containing "tickets:
many(ticketsToUsers)", "chats: many(chatsToUsers)", and "messages:
many(chatMessages)") so they no longer live as commented artifacts in the schema
file; delete those comment lines entirely to prevent schema drift and ensure the
schema file remains the single source of truth.
apps/web/src/app/dash/layout.tsx (1)

77-80: Consider overflow handling for dynamic dash nav items.

Because c.dashPaths.dash is dynamic, the nav can clip on narrow screens. Making the row horizontally scrollable keeps all tabs reachable.

📱 Proposed refactor
-			<div className="flex h-12 w-full border-b border-b-border bg-nav px-5">
-				{Object.entries(c.dashPaths.dash).map(([name, path]) => (
-					<DashNavItem key={name} name={name} path={path} />
-				))}
-			</div>
+			<div className="h-12 w-full overflow-x-auto border-b border-b-border bg-nav px-5">
+				<div className="flex min-w-max">
+					{Object.entries(c.dashPaths.dash).map(([name, path]) => (
+						<DashNavItem key={name} name={name} path={path} />
+					))}
+				</div>
+			</div>
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@apps/web/src/app/dash/layout.tsx` around lines 77 - 80, The dash nav
container can overflow on narrow screens; update the wrapper div that renders
Object.entries(c.dashPaths.dash) to allow horizontal scrolling by adding
horizontal overflow and preventing wrapping (e.g., apply overflow-x-auto and
whitespace-nowrap / flex-nowrap utility classes) so all DashNavItem elements
remain reachable; ensure DashNavItem components still render as inline/flex
items so scrolling works correctly when mapping c.dashPaths.dash.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@apps/web/package.json`:
- Line 70: The package.json currently specifies a non-existent zod version
"3.25.67"; update the dependency entry for "zod" in package.json to an available
published version (for example "3.25.69" or "3.25.76") so npm install succeeds
and lockfiles remain consistent; ensure you run npm/yarn install afterwards to
regenerate package-lock.json or yarn.lock.

In `@apps/web/src/app/admin/users/`[slug]/page.tsx:
- Around line 148-164: The parent div with classes "cursor-pointer rounded-sm
px-2 py-1.5 text-center text-sm hover:bg-accent" creates an empty interactive
area when the Restricted component renders nothing; to fix, remove the outer div
and place those classes onto the element rendered inside Restricted (i.e., move
the wrapper div into Restricted's children) or wrap the entire div with
<Restricted ...> so that the div is only rendered when Restricted allows it;
update the JSX around Restricted and UpdateRoleDialog (and their props
currentRoleId/userID/roles) accordingly so no styled wrapper remains when access
is denied.

In `@apps/web/src/app/dash/layout.tsx`:
- Around line 55-64: In apps/web/src/app/dash/layout.tsx update the Next.js Link
usages that set target="_blank" (the Link wrapping the "Survival Guide" Button
and the Link wrapping the Discord Button) to also include rel="noopener
noreferrer" so external blank-opened links are secured; locate the Link
components around the Buttons and add the rel attribute to each Link tag.

---

Outside diff comments:
In `@apps/web/src/components/admin/users/UpdateRoleDialog.tsx`:
- Around line 82-88: In UpdateRoleDialog.tsx inside the roles.map rendering (the
SelectItem returned in the map), replace the call titleCase(name.replace("_", "
")) with titleCase(name.replaceAll("_", " ")) so underscores are consistently
converted to spaces across the dropdown items (matching the other fixes) —
update the SelectItem rendering in the roles.map callback to use replaceAll on
the name before passing it to titleCase.

---

Nitpick comments:
In `@apps/web/src/app/dash/layout.tsx`:
- Around line 77-80: The dash nav container can overflow on narrow screens;
update the wrapper div that renders Object.entries(c.dashPaths.dash) to allow
horizontal scrolling by adding horizontal overflow and preventing wrapping
(e.g., apply overflow-x-auto and whitespace-nowrap / flex-nowrap utility
classes) so all DashNavItem elements remain reachable; ensure DashNavItem
components still render as inline/flex items so scrolling works correctly when
mapping c.dashPaths.dash.

