feat(server): implement Phase 1.1 backend foundation #11

senutpal · 2026-01-01T18:40:03Z

Add Fastify 5 HTTP server with CORS, Helmet, JWT, rate limiting
Integrate Prisma 7 with PostgreSQL adapter and ESM support
Add Redis service with separate pub/sub clients for presence
Implement WebSocket handler with JWT auth and heartbeat protocol
Create GitHub OAuth authentication flow
Add REST routes: /auth, /users, /friends with full CRUD
Set up structured Pino logging with sensitive data redaction
Add hierarchical error system distinguishing operational errors
Configure graceful shutdown with connection cleanup

Summary by CodeRabbit

New Features
- GitHub OAuth login with token refresh/logout
- Follow/unfollow, followers/following lists, mutual friends
- User profiles with privacy mode, editable display name, and search
- Real-time presence, friend notifications, poke/heartbeat over WebSocket
Chores
- New backend server wiring (DB, Redis, WebSocket), structured logging, health checks, robust error handling, Prisma schema and config
- Lint/config updates and package metadata adjustments
CI
- Added Prisma client generation step to CI build

_{✏️ Tip: You can customize this high-level summary in your review settings.}

- Add Fastify 5 HTTP server with CORS, Helmet, JWT, rate limiting - Integrate Prisma 7 with PostgreSQL adapter and ESM support - Add Redis service with separate pub/sub clients for presence - Implement WebSocket handler with JWT auth and heartbeat protocol - Create GitHub OAuth authentication flow - Add REST routes: /auth, /users, /friends with full CRUD - Set up structured Pino logging with sensitive data redaction - Add hierarchical error system distinguishing operational errors - Configure graceful shutdown with connection cleanup

coderabbitai · 2026-01-01T18:40:11Z

Note

Other AI code review bot(s) detected

CodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review.

📝 Walkthrough

Walkthrough

Adds a new Fastify server app (apps/server) with Prisma schema, Redis-backed presence, GitHub OAuth + JWT auth, REST routes for users/friends, WebSocket real-time presence/poke handling, structured logging/errors, and related configs, scripts, and CI changes.

Changes

Cohort / File(s)	Summary
Project & Tooling `\`.gitignore``,` apps/server/tsconfig.json`,` apps/server/eslint.config.js`,` apps/server/package.json`	New server scaffold: .gitignore entry for generated Prisma client, TS config, ESLint config (extends base + ignores prisma generated), and package.json with scripts, ESM module, and dependencies.
Prisma & Schema `apps/server/prisma.config.ts`, `apps/server/prisma/schema.prisma`	Prisma 7 CLI config and PostgreSQL schema added (models: User, Follow, Team, TeamMember; enums Tier, Role) with migrations and datasource config.
Config & Core libs `apps/server/src/config.ts`, `apps/server/src/lib/errors.ts`, `apps/server/src/lib/logger.ts`	Zod-validated environment config and Env type; hierarchical AppError classes and helpers; Pino-based structured logger with redaction and child logger helper.
Services `apps/server/src/services/db.ts`, `apps/server/src/services/redis.ts`, `apps/server/src/services/github.ts`	Prisma client singleton + lifecycle and health checks; Redis command/sub/pub clients with presence APIs and token blacklist; GitHub OAuth helpers (auth URL, token exchange, upsert user, getters).
API Routes `apps/server/src/routes/auth.ts`, `apps/server/src/routes/users.ts`, `apps/server/src/routes/friends.ts`	Auth routes (GitHub redirect, callback, refresh, logout); user profile endpoints (me, get, patch, search); friends/follow endpoints (list, followers, follow, unfollow, mutuals) with validation and error handling.
Server & WebSocket `apps/server/src/server.ts`, `apps/server/src/types/fastify.d.ts`, `apps/server/src/ws/types.ts`, `apps/server/src/ws/handler.ts`	Fastify bootstrap (plugins, hooks, auth decorator, error handling, health), Fastify type augmentations, WebSocket types and handler with JWT auth, heartbeats, presence subscription, poke routing, connection tracking, and broadcast API.
Shared packages & validators `packages/eslint-config/package.json`, `packages/shared/package.json`, `packages/shared/src/validators.ts`	package.json export/dep updates; downgraded zod in shared package; validators import updated to `zod`; WebSocket message schema correlationId changed to `z.string().uuid().optional()`.
CI & Orchestration `.github/workflows/ci.yml`, `turbo.json`	CI step added to generate Prisma client for server; turbo task dependencies for check-types/lint/lint:fix now depend on ^build instead of topo.

