feat: Migrate to tanstack start - Stage 1 - #760
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bf94b10c64
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "#/*": "./src/*" | ||
| }, | ||
| "scripts": { | ||
| "dev": "vite dev --port 3001", |
There was a problem hiding this comment.
The development server listens on port 3001, while apps/web/.env.example configures both NEXT_PUBLIC_API_URL and NEXT_PUBLIC_WEB_URL as http://localhost:3000. When developers use the supplied environment and run this script, fetcherServer and browser-side core fetchers therefore call port 3000 rather than the Hono API mounted in this app; with the existing docs app running there this silently exercises the wrong API, and without it session/API calls fail. Make the configured origin and listening port agree.
Useful? React with 👍 / 👎.
| shellComponent: RootDocument, | ||
| }) | ||
|
|
||
| function RootDocument({ children }: { children: React.ReactNode }) { |
There was a problem hiding this comment.
RootDocument is declared as a function despite the repository requiring arrow functions for components; the same pattern also appears in the new Home, ApiCheck, and SessionCheck components, so convert these declarations consistently before establishing them as the migration's component convention.
AGENTS.md reference: AGENTS.md:L9-L12
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8e6b4db837
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| */ | ||
| export const resolveApiOrigin = (): string => { | ||
| try { | ||
| return getRequestUrl().origin |
There was a problem hiding this comment.
When the deployment accepts an arbitrary Host header or forwards it without validation, getRequestUrl().origin is attacker-controlled. Both fetcherServer and the public /api-check route then make server-side requests to that origin, and /api-check renders the first 600 response bytes, allowing crafted requests to probe or read matching paths on internal services. Resolve the origin from trusted deployment configuration or validate it against an allowlist before issuing these fetches.
Useful? React with 👍 / 👎.
| content: 'width=device-width, initial-scale=1', | ||
| }, | ||
| { | ||
| title: 'TanStack Start Starter', |
There was a problem hiding this comment.
Every page in the new app currently ships with the generic TanStack Start Starter title, while the root head also lacks the required VitNode description and viewport details such as theme color and userScalable. This causes production pages to be misidentified in search results and browser UI; provide app-specific title, description, and viewport metadata in this root route.
AGENTS.md reference: AGENTS.md:L45-L46
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6a1d90cf52
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const response = await fetcherServer(users, { | ||
| method: 'get', | ||
| module: 'users', | ||
| path: '/session', | ||
| }) |
There was a problem hiding this comment.
When a cookie-less visitor calls getSession, the API's global middleware invokes SessionModel.getUser(), which creates a device record and returns a vitnode_device cookie. This response exists only inside the server function, but the handler never calls saveApiCookies(response), so the browser never receives that cookie and every later session lookup creates another device row. Relay the API cookies before consuming or returning this response.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b05047fa42
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| }, | ||
| // Same-origin by construction, and ahead of `NEXT_PUBLIC_API_URL` - which | ||
| // an explicit `origin` on the call can still override. | ||
| origin: options.origin ?? resolveApiOrigin(), |
There was a problem hiding this comment.
When NEXT_PUBLIC_API_URL points to a separate API server, browser fetches honor that setting, but every request-scoped fetcherServer call replaces it with the web request's origin. In particular, getSession does not pass an explicit origin, so SSR reads the session from the locally mounted API while client-side calls use the configured server, potentially producing different authentication and data depending on navigation mode. Use the configured origin when it is explicitly set, while retaining the request origin as the unconfigured fallback.
Useful? React with 👍 / 👎.
1 participant
Improving Documentation
pnpm lint:fixto fix formatting issues before opening the PR.Description
What?
Why?