fix: forward the API and content-gateway config to the browser engine - #1035
Merged
Conversation
|
Warning Review limit reached
Next review available in: 34 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (21)
WalkthroughThe change validates required deployment and login variables, propagates API and content gateway settings through the browser engine, requires a nonblank WASM API URL, and adds mock authentication coverage for browser engine startup. ChangesEngine configuration and authentication
Estimated code review effort: 3 (Moderate) | ~25 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
FSM1
marked this pull request as ready for review
August 4, 2026 20:16
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/web/src/engine/config.ts`:
- Around line 81-103: Reject whitespace-only environment values by applying a
trimmed nonblank check in missingLoginEnv and missingDeployEnv, and make
loginEnv reuse that validation for clientId and verifier; in
apps/web/src/engine/config.ts lines 81-103 update these functions accordingly.
In apps/web/src/engine/config.ts lines 72-76, trim VITE_READ_ACCELERATOR_URL and
return undefined when the trimmed value is blank. In
apps/web/src/engine/config.test.ts lines 61-118, add runtime assertions covering
whitespace-only accelerator URL, API URL, client ID, and verifier values.
In `@packages/client/test/browser/mockAuth.ts`:
- Around line 73-78: Update parse to validate the JSON result before returning
it: return the parsed value only when it is a non-null object, otherwise return
{}. Add a runtime test for posting null to the mock auth challenge/login
endpoint and assert it responds with HTTP 400.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: c3240753-9c00-4827-a45c-21958d4ba2f9
📒 Files selected for processing (21)
.github/workflows/deploy-staging.yml.github/workflows/desktop-staging-release.yml.github/workflows/web-e2e.ymlapps/web/src/auth/coreKit.tsapps/web/src/engine/config.test.tsapps/web/src/engine/config.tsapps/web/src/vite-env.d.tsapps/web/vite.config.tscrates/engine/src/facade.rscrates/wasm/src/host.rspackages/client/src/spawnEngineWorker.test.tspackages/client/src/spawnEngineWorker.tspackages/client/src/worker/engineHost.test.tspackages/client/src/worker/engineHost.tspackages/client/src/worker/engineWorker.tspackages/client/src/worker/serve.test.tspackages/client/test/browser/engine.spec.tspackages/client/test/browser/engine.worker.tspackages/client/test/browser/mockAuth.tspackages/client/test/browser/mockMailbox.tspackages/client/test/browser/vite.config.ts
FSM1
marked this pull request as draft
August 4, 2026 20:26
FSM1
force-pushed
the
fix/986-browser-engine-bootstrap-and-config
branch
2 times, most recently
from
August 4, 2026 21:33
0a36d32 to
80dd518
Compare
The browser worker built the WASM EngineHandle with every config argument hardcoded to undefined, so the engine ran against an empty API base and cold start skipped identity login entirely. Thread apiBaseUrl through EngineHostConfig, the worker bootstrap, and EngineHost, and refuse an absent or blank base at the WASM boundary rather than coming up unauthenticated. Add the read-accelerator and public-gateway surface alongside it, with no default: an unconfigured build reads nothing and the engine reports it as unavailable, never falling back to an endpoint nobody chose. The accelerator bearer is deferred — it is a session credential and a VITE_ variable ships in the public bundle. Plumb VITE_WEB3AUTH_VERIFIER through every workflow that builds the web app, and fail a deployment build whose login-critical environment is unset so the gap surfaces in CI rather than in the browser at first login. Closes #986 Closes #987 Closes #970 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Db7mRD4qUCPxkdc8JHqjfo
Requires VITE_API_URL of a deployed build too: an unset one falls back to localhost, which the engine would then authenticate against. Single-sources the login variables so the build gate and the Core Kit session cannot drift apart. Derives the worker bootstrap and the host options from one config type and posts the handshake as a checked spread, so a field added upstream reaches the engine without a copy nothing typechecks. Wraps the accelerator bearer before the constructor's first fallible step so an early return cannot drop it unzeroized, and trims a whitespace-only API base. The browser suite now tallies the identity-login exchange, so a cold start that skipped login fails the gate instead of passing silently. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Db7mRD4qUCPxkdc8JHqjfo
The deploy gate tested truthiness, so `VITE_API_URL=" "` passed it and
shipped a bundle that authenticates against whatever answers on the user's
machine — reopening past the gate the very hole the gate was added to close.
A whitespace accelerator was worse than useless: it configured a gateway
source with an unusable base URL, so reads failed per request instead of
staying dormant, which is the fail-closed state chosen deliberately.
One `configured()` helper now backs the gate, the Core Kit accessor and the
accelerator. The API origin is trimmed because it is concatenated into
request URLs, but a blank one never defaults — defaulting would turn the
engine's fail-closed refusal into a silent localhost fallback.
The browser suite's auth mock answered `JSON.parse('null')` by throwing
inside its response callback, leaving the request unanswered so a failure
surfaced as a timeout with no signal. It now answers 400.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Db7mRD4qUCPxkdc8JHqjfo
FSM1
force-pushed
the
fix/986-browser-engine-bootstrap-and-config
branch
from
August 4, 2026 21:48
80dd518 to
13001b2
Compare
FSM1
marked this pull request as ready for review
August 4, 2026 21:52
This was referenced Aug 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #986
Closes #987
Closes #970
Browser bootstrap and config wiring. No new primitives, no new KDF edges, no codec changes.
