Skip to content

swap to queue for emails #394

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
InfinityBowman merged 10 commits into from
Mar 7, 2026
Merged

swap to queue for emails #394

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
8f083b0
swap to queue for emails
InfinityBowman Feb 26, 2026
11ef514
Apply Prettier formatting
actions-user Feb 26, 2026
a6c7c61
update deps, fix sentry typing
InfinityBowman Feb 26, 2026
2f824db
bug fixes
InfinityBowman Mar 7, 2026
de3dec2
Apply Prettier formatting
actions-user Mar 7, 2026
d65cc1c
update deps
InfinityBowman Mar 7, 2026
5b616b2
fix lint errors and circular updates
InfinityBowman Mar 7, 2026
d453c3b
Apply Prettier formatting
actions-user Mar 7, 2026
8fa05a8
bug fixes
InfinityBowman Mar 7, 2026
f2a922c
Merge branch 'switch-to-email-queue' of https://github.com/InfinityBo…
InfinityBowman Mar 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .cursor/mcp.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,9 @@
"ark-ui": {
"command": "npx",
"args": ["-y", "@ark-ui/mcp"]
},
"sentry": {
"url": "https://mcp.sentry.dev/mcp"
}
}
}
2 changes: 0 additions & 2 deletions .cursor/rules/durable-objects.mdc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,6 @@ Durable Objects provide stateful, single-instance objects for each project. They

- **ProjectDoc**: Manages project Y.Doc and WebSocket connections
- **UserSession**: Manages user session state
- **EmailQueue**: Manages email sending queue

## ProjectDoc Pattern

Expand Down Expand Up @@ -211,4 +210,3 @@ this.doc.on('update', async (update) => {

- `packages/workers/src/durable-objects/ProjectDoc.js` - Main ProjectDoc implementation
- `packages/workers/src/durable-objects/UserSession.js` - User session management
- `packages/workers/src/durable-objects/EmailQueue.js` - Email queue management
5 changes: 0 additions & 5 deletions .mcp.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,11 +12,6 @@
"env": {
"MCP_MEMORY_REPO_ROOT": "."
}
},
"ark-ui": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@ark-ui/mcp"]
}
}
}
26 changes: 26 additions & 0 deletions .mcp.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
<!-- {
"mcpServers": {
"corates": {
"type": "stdio",
"command": "node",
"args": ["packages/mcp/dist/server.js"]
},
"corates-memory": {
"type": "stdio",
"command": "node",
"args": ["packages/mcp-memory/dist/server.js"],
"env": {
"MCP_MEMORY_REPO_ROOT": "."
}
},
"ark-ui": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@ark-ui/mcp"]
},
Comment on lines +16 to +20
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Mar 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Security concern: npx -y auto-accepts package installation.

The -y flag causes npx to automatically install @ark-ui/mcp without user confirmation. This poses a security risk if:

  • The package is compromised or replaced with malicious code
  • A typosquatting attack targets the package name
  • The package is unexpectedly updated to a malicious version

Consider one of the following approaches:

  1. Pre-install the package as a dev dependency to lock the version
  2. Remove the -y flag to require explicit user confirmation
  3. Use a specific version constraint: npx @ark-ui/mcp@^1.0.0

Additionally, the AI summary mentions that "ark-ui has been removed from the public configuration," but it appears in this file. Clarify whether this configuration file is intended to be private/local-only.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.mcp.md around lines 16 - 20, The current MCP entry uses npx with the
auto-accept flag (-y) for the "ark-ui" tool which risks silently installing a
malicious/typosquatted package; replace this with a safer approach: either
pre-install `@ark-ui/mcp` as a devDependency and point the config to the local
binary, remove the -y flag to require user confirmation when invoking npx, or
pin a specific safe version using npx `@ark-ui/mcp`@<semver> to avoid implicit
upgrades—also confirm whether the "ark-ui" configuration in this file is
intended to be private/local-only and, if so, mark or move it to a local-only
config to avoid exposing it in public repos.