Sequence Diagram(s)

sequenceDiagram
  participant Browser as User/Browser
  participant Server as Fastify Server
  participant GitHub as GitHub API
  participant DB as PostgreSQL

  Browser->>Server: GET /auth/github
  Server->>Server: generate state, set oauth_state cookie
  Server-->>Browser: 302 redirect -> GitHub auth URL
  Browser->>GitHub: authorize, redirect back with code & state
  Browser->>Server: GET /auth/callback?code&state
  Server->>Server: validate state & params
  Server->>GitHub: POST /login/oauth/access_token (code)
  GitHub-->>Server: access_token
  Server->>GitHub: GET /user (access_token)
  GitHub-->>Server: user profile
  Server->>DB: upsert user record
  DB-->>Server: user
  Server->>Server: sign JWT (userId, username, tier)
  Server-->>Browser: { token, user }

sequenceDiagram
  participant Client as WS Client
  participant Server as Fastify WS Handler
  participant DB as PostgreSQL
  participant Redis as Redis Pub/Sub

  Client->>Server: WS connect /ws?token=JWT
  Server->>Server: validate JWT -> userId
  Server->>DB: fetch friendIds
  DB-->>Server: friendIds[]
  Server->>Redis: SUBSCRIBE presence:friendId* (per friend)
  Redis-->>Server: subscription ack
  Server-->>Client: CONNECTED + initial FRIEND_STATUS list
  Client->>Server: HEARTBEAT {status, activity}
  Server->>Redis: set presence:userId, PUBLISH presence:userId
  Redis-->>Server: deliver presence updates to subscribers
  Server-->>Client: PONG and broadcast FRIEND_STATUS to subscribers
  Client->>Server: POKE { toUserId, message }
  Server->>Server: validate friend relation
  alt target online
    Server->>Server: deliver POKE to target's connections
  else
    Server->>Server: ignore or persist (noop)
  end

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Possibly related PRs

feat: Setup Monorepo foundation #1: Overlaps changes to packages/shared/src/validators.ts (zod import and WebSocketMessageSchema correlationId) used by the new WebSocket handler.

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The PR title 'feat(server): implement Phase 1.1 backend foundation' clearly summarizes the main change—establishing the foundational backend infrastructure with Fastify, Prisma, Redis, and related services.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

✨ Finishing touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch feat/backend-implementation-phase-1

📜 Recent review details

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between add8b14 and d555a07.

📒 Files selected for processing (1)

turbo.json

🔇 Additional comments (1)

turbo.json (1)

15-23: LGTM! Task dependencies correctly updated.

The change from ["topo"] to ["^build"] ensures that workspace dependencies (e.g., @devradar/shared) are fully compiled before type-checking and linting run. This prevents errors when dependent packages import from shared code that hasn't been built yet.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

apps/server/src/routes/auth.ts

apps/server/src/ws/handler.ts

greptile-apps · 2026-01-01T18:44:31Z

Greptile Summary

Implements Phase 1.1 backend foundation with Fastify 5 HTTP server, Prisma 7 database, Redis pub/sub for real-time presence, and WebSocket support with JWT authentication. The architecture is well-structured with clean separation of concerns, comprehensive error handling, and structured logging.

Critical Issues Found:

CSRF Vulnerability: OAuth state parameter generated but never validated in callback, allowing potential CSRF attacks
Memory Leak: Redis pub/sub message listeners added on every WebSocket connection but never removed, causing memory to grow unbounded
Broken Graceful Shutdown: Shutdown handlers don't properly exit the process and uncaught exception handlers incorrectly attempt graceful shutdown

Architecture Highlights:

Clean hexagonal architecture with service adapters for database and Redis
Hierarchical error system distinguishing operational vs programming errors
Proper use of Prisma 7 adapter pattern with PostgreSQL
Type-safe configuration with Zod validation
Comprehensive request validation using shared Zod schemas
Structured logging with sensitive data redaction

Other Concerns:

Unnecessary JWT verification attempt in WebSocket handler (will always fail and fall through to query token)
Potential performance issue with Redis publish on every heartbeat (every 30s per user)
Duplicate auth route registration may cause confusion

The code quality and architecture are excellent, but the critical security and stability issues must be resolved before merging.

