refactor(nuxi): better admin-mcp (admin mode now), Global Config - #2367
refactor(nuxi): better admin-mcp (admin mode now), Global Config#2367HugoRCD wants to merge 15 commits into
Conversation
…r admin logins Replace the if/else chain deciding who can use Nuxi's admin-mcp tools with a single Context model (surface/person/channel) and a per-surface rule table, merging the previously duplicated surface classification in surface.ts and admin-mcp-access.ts into one lib/context.ts. Discord's admin gate now checks the allowlist at decision time against a raw channel id instead of a pre-baked boolean set at auth-build time. Also move the extra admin GitHub logins list from NUXT_ADMIN_GITHUB_LOGINS (env var, requires a redeploy to change) to Vercel Global Config (adminGithubLogins key), editable from the dashboard.
…st to Global Config canAccessAdminMcp()/AdminMcpAuthContext become isAdminMode()/AuthContext (admin-mcp-access.ts -> admin-mode.ts) to reflect the actual concept: a session is either public or in admin mode with every tool and capability, not just gated on the admin-mcp connection specifically. DISCORD_ALLOWED_CHANNELS moves to Global Config (discordAllowedChannels key, alongside adminGithubLogins) so the channel allowlist is editable from the Vercel dashboard without a redeploy, same rationale as the admin logins list.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Warning Review limit reached
Next review available in: 23 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (9)
📝 WalkthroughWalkthroughThe change replaces environment-based administration and channel settings with Vercel Global Config. It adds cached configuration loaders and validation for admin, Discord, Slack, and workflow settings. It centralizes authentication context and admin-mode evaluation across surfaces. Discord gains auto-response channels, full-name attribution, retry handling, and digest mirroring. Slack gains asynchronous configuration and display-name resolution. Workflow routes and schedules now await Global Config values. Unit tests cover identity, admin mode, and Discord access. Estimated code review effort: 4 (Complex) | ~45 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
test/unit/discord-access.spec.ts (1)
15-20: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winTest the
autoRespondtier.The tests do not configure
autoRespond. Add a channel in that tier. Assert thatisAllowedDiscordChannelreturnstrueandisAdminDiscordChannelreturnsfalse.Also applies to: 54-59
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/unit/discord-access.spec.ts` around lines 15 - 20, Add an autoRespond channel to the mocked Discord channel configuration in the isAllowedDiscordChannel tests, then assert that channel is accepted by isAllowedDiscordChannel and isAdminDiscordChannel returns false for it. Apply the same coverage to the related test block around the second referenced case.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@layers/nuxi/agent/lib/discord/access.ts`:
- Around line 23-30: Update the schemas in
layers/nuxi/agent/lib/discord/access.ts lines 23-30,
layers/nuxi/agent/lib/slack/config.ts lines 21-32, and
layers/nuxi/agent/lib/workflow/config.ts lines 17-20 to reject unknown keys at
every listed configuration level: discord, discord.channels, slack,
slack.channels, channel references, and workflow. Ensure the existing safeParse
validation path reports typoed fields instead of silently stripping them.
In `@layers/nuxi/README.md`:
- Around line 192-208: Update the Global Config reference’s discord example to
include channels.autoRespond, and expand the discord description to state that
this tier enables dispatch without a mention while remaining non-admin. Keep the
existing admin, public, and digestChannel documentation unchanged.
In `@server/utils/team.ts`:
- Around line 20-31: Update getExtraAdminLogins in team.ts to handle
getAll(['admin']) failures by catching the read error and returning an empty
array, so isAuthorizedAdmin can continue to the core-team authorization path.
Keep the existing normalization/filtering logic unchanged, and scope the fix to
the getExtraAdminLogins call site rather than altering isAuthorizedAdmin’s
core-admin checks.