"sentry": {
"type": "http",
"url": "https://mcp.sentry.dev/mcp"
}
}
} -->
Binary file modified .mcp/memory.db
View file
Open in desktop
Binary file not shown.
Binary file modified .mcp/memory.db-wal
View file
Open in desktop
Binary file not shown.
8 changes: 4 additions & 4 deletions .vscode/mcp.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,10 +16,10 @@
"ark-ui": {
"command": "npx",
"args": ["-y", "@ark-ui/mcp"]
},
"sentry": {
"type": "http",
"url": "https://mcp.sentry.dev/mcp"
}
// "stripe": {
// "type": "http",
// "url": "https://mcp.stripe.com"
// }
}
}
2 changes: 2 additions & 0 deletions eslint.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -328,6 +328,8 @@ export default [
globals: {
// Cloudflare Workers globals
MessageEvent: 'readonly',
Message: 'readonly',
MessageBatch: 'readonly',
Cloudflare: 'readonly',
D1Database: 'readonly',
DurableObject: 'readonly',
Expand Down
8 changes: 4 additions & 4 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,20 +45,20 @@
"docs:preview": "pnpm --filter @corates/docs preview"
},
"devDependencies": {
"@eslint/js": "^9.39.3",
"@eslint/js": "^9.39.4",
"@typescript-eslint/parser": "^8.56.1",
"agent-browser": "^0.4.4",
"concurrently": "^9.2.1",
"dotenv": "^17.3.1",
"eslint": "^9.39.3",
"eslint": "^9.39.4",
"eslint-plugin-drizzle": "^0.2.3",
"eslint-plugin-solid": "^0.14.5",
"eslint-plugin-sonarjs": "^3.0.7",
"eslint-plugin-unicorn": "^62.0.0",
"prettier": "^3.8.1",
"prettier-plugin-tailwindcss": "^0.7.2",
"turbo": "^2.8.10",
"wrangler": "^4.67.1"
"turbo": "^2.8.14",
"wrangler": "^4.71.0"
},
"engines": {
"node": ">=24.0.0",
Expand Down
20 changes: 10 additions & 10 deletions packages/docs/STATUS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,11 +59,11 @@ This document tracks the current implementation status of CoRATES features and s
| PDF Routes | Complete | R2 storage, Google Drive proxy |
| Billing Routes | Complete | Stripe subscriptions, webhooks, portal |
| Admin Routes | Complete | User/org management, impersonation |
| Contact Routes | Complete | Rate-limited contact form with Postmark |
| Contact Routes | Complete | Rate-limited contact form |
| Account Merge Routes | Complete | OAuth account linking |
| ProjectDoc DO | Complete | Yjs sync with WebSocket connections |
| UserSession DO | Complete | Session management |
| EmailQueue DO | Complete | Email delivery queue |
| Email Queue | Complete | Cloudflare Queue with Postmark delivery |

### Database Schema

Expand Down Expand Up @@ -97,14 +97,14 @@ This document tracks the current implementation status of CoRATES features and s

## Infrastructure

| System | Status | Notes |
| ------------------ | -------- | ----------------------------------- |
| Cloudflare Workers | Complete | Hono with OpenAPI support |
| Cloudflare D1 | Complete | SQLite database with Drizzle ORM |
| Cloudflare R2 | Complete | PDF storage |
| Durable Objects | Complete | ProjectDoc, UserSession, EmailQueue |
| Email (Postmark) | Complete | Transactional emails |
| GitHub Actions | Partial | Prettier check only |
| System | Status | Notes |
| ------------------ | -------- | -------------------------------- |
| Cloudflare Workers | Complete | Hono with OpenAPI support |
| Cloudflare D1 | Complete | SQLite database with Drizzle ORM |
| Cloudflare R2 | Complete | PDF storage |
| Durable Objects | Complete | ProjectDoc, UserSession |
| Email Queue | Complete | Cloudflare Queue + Postmark |
| GitHub Actions | Partial | Prettier check only |

---

Expand Down
4 changes: 2 additions & 2 deletions packages/docs/architecture/diagrams/02-system-architecture.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,9 +17,9 @@ flowchart TB

subgraph DurableObjects["Durable Objects"]
ProjectDoc[ProjectDoc<br/>One per project<br/>Yjs sync & content]
EmailQueue[EmailQueue]
UserSession[UserSession<br/>One per user<br/>Notifications]
end
EmailQueue[Cloudflare Queue<br/>Email delivery]
end

subgraph Storage["Cloudflare Storage"]
Expand Down Expand Up @@ -56,7 +56,7 @@ flowchart TB
- **Durable Objects**:
- **ProjectDoc**: One per project, holds Yjs document for real-time collaboration and content storage
- **UserSession**: One per user, manages WebSocket connections for real-time notifications (e.g., project invites)
- **EmailQueue**: Background email processing
- **Cloudflare Queue**: Async email delivery with retries and dead letter queue, consumed by Postmark

### Storage

Expand Down
Loading