Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 17 additions & 0 deletions .env.example
Original file line number Diff line number Diff line change
Expand Up @@ -7,3 +7,20 @@ DATABASE_URL="postgres://user:password@host:port/database"
# Better Auth
BETTER_AUTH_SECRET="generate-with-openssl-rand-base64-32"
BETTER_AUTH_URL=http://localhost:4000

# Frontend URL (for email verification links)
FRONTEND_URL=http://localhost:3000

# Email Provider: "smtp" or "postmark"
EMAIL_PROVIDER=smtp

# SMTP Configuration (when EMAIL_PROVIDER=smtp)
SMTP_HOST=smtp.gmail.com
SMTP_PORT=587
SMTP_USER=
SMTP_PASS=
SMTP_FROM=noreply@clear-platform.org
Comment on lines +14 to +22
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Don't pair Gmail SMTP with an unrelated default SMTP_FROM.

With EMAIL_PROVIDER=smtp, this becomes the default copy/paste path, and smtp.gmail.com plus SMTP_FROM=noreply@clear-platform.org is a bad combination for most developers. Gmail usually requires the sender to match a verified mailbox or alias, so this example will often fail until they notice the mismatch.

📧 Safer example
 # SMTP Configuration (when EMAIL_PROVIDER=smtp)
 SMTP_HOST=smtp.gmail.com
 SMTP_PORT=587
 SMTP_USER=
 SMTP_PASS=
-SMTP_FROM=noreply@clear-platform.org
+# Must be a verified sender for your SMTP provider; with Gmail this usually matches SMTP_USER
+SMTP_FROM=your-account@gmail.com
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# Email Provider: "smtp" or "postmark"
EMAIL_PROVIDER=smtp
# SMTP Configuration (when EMAIL_PROVIDER=smtp)
SMTP_HOST=smtp.gmail.com
SMTP_PORT=587
SMTP_USER=
SMTP_PASS=
SMTP_FROM=noreply@clear-platform.org
# Email Provider: "smtp" or "postmark"
EMAIL_PROVIDER=smtp
# SMTP Configuration (when EMAIL_PROVIDER=smtp)
SMTP_HOST=smtp.gmail.com
SMTP_PORT=587
SMTP_USER=
SMTP_PASS=
# Must be a verified sender for your SMTP provider; with Gmail this usually matches SMTP_USER
SMTP_FROM=your-account@gmail.com
🧰 Tools
🪛 dotenv-linter (4.0.0)

[warning] 21-21: [UnorderedKey] The SMTP_PASS key should go before the SMTP_PORT key

(UnorderedKey)


[warning] 22-22: [UnorderedKey] The SMTP_FROM key should go before the SMTP_HOST key

(UnorderedKey)

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.env.example around lines 14 - 22, The example .env pairs
EMAIL_PROVIDER=smtp with SMTP_HOST=smtp.gmail.com but uses an unrelated
SMTP_FROM (noreply@clear-platform.org); update the example so SMTP_FROM is
either blank or matches the SMTP_USER/verified Gmail address (e.g., set
SMTP_FROM to the same address as SMTP_USER or to a neutral placeholder like
your-email@example.com) and add a short inline comment reminding users that
SMTP_FROM must match a verified mailbox/alias when using Gmail (referencing
EMAIL_PROVIDER, SMTP_HOST, SMTP_USER, SMTP_FROM).


# Postmark Configuration (when EMAIL_PROVIDER=postmark)
# POSTMARK_SERVER_TOKEN=
# POSTMARK_SENDER_EMAIL=
2 changes: 1 addition & 1 deletion .github/workflows/ci.yml
Original file line number Diff line number Diff line change
Expand Up @@ -18,4 +18,4 @@ jobs:
- run: bun install --frozen-lockfile
- run: bun run lint
- run: bun run typecheck
- run: bun run test
# - run: bun run test
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Re-enable the test step in CI.

Commenting this out lets PRs merge with only lint/typecheck, so regressions in the new email/GeoJSON paths can slip through untested. If tests currently need extra setup, keep them in CI behind the right env/config instead of disabling them wholesale.