Confidence Score: 2/5

This PR has critical security and stability issues that must be fixed before production deployment
Score reflects critical CSRF vulnerability in OAuth flow, memory leak in WebSocket handler from unremoved Redis listeners, and broken graceful shutdown that won't exit the process. These are production-blocking issues that could lead to security breaches and server instability.
Pay close attention to apps/server/src/routes/auth.ts (CSRF vulnerability), apps/server/src/ws/handler.ts (memory leak), and apps/server/src/server.ts (shutdown issues)

Important Files Changed

Filename	Overview
apps/server/src/routes/auth.ts	OAuth flow implementation with critical CSRF vulnerability - state parameter not validated
apps/server/src/ws/handler.ts	WebSocket handler with memory leak - Redis pub/sub listeners never removed on disconnect
apps/server/src/server.ts	Server setup with graceful shutdown issues - handlers don't properly exit process
apps/server/src/services/redis.ts	Redis service with separate pub/sub clients, potential performance concern with frequent publishes

Sequence Diagram

sequenceDiagram
    participant Client
    participant Server as Fastify Server
    participant GitHub
    participant DB as PostgreSQL
    participant Redis
    participant WS as WebSocket

    Note over Client,WS: OAuth Authentication
    Client->>Server: GET /auth/github
    Server->>Client: Redirect to GitHub
    Client->>GitHub: Authorize app
    GitHub->>Server: Callback with code
    Server->>GitHub: Exchange code for access
    GitHub->>Server: User profile
    Server->>DB: Upsert user
    Server->>Client: Return signed JWT

    Note over Client,WS: WebSocket Connection
    Client->>WS: Connect with JWT
    WS->>DB: Fetch friend IDs
    WS->>Redis: Subscribe to presence
    Redis->>WS: Current presences
    WS->>Client: CONNECTED + friend statuses

    Note over Client,WS: Real-time Updates
    Client->>WS: HEARTBEAT with status
    WS->>Redis: Update presence (SETEX + PUBLISH)
    Redis-->>WS: Notify subscribers
    WS->>Client: Friend status updates

    Note over Client,WS: REST Operations
    Client->>Server: POST /friends/:id
    Server->>DB: Create follow
    Server->>Client: Success response
    
    Client->>Server: GET /friends
    Server->>DB: Query follows
    Server->>Redis: Get presences
    Server->>Client: Friends with status

greptile-apps

_{22 files reviewed, 9 comments}

_{Edit Code Review Agent Settings | Greptile}

greptile-apps · 2026-01-01T18:44:25Z

apps/server/src/routes/auth.ts

+    // Generate state for CSRF protection
+    const state = crypto.randomUUID();
+
+    // Store state in session/cookie for validation (simplified for now)
+    // In production, use secure cookies or session storage


logic: CSRF state validation is not implemented. The state parameter is generated but never stored or validated in the callback, creating a CSRF vulnerability.

Suggested change

// Generate state for CSRF protection

const state = crypto.randomUUID();

// Store state in session/cookie for validation (simplified for now)

// In production, use secure cookies or session storage

// Generate state for CSRF protection

const state = crypto.randomUUID();

// Store state in secure cookie for validation

reply.setCookie('oauth_state', state, {

httpOnly: true,

secure: isProduction,

sameSite: 'lax',

maxAge: 600, // 10 minutes

});

Prompt To Fix With AI

This is a comment left during a code review. Path: apps/server/src/routes/auth.ts Line: 36:40 Comment: **logic:** CSRF state validation is not implemented. The state parameter is generated but never stored or validated in the callback, creating a CSRF vulnerability. ```suggestion // Generate state for CSRF protection const state = crypto.randomUUID(); // Store state in secure cookie for validation reply.setCookie('oauth_state', state, { httpOnly: true, secure: isProduction, sameSite: 'lax', maxAge: 600, // 10 minutes }); ``` How can I resolve this? If you propose a fix, please make it concise.

greptile-apps · 2026-01-01T18:44:25Z

apps/server/src/routes/auth.ts

+  app.get('/auth/callback', async (request: FastifyRequest, reply: FastifyReply) => {
+    const result = CallbackQuerySchema.safeParse(request.query);
+
+    if (!result.success) {
+      throw new ValidationError('Invalid callback parameters', {
+        details: { errors: result.error.issues },
+      });
+    }
+
+    const { code, error, error_description } = result.data;
+
+    // Handle OAuth errors from GitHub
+    if (error) {
+      logger.warn({ error, error_description }, 'GitHub OAuth error');
+      return reply.status(400).send({
+        error: {
+          code: 'OAUTH_ERROR',
+          message: error_description ?? error,
+        },
+      });
+    }


logic: Missing state validation in OAuth callback creates CSRF vulnerability.

