feat: implement document upload infrastructure, UI components, and ba…#2
Merged
Conversation
…ckend integration for PDF and text processing
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Code Review by Qodo
1. DropZone missing use client
|
… and chat route handlers
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
Comment on lines
1
to
3
| import { useCallback } from "react"; | ||
| import { useDropzone } from "react-dropzone"; | ||
| import { CloudUpload, FileText, AlertCircle } from "lucide-react"; |
There was a problem hiding this comment.
1. dropzone missing use client 📘 Rule violation ≡ Correctness
features/upload/components/DropZone.tsx uses React hooks (useCallback, useDropzone) but the PR removed the required "use client" directive, causing Next.js to treat it as a Server Component and fail at build/runtime. This breaks the repository’s Next.js App Router component conventions and can disrupt the upload UI because UploadTabs (a Client Component) imports DropZone.
Agent Prompt
## Issue description
`features/upload/components/DropZone.tsx` uses client-only React hooks (`useCallback`, `useDropzone`) but is missing the required `"use client";` directive at the top of the file, so Next.js treats it as a Server Component by default and will error at build/runtime.
## Issue Context
This PR removed `"use client"` from `DropZone.tsx` while keeping hook usage, and `UploadTabs.tsx` is a Client Component that imports `DropZone`, making the issue surface as a Next.js App Router Server/Client component boundary violation.
## Fix Focus Areas
- features/upload/components/DropZone.tsx[1-10]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+76
to
+97
| // Overwrite behavior: Delete existing document chunks with the same name | ||
| // to avoid duplicate search results. | ||
| const { error: deleteError } = await supabase | ||
| .from("documents") | ||
| .delete() | ||
| .eq("name", name); | ||
|
|
||
| if (deleteError) { | ||
| console.warn("Could not delete old chunks (non-blocking):", deleteError.message, deleteError.details); | ||
| } | ||
|
|
||
| // Insert new chunks | ||
| const records = chunks.map((chunk, index) => ({ | ||
| name, | ||
| content: chunk, | ||
| embedding: embeddings[index], | ||
| })); | ||
|
|
||
| const { error: insertError } = await supabase | ||
| .from("documents") | ||
| .insert(records); | ||
|
|
There was a problem hiding this comment.
2. Unauthenticated service-role api 🐞 Bug ⛨ Security
The new /api/upload and /api/chat routes perform privileged Supabase operations using a client initialized with SUPABASE_SERVICE_ROLE_KEY, but the routes have no authentication/authorization checks. Any caller who can reach these endpoints can insert/delete document chunks and query document contents via vector search, and can also burn Cohere/Groq API quota.
Agent Prompt
### Issue description
`/api/upload` and `/api/chat` are publicly callable but use a Supabase client created with `SUPABASE_SERVICE_ROLE_KEY`, enabling unauthorized document mutation/query and paid API usage.
### Issue Context
- Client-side hooks call `/api/upload` and `/api/chat` directly.
- Service-role bypasses RLS; without per-user scoping this becomes admin access from the internet.
### Fix Focus Areas
- app/api/upload/route.ts[9-18]
- app/api/upload/route.ts[76-97]
- app/api/chat/route.ts[8-40]
- lib/supabase.ts[3-15]
- lib/n8n.ts[4-6]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
…ng and chat retrieval
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR Summary by Qodo
Implement RAG upload + chat API with Supabase vectors, Cohere embeddings, and Groq
✨ Enhancement⚙️ Configuration changes📝 Documentation🕐 40+ MinutesWalkthroughs
User Description
…ckend integration for PDF and text processing
AI Description
Diagram
graph TD UUI(["Upload UI"]) --> AUP[["/api/upload"]] --> DP["PDF/text processing"] --> COH{{"Cohere Embed"}} --> SB[("Supabase pgvector")] CUI(["Chat UI"]) --> ACH[["/api/chat"]] --> COH --> SB ACH --> GRQ{{"Groq Chat"}} subgraph Legend direction LR _ui(["UI Page"]) ~~~ _api[["API Route"]] ~~~ _proc["Processor"] ~~~ _ext{{"External API"}} ~~~ _db[("Database")] endHigh-Level Assessment
The following are alternative approaches to this PR:
1. Use Supabase Edge Functions for upload/chat APIs
2. Keep n8n webhooks as the sole backend (as in existing prompt doc)
3. Use Supabase client with RLS + per-user auth instead of service role
Recommendation: The current Node.js route approach is a pragmatic fit given PDF parsing requirements and the need to keep secrets server-side. However, reviewers should explicitly validate (1) service-role usage is only on the server and never exposed to clients, (2) Node runtime requirements (pdf-parse and Supabase packages indicate Node >=20.16+) match deployment, and (3) documentation alignment—doqify-prompt.md currently states “no backend routes needed,” which conflicts with this implementation.
File Changes
Enhancement (11)
Documentation (1)
Other (5)