fix: validate security middleware capabilities - #1225
Merged
Conversation
π WalkthroughWalkthroughHTTP 보μ λ―Έλ€μ¨μ΄ κ²μ¦μ Changes보μ λ―Έλ€μ¨μ΄ Capability κΈ°λ° κ²μ¦
Estimated code review effort: 3 (Moderate) | ~25 minutes π₯ Pre-merge checks | β 5β Passed checks (5 passed)
β¨ Finishing Touchesπ Generate docstrings
π§ͺ Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
π Benchmark Resultsβ All benchmarks passed
Updated: 2026-07-05T12:09:17.485Z Β· Commit: 0a868ee |
There was a problem hiding this comment.
Actionable comments posted: 1
π€ Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/transports-http/src/index.ts`:
- Around line 166-171: The new capability API export block is missing the same
leading Korean documentation comment used by the other public exports in this
file, so add a concise explanatory comment above the SecurityMiddlewareMarker
re-export to match the existing documentation pattern. Place it near the
exported symbols declareSecurityMiddlewareCapabilities,
getSecurityMiddlewareCapabilities, hasSecurityMiddlewareCapability, and
SecurityMiddlewareCapability so the block stays consistent with the adjacent
export sections.
πͺ Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
βΉοΈ Review info
βοΈ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 848b6af8-5a6e-4228-8ad4-6d96441663ec
β Files ignored due to path filters (1)
packages/problems-core/src/generated/problem-code-registry.tsis excluded by!**/generated/**
π Files selected for processing (18)
.changeset/security-middleware-capabilities.mddocs/problem-code-registry.jsondocs/troubleshooting/diagnostics.mdpackages/create-croco-app/test-fixtures/templates/ssr-lambda/README.md.hbspackages/docs/src/content/docs/api/problems-core/src/variables/CROCO_PROBLEM_CODE_REGISTRY.mdpackages/docs/src/content/docs/api/transports-http/src/functions/declareSecurityMiddlewareCapabilities.mdpackages/docs/src/content/docs/api/transports-http/src/functions/getSecurityMiddlewareCapabilities.mdpackages/docs/src/content/docs/api/transports-http/src/functions/hasSecurityMiddlewareCapability.mdpackages/docs/src/content/docs/api/transports-http/src/type-aliases/SecurityMiddlewareCapability.mdpackages/docs/src/content/docs/en/reference/problem-recovery-cookbook.mdpackages/transports-http/README.mdpackages/transports-http/src/index.tspackages/transports-http/src/libs/CrocoApp.tspackages/transports-http/src/libs/middleware/SecurityMiddlewareMarker.tspackages/transports-http/src/tests/CrocoApp.spec.tspackages/transports-http/src/tests/SecurityMiddlewareMarker.spec.tspublic-api-surface.snapshot.jsontsconfig/contract-strict.baseline.json
There was a problem hiding this comment.
Caution
Some comments are outside the diff and canβt be posted inline due to platform limitations.
β οΈ Outside diff range comments (1)
packages/docs/src/content/docs/en/reference/problem-recovery-cookbook.md (1)
369-372: π Maintainability & Code Quality | π‘ Minor | β‘ Quick win
unsafeSkipSecurityValidationκ²½λ‘λ κ°μ΄ μ μ΄ μ£ΌμΈμ.νμ¬ μλ΄λ
securityValidation: 'off'/CROCO_HTTP_SECURITY_VALIDATION=offλ§ μ€λͺ ν΄μ, λ°νμ λ©μμ§μ PR λ²μμ μλunsafeSkipSecurityValidation: trueλ§μ΄κ·Έλ μ΄μ κ²½λ‘κ° λΉ μ§λλ€. λ μ€ νλλ₯Ό μΆκ°νκ±°λ, μλμ μΌλ‘ μ κ±°νλ€λ©΄ λ체 μ μ°¨λ₯Ό λͺ μν΄ μ£ΌμΈμ.β»οΈ Suggested edit
- Use securityValidation: 'off' or `CROCO_HTTP_SECURITY_VALIDATION=off` only for explicit local + Use securityValidation: 'off', `unsafeSkipSecurityValidation: true`, or `CROCO_HTTP_SECURITY_VALIDATION=off` only for explicit localπ€ Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/docs/src/content/docs/en/reference/problem-recovery-cookbook.md` around lines 369 - 372, The problem-recovery docs currently describe only the securityValidation off path, but miss the runtime and migration path for unsafeSkipSecurityValidation. Update the relevant reference section and any linked guidance to explicitly mention unsafeSkipSecurityValidation: true alongside securityValidation: 'off' and CROCO_HTTP_SECURITY_VALIDATION=off, or clearly state the replacement procedure if that option was intentionally removed. Use the surrounding tenant-core error/reference entries to locate the affected documentation block.