Suggested change

app.get('/auth/callback', async (request: FastifyRequest, reply: FastifyReply) => {

const result = CallbackQuerySchema.safeParse(request.query);

if (!result.success) {

throw new ValidationError('Invalid callback parameters', {

details: { errors: result.error.issues },

});

}

const { code, error, error_description } = result.data;

// Handle OAuth errors from GitHub

if (error) {

logger.warn({ error, error_description }, 'GitHub OAuth error');

return reply.status(400).send({

error: {

code: 'OAUTH_ERROR',

message: error_description ?? error,

},

});

}

app.get('/auth/callback', async (request: FastifyRequest, reply: FastifyReply) => {

const result = CallbackQuerySchema.safeParse(request.query);

if (!result.success) {

throw new ValidationError('Invalid callback parameters', {

details: { errors: result.error.issues },

});

}

const { code, state, error, error_description } = result.data;

// Validate CSRF state

const storedState = request.cookies.oauth_state;

if (!state || !storedState || state !== storedState) {

logger.warn({ providedState: state }, 'OAuth state mismatch');

return reply.status(400).send({

error: {

code: 'INVALID_STATE',

message: 'Invalid OAuth state parameter',

},

});

}

// Clear the state cookie

reply.clearCookie('oauth_state');

// Handle OAuth errors from GitHub

if (error) {

Prompt To Fix With AI

This is a comment left during a code review. Path: apps/server/src/routes/auth.ts Line: 54:74 Comment: **logic:** Missing state validation in OAuth callback creates CSRF vulnerability. ```suggestion app.get('/auth/callback', async (request: FastifyRequest, reply: FastifyReply) => { const result = CallbackQuerySchema.safeParse(request.query); if (!result.success) { throw new ValidationError('Invalid callback parameters', { details: { errors: result.error.issues }, }); } const { code, state, error, error_description } = result.data; // Validate CSRF state const storedState = request.cookies.oauth_state; if (!state || !storedState || state !== storedState) { logger.warn({ providedState: state }, 'OAuth state mismatch'); return reply.status(400).send({ error: { code: 'INVALID_STATE', message: 'Invalid OAuth state parameter', }, }); } // Clear the state cookie reply.clearCookie('oauth_state'); // Handle OAuth errors from GitHub if (error) { ``` How can I resolve this? If you propose a fix, please make it concise.

greptile-apps · 2026-01-01T18:44:26Z

apps/server/src/ws/handler.ts

+
+  // Handle incoming presence updates
+  subscriber.on('message', (channel: string, messageData: string) => {
+    try {
+      const data = JSON.parse(messageData) as FriendStatusPayload;
+      send(ws, 'FRIEND_STATUS', data);
+    } catch (error) {
+      logger.error({ error, channel }, 'Failed to parse presence message');
+    }
+  });
+}


logic: Redis pub/sub listener is registered for every WebSocket connection without cleanup, causing memory leak. Each new connection adds a new 'message' listener that's never removed.

Suggested change

// Handle incoming presence updates

subscriber.on('message', (channel: string, messageData: string) => {

try {

const data = JSON.parse(messageData) as FriendStatusPayload;

send(ws, 'FRIEND_STATUS', data);

} catch (error) {

logger.error({ error, channel }, 'Failed to parse presence message');

}

});

}

// Store the message handler so it can be removed later

const messageHandler = (channel: string, messageData: string) => {

try {

const data = JSON.parse(messageData) as FriendStatusPayload;

send(ws, 'FRIEND_STATUS', data);

} catch (error) {

logger.error({ error, channel }, 'Failed to parse presence message');

}

};

// Attach handler to ws for cleanup on close

ws.presenceMessageHandler = messageHandler;

// Subscribe to friend channels

for (const friendId of ws.friendIds) {

const channel = REDIS_KEYS.presenceChannel(friendId);

await subscriber.subscribe(channel);

logger.debug({ userId: ws.userId, friendId, channel }, 'Subscribed to friend presence');

}

subscriber.on('message', messageHandler);