💡 Suggested workflow fix
-      # - run: bun run test
+      - run: bun run test
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# - run: bun run test
- run: bun run test
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/ci.yml at line 21, Restore the commented-out test step by
uncommenting the "- run: bun run test" entry in the CI workflow so tests run as
part of the pipeline; if the test suite requires extra setup or secrets, wrap
the test step with a conditional check on an appropriate env/config (e.g., using
if: env.RUN_TESTS == 'true' or adding required service steps) so tests are
executed in CI only when the necessary environment is available; ensure the step
remains named/described clearly (the "- run: bun run test" step) and that any
setup steps required by tests are included earlier in the workflow.

7 changes: 7 additions & 0 deletions bun.lock

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 4 additions & 1 deletion package.json
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,8 @@
"typecheck": "tsc --noEmit",
"seed": "tsx prisma/seed.ts",
"test": "vitest run",
"test:watch": "vitest"
"test:watch": "vitest",
"postinstall": "prisma generate"
},
"prisma": {
"seed": "tsx prisma/seed.ts"
Expand All @@ -26,13 +27,15 @@
"express": "^5.2.1",
"graphql": "^16.13.0",
"graphql-tag": "^2.12.6",
"nodemailer": "^8.0.1",
"zod": "^4.3.6"
},
"devDependencies": {
"@eslint/js": "^10.0.1",
"@types/cors": "^2.8.19",
"@types/express": "^5.0.6",
"@types/node": "^25.3.2",
"@types/nodemailer": "^7.0.11",
"eslint": "^10.0.2",
"prettier": "^3.8.1",
"prisma": "^7.4.2",
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
/*
Warnings:

- You are about to drop the column `sourceId` on the `Alert` table. All the data in the column will be lost.

*/
-- DropForeignKey
ALTER TABLE "Alert" DROP CONSTRAINT "Alert_sourceId_fkey";

-- DropIndex
DROP INDEX "Alert_sourceId_idx";

-- AlterTable
ALTER TABLE "Alert" DROP COLUMN "sourceId";
Comment on lines +1 to +14
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Backfill or guard existing Alert.sourceId data before dropping it.

This migration permanently deletes alert-source provenance. If any deployed environment still has non-null sourceId values, rollout becomes destructive with no preservation step here. Please add a backfill path or at least an explicit preflight abort until the old data is safely migrated.

🛑 Example preflight guard if a backfill is not ready yet
DO $$
BEGIN
  IF EXISTS (SELECT 1 FROM "Alert" WHERE "sourceId" IS NOT NULL) THEN
    RAISE EXCEPTION 'Backfill Alert.sourceId before applying this migration';
  END IF;
END $$;
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@prisma/migrations/20260308114835_remove_alert_sourceid/migration.sql` around
lines 1 - 14, The migration currently drops the Alert table's sourceId column
(see DROP CONSTRAINT "Alert_sourceId_fkey", DROP INDEX "Alert_sourceId_idx", and
ALTER TABLE "Alert" DROP COLUMN "sourceId"), which will irreversibly delete
provenance; add a preflight guard or backfill step before the DROP: either 1)
add a SQL preflight check (e.g., a DO $$ BEGIN ... IF EXISTS (SELECT 1 FROM
"Alert" WHERE "sourceId" IS NOT NULL) THEN RAISE EXCEPTION ... END IF; END $$;)
to abort the migration if any non-null sourceId exists, or 2) implement a
backfill in this migration that migrates/archives non-null sourceId values into
the new schema/location before executing DROP CONSTRAINT/DROP INDEX/DROP COLUMN,
and only proceed to drop after verifying the backfill completed successfully.

5 changes: 0 additions & 5 deletions prisma/schema.prisma
Original file line number Diff line number Diff line change
Expand Up @@ -136,7 +136,6 @@ model DataSource {
updatedAt DateTime @updatedAt

detections Detection[]
alerts Alert[]

@@index([type])
@@index([isActive])
Expand Down Expand Up @@ -194,9 +193,6 @@ model Alert {
severity Int
status AlertStatus @default(draft)

sourceId String?
source DataSource? @relation(fields: [sourceId], references: [id], onDelete: SetNull)

createdById String?
createdBy user? @relation("AlertCreatedBy", fields: [createdById], references: [id], onDelete: SetNull)

Expand All @@ -215,7 +211,6 @@ model Alert {

@@index([status, createdAt])
@@index([severity])
@@index([sourceId])
@@index([createdById])
}

Expand Down
Loading