chore(cleanup): remover refs órfãs a quote-public-view (Onda 3)#190
Conversation
Onda 3 do plano de hardening pré-prod. Limpa loose ends pós-deleção das edges quote-public-view (B-9) e useFavoriteReactions (B-5). Refs mortas removidas: - supabase/config.toml: bloco [functions.quote-public-view] - supabase/functions/_shared/edge-authz-manifest.ts: entrada do manifest - supabase/functions/_shared/cors-snapshot.json: entrada do snapshot CORS - supabase/functions/_shared/credentials.ts: comentário documentação Validações: - Edge function quote-public-view já era HTTP 404 no Supabase prod - Hook useFavoriteReactions não é importado em nenhum lugar - JSON do cors-snapshot continua parseável - Estrutura TOML do config.toml válida Tempo: ~20min. Risco: baixo (apenas refs mortas). Bloqueadores: B-5 e B-9 (parcial — refs). Detalhes: docs/hardening/ONDA-3-REMOVE-ORPHANS.md
Part of Onda 3 — completing the push that github_push_files truncated.
…comment Part of Onda 3 — completing the push that github_push_files truncated.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
This pull request has been ignored for the connected project Preview Branches by Supabase. |
WalkthroughPR realiza limpeza de referências órfãs à edge function ChangesOnda 3 — Remoção de Referências Órfãs
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Keep the CORS snapshot totals in sync
After removing this snapshot entry, the metadata at the top of the same JSON still says total: 83 and counts.shared: 83, while the functions array now contains only 82 entries. Consumers such as cors-audit will report incorrect totals, and the generated snapshot check (node scripts/build-cors-snapshot.mjs --check) now catches this internal mismatch; please regenerate the snapshot or update the counts together with the deletion.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
Pull request overview
Limpa referências órfãs a quote-public-view após a remoção da edge function, mantendo manifest, config, snapshot CORS e documentação de hardening alinhados ao estado atual.
Changes:
- Remove
quote-public-viewdoconfig.toml, manifest de autorização e snapshot CORS. - Atualiza comentário em
credentials.ts. - Adiciona documentação da Onda 3 de limpeza/hardening.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
supabase/functions/_shared/edge-authz-manifest.ts |
Remove a entrada de autorização da edge removida. |
supabase/functions/_shared/credentials.ts |
Remove menção obsoleta a quote-public-view em comentário. |
supabase/functions/_shared/cors-snapshot.json |
Remove a entrada CORS da edge removida. |
supabase/config.toml |
Remove o bloco de configuração da edge removida. |
docs/hardening/ONDA-3-REMOVE-ORPHANS.md |
Documenta escopo, validações e impacto da limpeza. |
Comments suppressed due to low confidence (3)
docs/hardening/ONDA-3-REMOVE-ORPHANS.md:39
- This says
.tmp-write-probe.mdwas deleted, but the file is still present at the repository root and is not part of this diff. Either include the deletion in this PR or update this section/impact table so the hardening record does not claim a cleanup that did not happen.
### 5. `.tmp-write-probe.md`
Deletado (artefato do diagnóstico de permissões GitHub PAT durante Onda 1).
docs/hardening/ONDA-3-REMOVE-ORPHANS.md:55
- The impact row overstates the cleanup as
0deadquote-public-viewrefs. The current tree still has active, non-historical docs that list this edge as available/credential-dependent (for exampledocs/EDGE_FUNCTIONS.md:48anddocs/RUNBOOK_CONNECTIONS.md:177), so either those refs should be cleaned up too or this row should scope the claim tosrc/andsupabase/functions/.
| Refs mortas a quote-public-view | 4 | 0 |
docs/hardening/ONDA-3-REMOVE-ORPHANS.md:53
- These manifest counts do not match the actual
EDGE_AUTHZ_MANIFEST: after this deletion thePúblicas por designsection still contains 19 entries (and had 20 before), not 15/16. Please update the numbers or clarify a different counting scope.