Prompt To Fix With AI

This is a comment left during a code review. Path: apps/server/src/ws/handler.ts Line: 118:128 Comment: **logic:** Redis pub/sub listener is registered for every WebSocket connection without cleanup, causing memory leak. Each new connection adds a new `'message'` listener that's never removed. ```suggestion // Store the message handler so it can be removed later const messageHandler = (channel: string, messageData: string) => { try { const data = JSON.parse(messageData) as FriendStatusPayload; send(ws, 'FRIEND_STATUS', data); } catch (error) { logger.error({ error, channel }, 'Failed to parse presence message'); } }; // Attach handler to ws for cleanup on close ws.presenceMessageHandler = messageHandler; // Subscribe to friend channels for (const friendId of ws.friendIds) { const channel = REDIS_KEYS.presenceChannel(friendId); await subscriber.subscribe(channel); logger.debug({ userId: ws.userId, friendId, channel }, 'Subscribed to friend presence'); } subscriber.on('message', messageHandler); ``` How can I resolve this? If you propose a fix, please make it concise.

greptile-apps · 2026-01-01T18:44:27Z

apps/server/src/ws/handler.ts

+
+  // Unsubscribe from friend channels
+  const subscriber = getRedisSubscriber();
+  for (const friendId of ws.friendIds) {
+    const channel = REDIS_KEYS.presenceChannel(friendId);
+    await subscriber.unsubscribe(channel);
+  }
+}


logic: Redis pub/sub message handler is never removed when unsubscribing, only channels are unsubscribed.

Suggested change

// Unsubscribe from friend channels

const subscriber = getRedisSubscriber();

for (const friendId of ws.friendIds) {

const channel = REDIS_KEYS.presenceChannel(friendId);

await subscriber.unsubscribe(channel);

}

}

// Unsubscribe from friend channels

const subscriber = getRedisSubscriber();

// Remove the message handler to prevent memory leak

if (ws.presenceMessageHandler) {

subscriber.off('message', ws.presenceMessageHandler);

}

for (const friendId of ws.friendIds) {

const channel = REDIS_KEYS.presenceChannel(friendId);

await subscriber.unsubscribe(channel);

}

Prompt To Fix With AI

This is a comment left during a code review. Path: apps/server/src/ws/handler.ts Line: 260:267 Comment: **logic:** Redis pub/sub message handler is never removed when unsubscribing, only channels are unsubscribed. ```suggestion // Unsubscribe from friend channels const subscriber = getRedisSubscriber(); // Remove the message handler to prevent memory leak if (ws.presenceMessageHandler) { subscriber.off('message', ws.presenceMessageHandler); } for (const friendId of ws.friendIds) { const channel = REDIS_KEYS.presenceChannel(friendId); await subscriber.unsubscribe(channel); } ``` How can I resolve this? If you propose a fix, please make it concise.

greptile-apps · 2026-01-01T18:44:27Z

apps/server/src/server.ts

+    const shutdown = (signal: string): void => {
+      logger.info({ signal }, 'Shutdown signal received');
+
+      // Set a timeout for graceful shutdown
+      const shutdownTimeout = setTimeout(() => {
+        logger.error('Graceful shutdown timed out, forcing exit');
+        throw new Error('Shutdown timeout');
+      }, 30_000);
+
+      Promise.all([
+        app?.close().then(() => {
+          logger.info('HTTP server closed');
+        }),
+        disconnectDb(),
+        disconnectRedis(),
+      ])
+        .then(() => {
+          clearTimeout(shutdownTimeout);
+          logger.info('Graceful shutdown complete');
+        })
+        .catch((error: unknown) => {
+          logger.error({ error }, 'Error during shutdown');
+          clearTimeout(shutdownTimeout);
+          throw error;
+        });
+    };


logic: Shutdown handler doesn't properly exit the process after cleanup, and errors during shutdown incorrectly throw (which will crash without cleanup).