---
Nitpick comments:
In `@test/unit/discord-access.spec.ts`:
- Around line 15-20: Add an autoRespond channel to the mocked Discord channel
configuration in the isAllowedDiscordChannel tests, then assert that channel is
accepted by isAllowedDiscordChannel and isAdminDiscordChannel returns false for
it. Apply the same coverage to the related test block around the second
referenced case.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 2778a479-971a-4fa3-a9b9-799f63d41b6c
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (39)
.env.examplelayers/nuxi/README.mdlayers/nuxi/agent/agent.tslayers/nuxi/agent/channels/discord.tslayers/nuxi/agent/channels/ops.tslayers/nuxi/agent/channels/slack.tslayers/nuxi/agent/connections/admin-mcp.tslayers/nuxi/agent/connections/vercel-mcp.tslayers/nuxi/agent/instructions.tslayers/nuxi/agent/lib/admin-mcp-access.tslayers/nuxi/agent/lib/discord-access.tslayers/nuxi/agent/lib/discord/access.tslayers/nuxi/agent/lib/discord/digest-mirror.tslayers/nuxi/agent/lib/discord/format.tslayers/nuxi/agent/lib/discord/retry.tslayers/nuxi/agent/lib/gateway-attribution.tslayers/nuxi/agent/lib/global-config.tslayers/nuxi/agent/lib/identity/admin-mode.tslayers/nuxi/agent/lib/identity/caller-instructions.tslayers/nuxi/agent/lib/identity/context.tslayers/nuxi/agent/lib/identity/surface-instructions.tslayers/nuxi/agent/lib/slack/api.tslayers/nuxi/agent/lib/slack/config.tslayers/nuxi/agent/lib/slack/connect.tslayers/nuxi/agent/lib/surface.tslayers/nuxi/agent/lib/workflow/config.tslayers/nuxi/agent/lib/workflow/shared.tslayers/nuxi/agent/schedules/discord-gateway.tslayers/nuxi/agent/schedules/firehose-summary.tslayers/nuxi/agent/schedules/weekly-digest.tslayers/nuxi/agent/tools/ai-gateway.tslayers/nuxi/agent/tools/slack-channel-history.tsnuxt.config.tspackage.jsonserver/utils/team.tstest/unit/admin-mode.spec.tstest/unit/context.spec.tstest/unit/discord-access.spec.tstest/unit/workflow-prompt.spec.ts
💤 Files with no reviewable changes (4)
- nuxt.config.ts
- layers/nuxi/agent/lib/surface.ts
- layers/nuxi/agent/lib/admin-mcp-access.ts
- layers/nuxi/agent/lib/discord-access.ts
…ssing the safe `readGlobalConfig` wrapper), so a Global Config outage throws out of `isAuthorizedAdmin` and breaks all GitHub logins.
This commit fixes the issue reported at server/utils/team.ts:21
## Bug
`server/utils/team.ts` reads the extra-admin list straight from the SDK:
```ts
async function getExtraAdminLogins(): Promise<string[]> {
const config = await getAll<{ admin?: { githubLogins?: string[] } }>(['admin'])
...
}
```
The `@vercel/global-config` `getAll` call **rejects** on invalid tokens, deleted/unavailable stores, and network errors (documented explicitly in `layers/nuxi/agent/lib/global-config.ts`). Because `isAuthorizedAdmin` awaits `getExtraAdminLogins()` *before* it ever reaches the `isCoreTeamMember` fallback:
```ts
export async function isAuthorizedAdmin(login: string): Promise<boolean> {
const normalized = login.toLowerCase()
const extraLogins = await getExtraAdminLogins() // throws here on GC outage
if (extraLogins.includes(normalized)) return true
return isCoreTeamMember(normalized)
}
```
### Concrete failure path
`isAuthorizedAdmin` is awaited inside the GitHub OAuth `onSuccess` handler in `server/api/auth/github.get.ts`:
```ts
const role = (await isAuthorizedAdmin(ghUser.login)) ? 'admin' : 'user'
```
Trigger: Global Config store unavailable / token invalid / transient network error during an OAuth callback → `getAll` rejects → rejection propagates out of `getExtraAdminLogins` → out of `isAuthorizedAdmin` → out of `onSuccess` → caught by `onError`, which redirects **every** user to `/`. Login breaks entirely, including for core team members whose authorization does not depend on the extra-logins list at all. The previous implementation read from `useRuntimeConfig()` and never threw, so this is a regression.