| Edges públicas no manifest | 16 | 15 |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| { | ||
| "name": "quote-sync", |
| - **B-5:** `src/hooks/useFavoriteReactions.ts` chamava edge function `favorites-public-react` que não existe | ||
| - **B-9:** `supabase/functions/quote-public-view/` era stub que retornava 501 com `verify_jwt=false`, expondo metadata pra reconnaissance de bots | ||
|
|
||
| Em sessões anteriores, dois trabalhos parciais já tinham sido feitos: |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@supabase/config.toml`:
- Line 32: A mudança do flag enable_anonymous_sign_ins = false altera
comportamento global de autenticação; reverta essa alteração neste PR ou, se a
intenção for mantê-la, adicione validação e documentação explícita dos fluxos
que dependem de sessões anônimas (testes de login anônimo, listas de endpoints
afetados) antes do merge; localize a chave enable_anonymous_sign_ins no arquivo
supabase/config.toml e restaure o valor anterior ou adicione um comentário e
checklist de validação dos fluxos anônimos conforme necessário.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 09f67622-0402-41d1-9221-a0e95429404b
📒 Files selected for processing (5)
docs/hardening/ONDA-3-REMOVE-ORPHANS.mdsupabase/config.tomlsupabase/functions/_shared/cors-snapshot.jsonsupabase/functions/_shared/credentials.tssupabase/functions/_shared/edge-authz-manifest.ts
| [auth] | ||
| enable_signup = false | ||
| enable_anonymous_sign_ins = false | ||
| enable_anonymous_sign_ins = false No newline at end of file |
There was a problem hiding this comment.
Mudança de política global de auth fora do escopo deste PR.
A alteração da Line 32 (enable_anonymous_sign_ins = false) muda comportamento de autenticação em produção e pode quebrar fluxos que dependem de sessão anônima. Como o objetivo aqui é cleanup de referências órfãs, recomendo reverter este ponto neste PR ou documentar/validar explicitamente os fluxos anônimos afetados antes do merge.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@supabase/config.toml` at line 32, A mudança do flag enable_anonymous_sign_ins
= false altera comportamento global de autenticação; reverta essa alteração
neste PR ou, se a intenção for mantê-la, adicione validação e documentação
explícita dos fluxos que dependem de sessões anônimas (testes de login anônimo,
listas de endpoints afetados) antes do merge; localize a chave
enable_anonymous_sign_ins no arquivo supabase/config.toml e restaure o valor
anterior ou adicione um comentário e checklist de validação dos fluxos anônimos
conforme necessário.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 5 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="supabase/functions/_shared/cors-snapshot.json">
<violation number="1" location="supabase/functions/_shared/cors-snapshot.json:667">
P2: Removing the `quote-public-view` entry from the `functions` array without updating the top-level `total` and `counts.shared` fields leaves the snapshot metadata inconsistent. If `scripts/build-cors-snapshot.mjs --check` validates these counts in CI, this will break the build. Either regenerate the snapshot via the build script or manually decrement the stale counters.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.
| @@ -495,14 +495,6 @@ | |||
| "allowMethods": null, | |||
There was a problem hiding this comment.
P2: Removing the quote-public-view entry from the functions array without updating the top-level total and counts.shared fields leaves the snapshot metadata inconsistent. If scripts/build-cors-snapshot.mjs --check validates these counts in CI, this will break the build. Either regenerate the snapshot via the build script or manually decrement the stale counters.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At supabase/functions/_shared/cors-snapshot.json, line 667:
<comment>Removing the `quote-public-view` entry from the `functions` array without updating the top-level `total` and `counts.shared` fields leaves the snapshot metadata inconsistent. If `scripts/build-cors-snapshot.mjs --check` validates these counts in CI, this will break the build. Either regenerate the snapshot via the build script or manually decrement the stale counters.</comment>
<file context>
@@ -672,4 +664,4 @@
}
]
-}
+}
\ No newline at end of file
</file context>
Onda 3 do hardening pré-prod. Limpa loose ends pós-deleção das edges
quote-public-view (B-9) e useFavoriteReactions (B-5) — esses arquivos
já estavam deletados em sessões anteriores, mas referências mortas
permaneciam em 4 arquivos do repo.
Mudanças:
Validações:
Risco: baixo. Tempo: ~20min.
Detalhes: docs/hardening/ONDA-3-REMOVE-ORPHANS.md
Summary by cubic
Remove referências órfãs à edge
quote-public-viewe ao hookuseFavoriteReactionspara concluir a Onda 3 de hardening pré-prod. Cobre B-9 e B-5 (parcial — refs), sem impacto de runtime.quote-public-viewdesupabase/config.toml,edge-authz-manifest.tsecors-snapshot.json.credentials.ts(remove menção).docs/hardening/ONDA-3-REMOVE-ORPHANS.md.Written for commit b5cd1ab. Summary will update on new commits.
Summary by CodeRabbit
Release Notes
Documentation
Refactor
Chores