Suggested change

const shutdown = (signal: string): void => {

logger.info({ signal }, 'Shutdown signal received');

// Set a timeout for graceful shutdown

const shutdownTimeout = setTimeout(() => {

logger.error('Graceful shutdown timed out, forcing exit');

throw new Error('Shutdown timeout');

}, 30_000);

Promise.all([

app?.close().then(() => {

logger.info('HTTP server closed');

}),

disconnectDb(),

disconnectRedis(),

])

.then(() => {

clearTimeout(shutdownTimeout);

logger.info('Graceful shutdown complete');

})

.catch((error: unknown) => {

logger.error({ error }, 'Error during shutdown');

clearTimeout(shutdownTimeout);

throw error;

});

};

const shutdown = async (signal: string): Promise<void> => {

logger.info({ signal }, 'Shutdown signal received');

// Set a timeout for graceful shutdown

const shutdownTimeout = setTimeout(() => {

logger.error('Graceful shutdown timed out, forcing exit');

process.exit(1);

}, 30_000);

try {

await Promise.all([

app?.close().then(() => {

logger.info('HTTP server closed');

}),

disconnectDb(),

disconnectRedis(),

]);

clearTimeout(shutdownTimeout);

logger.info('Graceful shutdown complete');

process.exit(0);

} catch (error: unknown) {

logger.error({ error }, 'Error during shutdown');

clearTimeout(shutdownTimeout);

process.exit(1);

}

};

Prompt To Fix With AI

This is a comment left during a code review. Path: apps/server/src/server.ts Line: 270:295 Comment: **logic:** Shutdown handler doesn't properly exit the process after cleanup, and errors during shutdown incorrectly throw (which will crash without cleanup). ```suggestion const shutdown = async (signal: string): Promise<void> => { logger.info({ signal }, 'Shutdown signal received'); // Set a timeout for graceful shutdown const shutdownTimeout = setTimeout(() => { logger.error('Graceful shutdown timed out, forcing exit'); process.exit(1); }, 30_000); try { await Promise.all([ app?.close().then(() => { logger.info('HTTP server closed'); }), disconnectDb(), disconnectRedis(), ]); clearTimeout(shutdownTimeout); logger.info('Graceful shutdown complete'); process.exit(0); } catch (error: unknown) { logger.error({ error }, 'Error during shutdown'); clearTimeout(shutdownTimeout); process.exit(1); } }; ``` How can I resolve this? If you propose a fix, please make it concise.

greptile-apps · 2026-01-01T18:44:28Z

apps/server/src/server.ts

+    process.on('SIGTERM', () => {
+      shutdown('SIGTERM');
+    });
+    process.on('SIGINT', () => {
+      shutdown('SIGINT');
+    });
+
+    // Handle uncaught errors
+    process.on('uncaughtException', (error) => {
+      logger.fatal({ error }, 'Uncaught exception');
+      shutdown('uncaughtException');
+    });
+
+    process.on('unhandledRejection', (reason) => {
+      logger.fatal({ reason }, 'Unhandled rejection');
+      shutdown('unhandledRejection');
+    });


logic: Signal handlers call shutdown() but don't await it, causing process to continue running. Also, uncaughtException and unhandledRejection shouldn't call shutdown - they should exit immediately.

Suggested change

process.on('SIGTERM', () => {

shutdown('SIGTERM');

});

process.on('SIGINT', () => {

shutdown('SIGINT');

});

// Handle uncaught errors

process.on('uncaughtException', (error) => {

logger.fatal({ error }, 'Uncaught exception');

shutdown('uncaughtException');

});

process.on('unhandledRejection', (reason) => {

logger.fatal({ reason }, 'Unhandled rejection');

shutdown('unhandledRejection');

});

process.on('SIGTERM', () => {

void shutdown('SIGTERM');

});

process.on('SIGINT', () => {

void shutdown('SIGINT');

});

// Handle uncaught errors - exit immediately, don't attempt graceful shutdown

process.on('uncaughtException', (error) => {

logger.fatal({ error }, 'Uncaught exception');

process.exit(1);

});

process.on('unhandledRejection', (reason) => {

logger.fatal({ reason }, 'Unhandled rejection');

process.exit(1);

});

Prompt To Fix With AI

This is a comment left during a code review. Path: apps/server/src/server.ts Line: 297:313 Comment: **logic:** Signal handlers call `shutdown()` but don't await it, causing process to continue running. Also, `uncaughtException` and `unhandledRejection` shouldn't call shutdown - they should exit immediately. ```suggestion process.on('SIGTERM', () => { void shutdown('SIGTERM'); }); process.on('SIGINT', () => { void shutdown('SIGINT'); }); // Handle uncaught errors - exit immediately, don't attempt graceful shutdown process.on('uncaughtException', (error) => { logger.fatal({ error }, 'Uncaught exception'); process.exit(1); }); process.on('unhandledRejection', (reason) => { logger.fatal({ reason }, 'Unhandled rejection'); process.exit(1); }); ``` How can I resolve this? If you propose a fix, please make it concise.