The PR already introduced `readGlobalConfig` for exactly this purpose ("turns a Global Config outage into a logged warning + empty result instead of an unhandled throw"), and the layer README lists `admin` among the keys read through it — but `team.ts` bypassed it.
## Fix
Route the read through the existing safe wrapper instead of calling `getAll` directly:
```ts
import { readGlobalConfig } from '../../layers/nuxi/agent/lib/global-config'
...
const config = await readGlobalConfig<{ admin?: { githubLogins?: string[] } }>(['admin'])
```
`readGlobalConfig` catches read failures, logs a warning, and resolves to `{}`, so `getExtraAdminLogins` degrades to `[]` and `isAuthorizedAdmin` falls back to `isCoreTeamMember` — login keeps working during a GC outage (fail-closed for extra admins, exactly like the prior runtime-config behavior). As a bonus this also picks up the wrapper's 30s cache + in-flight dedupe and matches the design documented in `layers/nuxi/README.md`.
Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com>
Co-authored-by: HugoRCD <hugo.richard@vercel.com>
|
@vercel fix the typecheck |
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
package.json (1)
54-54: 🩺 Stability & Availability | 🟡 Minor | ⚡ Quick winDeclare
@vercel/global-configinlayers/nuxi/package.json.
layers/nuxi/agent/lib/global-config.tsimports@vercel/global-config, but the package is only listed in the root manifest. Add it tolayers/nuxi/package.jsonso typecheck and deployment do not depend on root-level hoisting.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@package.json` at line 54, Declare `@vercel/global-config` in layers/nuxi/package.json dependencies, matching the existing version constraint, so the import in global-config.ts resolves without relying on root-level hoisting.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@package.json`:
- Line 54: Declare `@vercel/global-config` in layers/nuxi/package.json
dependencies, matching the existing version constraint, so the import in
global-config.ts resolves without relying on root-level hoisting.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: b9b72b54-2c7c-477b-a5f4-3832c3d42418
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (5)
README.mdlayers/nuxi/agent/agent.tslayers/nuxi/package.jsonpackage.jsonpnpm-workspace.yaml
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@layers/nuxi/agent/lib/identity/context.ts`:
- Around line 39-40: Update isLocalDevPrincipal so it returns true only when
both auth.authenticator and auth.principalType equal 'local-dev', preserving the
intended local-development principal contract before the Slack, Discord, and web
branches.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 506d86b1-659a-4df0-b295-6640385f33ba
📒 Files selected for processing (7)
.env.exampleREADME.mdlayers/nuxi/agent/lib/identity/admin-mode.tslayers/nuxi/agent/lib/identity/context.tslayers/nuxi/agent/tools/ai-gateway.tstest/unit/admin-mode.spec.tstest/unit/context.spec.ts
🚧 Files skipped from review as they are similar to previous changes (6)
- README.md
- test/unit/context.spec.ts
- layers/nuxi/agent/tools/ai-gateway.ts
- test/unit/admin-mode.spec.ts
- layers/nuxi/agent/lib/identity/admin-mode.ts
- .env.example
Replace the if/else chain that decides who can use Nuxi's admin-mcp tools with a single Context model (surface/person/channel) and a per-surface rule table, merging the previously duplicated surface classification in surface.ts and admin-mcp-access.ts into lib/context.ts. Discord's admin gate now checks the allowlist at decision time against a raw channel ID instead of a pre-baked boolean set at auth-build time.
Also move the extra admin GitHub logins list from NUXT_ADMIN_GITHUB_LOGINS (env var, requires a redeploy to change) to Vercel Global Config (adminGithubLogins key), editable from the dashboard.