In `@packages/db/schema.ts`:
- Around line 150-152: Remove the commented-out relation stubs in
packages/db/schema.ts (the lines containing "tickets: many(ticketsToUsers)",
"chats: many(chatsToUsers)", and "messages: many(chatMessages)") so they no
longer live as commented artifacts in the schema file; delete those comment
lines entirely to prevent schema drift and ensure the schema file remains the
single source of truth.

ℹ️ Review info

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

  • Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between 0844411 and 2f44af4.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (8)
  • apps/web/package.json
  • apps/web/src/app/admin/users/[slug]/page.tsx
  • apps/web/src/app/dash/layout.tsx
  • apps/web/src/components/Restricted.tsx
  • apps/web/src/components/admin/users/UpdateRoleDialog.tsx
  • packages/config/constants.ts
  • packages/db/schema.ts
  • turbo.json
🚧 Files skipped from review as they are similar to previous changes (1)
  • turbo.json

Comment on lines +55 to +64
<Link href={c.links.guide} target="_blank">
<Button
variant={"outline"}
className="bg-nav hover:bg-background"
>
Survival Guide
</Button>
</Link>
<Link href={c.links.discord} target="_blank">
<Button
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🌐 Web query:

Next.js Link component target="_blank" rel="noopener noreferrer" automatic

💡 Result:

Next.js does not automatically add rel="noopener noreferrer" when you set target="_blank" on <Link>. <Link> just passes anchor (<a>) attributes (including target) through to the underlying <a> element. [1]

So you must set rel yourself (or use a wrapper component):

import Link from "next/link";

<Link
  href="https://example.com"
  target="_blank"
  rel="noopener noreferrer"
  prefetch={false} // optional, often preferred for external links
>
  External site
</Link>

If it’s purely an external navigation, a plain <a> is also fine/preferred:

<a href="https://example.com" target="_blank" rel="noopener noreferrer">
  External site
</a>

Sources: Next.js Link docs (anchor attributes like target="_blank" are passed through) [1]; example usage showing rel must be provided manually [2].

[1] (nextjs.org)
[2] (corner.buka.sh)

Citations:


Add rel on external _blank links.

At lines 55 and 63, Next.js Link components with target="_blank" must explicitly include rel="noopener noreferrer" to prevent security vulnerabilities, as Next.js does not add this attribute automatically.

🔒 Proposed fix
-					<Link href={c.links.guide} target="_blank">
+					<Link href={c.links.guide} target="_blank" rel="noopener noreferrer">
 						<Button
 							variant={"outline"}
 							className="bg-nav hover:bg-background"
 						>
 							Survival Guide
 						</Button>
 					</Link>
-					<Link href={c.links.discord} target="_blank">
+					<Link href={c.links.discord} target="_blank" rel="noopener noreferrer">
 						<Button
 							variant={"outline"}
 							className="bg-nav hover:bg-background"
 						>
 							Discord
 						</Button>
 					</Link>
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
<Link href={c.links.guide} target="_blank">
<Button
variant={"outline"}
className="bg-nav hover:bg-background"
>
Survival Guide
</Button>
</Link>
<Link href={c.links.discord} target="_blank">
<Button
<Link href={c.links.guide} target="_blank" rel="noopener noreferrer">
<Button
variant={"outline"}
className="bg-nav hover:bg-background"
>
Survival Guide
</Button>
</Link>
<Link href={c.links.discord} target="_blank" rel="noopener noreferrer">
<Button
variant={"outline"}
className="bg-nav hover:bg-background"
>
Discord
</Button>
</Link>
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@apps/web/src/app/dash/layout.tsx` around lines 55 - 64, In
apps/web/src/app/dash/layout.tsx update the Next.js Link usages that set
target="_blank" (the Link wrapping the "Survival Guide" Button and the Link
wrapping the Discord Button) to also include rel="noopener noreferrer" so
external blank-opened links are secured; locate the Link components around the
Buttons and add the rel attribute to each Link tag.

@Rufat00 Rufat00 merged commit 105d85c into dev Feb 26, 2026
2 of 3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants