Add Pandora Operator Action Center#134
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Warning Review limit reached
Next review available in: 23 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (18)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 96e4ed9d90
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| create policy "pandora_operator_actions_update_own_bookkeeping" on public.pandora_operator_actions for update to authenticated using (user_id = auth.uid()) with check (user_id = auth.uid()); | ||
|
|
||
| revoke update on public.pandora_operator_actions from authenticated; | ||
| grant update (status, result, warnings, updated_at, approved_at, completed_at, failed_at) on public.pandora_operator_actions to authenticated; |
There was a problem hiding this comment.
Because Supabase browser clients use the same authenticated role, this grant lets any logged-in user update their own action rows directly through PostgREST, including setting status to dry_ran/completed, fabricating result/warnings, and filling approval/completion timestamps without going through the dry-run or cancel routes. The dashboard reads these fields from pandora_operator_actions, so the current audit/dry-run history can be forged even though live actions are described as gated; these bookkeeping transitions need to be enforced behind a trusted server/RPC path rather than granted broadly to authenticated.
Useful? React with 👍 / 👎.
| create policy "pandora_operator_action_events_select_own" on public.pandora_operator_action_events for select to authenticated using (user_id = auth.uid()); | ||
|
|
||
| drop policy if exists "pandora_operator_action_events_insert_own" on public.pandora_operator_action_events; | ||
| create policy "pandora_operator_action_events_insert_own" on public.pandora_operator_action_events for insert to authenticated with check (user_id = auth.uid()); |
There was a problem hiding this comment.
With this policy, an authenticated client only has to set user_id = auth.uid(); action_id can reference any existing pandora_operator_actions.id, including another user's action if the UUID is known or leaked. That permits cross-user audit rows attached to someone else's action, and future reads by action_id would mix another user's event into the action history. Add a with check that verifies the referenced action exists and has user_id = auth.uid().
Useful? React with 👍 / 👎.
1 participant
Motivation
Description
supabase/migrations/20260703000000_pandora_operator_action_center.sqlcreatingpandora_operator_actionsandpandora_operator_action_eventswith constraints, indexes, RLS policies, andunique(user_id, idempotency_key).lib/services/pandora-operator-action-service.tsexposinglistOperatorActions,proposeOperatorAction,dryRunOperatorAction,cancelOperatorAction, andcreateActionEvent; enforces server-deriveduserId, deterministic idempotency key, allowed action/mode lists, and never mutates core memory tables.app/api/pandora/operator-actions/route.ts,app/api/pandora/operator-actions/[id]/dry-run/route.ts, andapp/api/pandora/operator-actions/[id]/cancel/route.tsthat reject client-supplieduser_idand call the service functions.OperatorActionCenterCard,OperatorActionComposer,OperatorActionList, andOperatorActionEnvelope, extendedcomponents/pandora/types.tsand wired anoperatorActionssummary into the live/pandoradashboard loader (lib/services/pandora-dashboard-service.ts) while preserving existing dashboard/verification behavior and visual style.no_mutation_performed: true; allowed action types are constrained to verification/dashboard-related work only; no model calls, embeddings, destructive operations, or service-role/admin client usage were added.Testing
npm run typecheck) which passed, and lint (npm run lint) which passed with pre-existing non-blocking warnings.npm run test) and full test suite; all tests passed (96 test files, 612 tests passed in CI run shown locally).npm run build) which completed successfully with Next.js/Edge-runtime informational warnings only.npm run env:policy) passed for discovered env keys.tests/unit/pandora-operator-action-service.test.ts,tests/unit/pandora-operator-action-ui.test.tsx, andtests/unit/pandora-operator-action-guards.test.ts, and they passed as part of the test run.Codex Task