#986 — apiBaseUrl reaches the WASM EngineHandle
packages/client/src/worker/engineHost.tsbuiltEngineHandlewith all four config arguments hardcodedundefined, so the engine ran against an empty API base andEngine::start()took itsif !self.api_base_url.is_empty()branch — skippingapi.login_identity()entirely. Every publish, register and upload ran unauthenticated against an empty base.apiBaseUrlnow flowsEngineHostConfigto the worker bootstrap toEngineHosttoEngineHandle.EngineHost's positional arguments became an options object derived fromEngineHostConfig, so the three layers carry one shape rather than three restatements, andspawnEngineWorkerposts a checked spread instead of a hand-written field-by-field copy that nothing typechecked.An absent base fails closed at the WASM boundary, rather than silently skipping login:
EngineHandle::newreturns aJsErrorfor a missing, empty, or whitespace-onlyapiBaseUrl, so a misconfigured host cannot bring an engine up unauthenticated. The engine facade keeps its empty-base skip for the Rust harness — see "Deferred" below.#987 — accelerator and public gateway config surface
Adds
VITE_READ_ACCELERATOR_URLandVITE_PUBLIC_GATEWAYSto theapps/webengine config, threaded intoGatewayConfig. No default: unset leaves the gateway dormant and reads fail closed asUnavailable, never degrading to an endpoint nobody chose. The network is canonical and every fetched block is CID-verified incrates/engine/src/content/read.rs, so these are accelerator hints, not trust anchors.Both are wired to repository variables in the staging web-build step; unset substitutes blank and stays dormant, so nothing changes until an admin sets them.
acceleratorBeareris deferred, deliberately. AVITE_-prefixed variable is inlined into the public browser bundle, and the accelerator token is a per-session credential. TypeScript passesundefined; #1033 tracks sourcing it from the session at runtime.#970 — VITE_WEB3AUTH_VERIFIER reaches every build
Plumbed alongside every existing
VITE_WEB3AUTH_CLIENT_ID— 4 sites indeploy-staging.yml, 3 indesktop-staging-release.yml, 2 plus the.envwrite inweb-e2e.yml.The reason it went unnoticed is that a missing variable is silent at build time, so this also adds a build-time gate: a build naming a deployed environment that lacks a login-critical variable now fails the build instead of shipping a bundle that throws in the browser at first login.
VITE_API_URLis gated too — an unset one falls back tohttp://localhost:3000, which the engine would then authenticate against.The predicate lives in
apps/web/src/engine/config.tsnext to the other config-edge validators and is unit-tested;vite.config.tsandcreateCoreKitSessionread the same list, so the gate and the runtime check cannot drift.Action required before this deploys
Set the
VITE_WEB3AUTH_VERIFIERrepository variable. This is a repo-admin action that cannot be done from a PR. Without it the staging deploy now goes red at build time rather than green-and-broken — the intended behaviour, but it will block a staging deploy until the variable exists.Optionally set
VITE_READ_ACCELERATOR_URLandVITE_PUBLIC_GATEWAYS; until then staging ships with a dormant content gateway and every content read fails closed as unavailable.Verification
Automated:
cargo fmt --all,cargo clippy --all-targetsclean,cargo test -p cipherbox-enginegreen across 13 suites.cargo checkandcargo test -p cipherbox-wasm --target wasm32-unknown-unknown— 16 tests, including a new one asserting the constructor refuses an absent, empty, or whitespace-onlyapiBaseUrlbefore it touches the seam bag.pnpm typecheck,pnpm lint,packages/client316 tests,apps/web107 tests,typecheck:browser-test./auth/challengeand/auth/login. The mock refuses a login that does not echo a challenge it issued, and the cold-start test asserts the exchange tally moved — so a regression reinstating the login skip fails there rather than passing silently.VITE_API_URLfails, and an unconfiguredvite build— theWeb BundleCI job — stays green.Puppeteer against
vite dev:VITE_WEB3AUTH_CLIENT_ID and VITE_WEB3AUTH_VERIFIER must be configured, reproducing Staging builds never receive VITE_WEB3AUTH_VERIFIER so login throws at session creation #970's symptom.Needs a human:
must be configuredbanner, then complete a Google login and an email login and confirm the vault loads.Review gates
/simplify,/security-reviewand/crypto-privacy-reviewall run; findings folded in as a second commit.The security pass found no HIGH or MEDIUM issues. It confirmed the verifier is a public routing identifier rather than a credential — sourced from
vars., exactly like the client id already in the bundle — that no path can source a bearer from build-time config, that a hostile gateway cannot forge content because every block is CID-verified with a mismatch terminal as a trust violation, and that the browser mock does not weaken any gate the Rust and contract suites already cover.Folded in from the gates:
VITE_API_URLadded to the deploy gate; the login variable list single-sourced; the accelerator bearer'sZeroizingwrap moved above the constructor's first fallible step so an early return cannot drop it unzeroized; a whitespace-only API base trimmed; the bootstrap handshake given back its type annotation; the browser suite's login assertion made explicit; comments trimmed where they restated a rule stated elsewhere or defended an absent path.Deferred
Engine::newrather than relying on one host's guard. Both the altitude and crypto passes wanted this; it is anEngine::newsignature change across 9 call sites in a file with concurrent in-flight work, and the browser path it hardens is already closed at the host edge.crates/engine/src/api/client.rs, which this PR does not touch.All three carry a native
blocked_byedge to the issue that unblocked them.Merge sequencing
crates/engine/src/facade.rsis shared with in-flight work. This PR touches only two comment regions there — theapi_base_urlfield doc and one stale line above the cold-start login guard — and changes no signature in that file. Every signature change is confined tocrates/wasm/src/host.rs, whose seven-argument constructor already existed and only changed how it handlesapi_base_url, and topackages/client.Summary by CodeRabbit
New Features
Bug Fixes
Tests