π€ Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@packages/docs/src/content/docs/en/reference/problem-recovery-cookbook.md`:
- Around line 369-372: The problem-recovery docs currently describe only the
securityValidation off path, but miss the runtime and migration path for
unsafeSkipSecurityValidation. Update the relevant reference section and any
linked guidance to explicitly mention unsafeSkipSecurityValidation: true
alongside securityValidation: 'off' and CROCO_HTTP_SECURITY_VALIDATION=off, or
clearly state the replacement procedure if that option was intentionally
removed. Use the surrounding tenant-core error/reference entries to locate the
affected documentation block.
βΉοΈ Review info
βοΈ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: cccb97a5-1830-436f-a610-05637975b303
β Files ignored due to path filters (1)
packages/problems-core/src/generated/problem-code-registry.tsis excluded by!**/generated/**
π Files selected for processing (8)
docs/problem-code-registry.jsonpackages/docs/src/content/docs/api/problems-core/src/variables/CROCO_PROBLEM_CODE_REGISTRY.mdpackages/docs/src/content/docs/en/reference/problem-recovery-cookbook.mdpackages/transports-http/README.mdpackages/transports-http/src/index.tspackages/transports-http/src/tests/CrocoApp.spec.tspublic-api-surface.snapshot.jsontsconfig/contract-strict.baseline.json
π€ Files with no reviewable changes (1)
- tsconfig/contract-strict.baseline.json
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #1174.
Summary
security-headers,cors,body-limit, andrate-limitcapabilities, with invalid runtime values reported asCROCO_HTTP_SECURITY_002.CROCO_HTTP_SECURITY_001.Verification
COREPACK_ENABLE_DOWNLOAD_PROMPT=0 corepack pnpm --filter @croco/transports-http exec vitest run src/tests/SecurityMiddlewareMarker.spec.ts src/tests/CrocoApp.spec.ts --reporter=verbose- passed, 57 tests.COREPACK_ENABLE_DOWNLOAD_PROMPT=0 corepack pnpm --filter @croco/transports-http test- passed, 192 tests.COREPACK_ENABLE_DOWNLOAD_PROMPT=0 corepack pnpm --filter @croco/transports-http typecheck- passed.COREPACK_ENABLE_DOWNLOAD_PROMPT=0 corepack pnpm --filter @croco/transports-http... build- passed.ASTRO_TELEMETRY_DISABLED=1 COREPACK_ENABLE_DOWNLOAD_PROMPT=0 corepack pnpm --filter @croco/docs docs:build- passed, 3519 pages built.COREPACK_ENABLE_DOWNLOAD_PROMPT=0 corepack pnpm public-api:check- passed.COREPACK_ENABLE_DOWNLOAD_PROMPT=0 corepack pnpm problem-registry:check- passed, 414 codes.COREPACK_ENABLE_DOWNLOAD_PROMPT=0 corepack pnpm check- passed.COREPACK_ENABLE_DOWNLOAD_PROMPT=0 corepack pnpm --filter create-croco-app... build- passed.COREPACK_ENABLE_DOWNLOAD_PROMPT=0 corepack pnpm --filter create-croco-app exec vitest run src/tests/templates-build.spec.ts src/tests/e2e-generation.spec.ts --reporter=verbose- passed, 26 tests.COREPACK_ENABLE_DOWNLOAD_PROMPT=0 corepack pnpm changeset-required:check -- --base origin/trunk --head HEAD- passed.git diff --checkandgit diff --cached --check- passed.test- passed, 225/225 Turbo tasks.typecheck- passed, 224/224 Turbo tasks.Self-review gates
CROCO_HTTP_SECURITY_002,CROCO_HTTP_SECURITY_001keeps legacy code metadata, and a patch changeset is included.Review and QA
Notes
@croco/protocols-trpcdeclaration build race while@croco/problems-coredist declarations were being regenerated. The failing package build passed directly afterward, and the second normal push completed the full pre-push hook successfully without bypassing hooks.Summary by CodeRabbit