greptile-apps · 2026-01-01T18:44:28Z

apps/server/src/ws/handler.ts

+      let decoded: { userId: string };
+      try {
+        decoded = await request.jwtVerify<{ userId: string }>({ onlyCookie: false });
+      } catch {
+        // Try from query token as header might not be available
+        try {
+          decoded = app.jwt.verify<{ userId: string }>(token);
+        } catch {
+          ws.close(WsCloseCodes.INVALID_TOKEN, 'Invalid token');
+          return;
+        }
+      }


syntax: JWT verification attempts request.jwtVerify() which requires the JWT to be in the Authorization header, but WebSocket connections can't set custom headers from browsers. The fallback to query token will always execute.

Suggested change

let decoded: { userId: string };

try {

decoded = await request.jwtVerify<{ userId: string }>({ onlyCookie: false });

} catch {

// Try from query token as header might not be available

try {

decoded = app.jwt.verify<{ userId: string }>(token);

} catch {

ws.close(WsCloseCodes.INVALID_TOKEN, 'Invalid token');

return;

}

}

// Verify JWT from query parameter

// (WebSocket connections from browsers can't set Authorization headers)

let decoded: { userId: string };

try {

decoded = app.jwt.verify<{ userId: string }>(token);

} catch {

ws.close(WsCloseCodes.INVALID_TOKEN, 'Invalid token');

return;

}

Prompt To Fix With AI

This is a comment left during a code review. Path: apps/server/src/ws/handler.ts Line: 286:297 Comment: **syntax:** JWT verification attempts `request.jwtVerify()` which requires the JWT to be in the Authorization header, but WebSocket connections can't set custom headers from browsers. The fallback to query token will always execute. ```suggestion // Verify JWT from query parameter // (WebSocket connections from browsers can't set Authorization headers) let decoded: { userId: string }; try { decoded = app.jwt.verify<{ userId: string }>(token); } catch { ws.close(WsCloseCodes.INVALID_TOKEN, 'Invalid token'); return; } ``` How can I resolve this? If you propose a fix, please make it concise.

greptile-apps · 2026-01-01T18:44:29Z

apps/server/src/server.ts

+  // Also register auth at root for OAuth redirects
+  app.register(authRoutes, { prefix: '/auth' });
+


style: Registering auth routes twice (at /api/v1/auth and /auth) may cause confusion. The comment says "for OAuth redirects" but the callback URL should be configured to match one specific path. Is the dual registration intentional? Which path should GITHUB_CALLBACK_URL use?

Prompt To Fix With AI

This is a comment left during a code review. Path: apps/server/src/server.ts Line: 224:226 Comment: **style:** Registering auth routes twice (at `/api/v1/auth` and `/auth`) may cause confusion. The comment says "for OAuth redirects" but the callback URL should be configured to match one specific path. Is the dual registration intentional? Which path should `GITHUB_CALLBACK_URL` use? How can I resolve this? If you propose a fix, please make it concise.

greptile-apps · 2026-01-01T18:44:30Z

apps/server/src/services/redis.ts

+export async function setPresence(userId: string, data: PresenceData): Promise<void> {
+  const redis = getRedis();
+  const key = REDIS_KEYS.presence(userId);
+
+  await redis.setex(key, PRESENCE_TTL_SECONDS, JSON.stringify(data));
+
+  // Publish presence update for real-time subscribers
+  const pub = getRedisPublisher();
+  await pub.publish(REDIS_KEYS.presenceChannel(userId), JSON.stringify(data));
+}


style: Publishing to Redis after every setPresence call could create significant Redis load with frequent heartbeats (every 30s per connected user). Consider batching or throttling presence updates.

_{Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!}

Prompt To Fix With AI

This is a comment left during a code review. Path: apps/server/src/services/redis.ts Line: 159:168 Comment: **style:** Publishing to Redis after every `setPresence` call could create significant Redis load with frequent heartbeats (every 30s per connected user). Consider batching or throttling presence updates. <sub>Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!</sub> How can I resolve this? If you propose a fix, please make it concise.

coderabbitai

Actionable comments posted: 26

📜 Review details

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 4b06f22 and a720654.

⛔ Files ignored due to path filters (1)

pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (22)

.gitignore
apps/server/eslint.config.js
apps/server/package.json
apps/server/prisma.config.ts
apps/server/prisma/schema.prisma
apps/server/src/config.ts
apps/server/src/lib/errors.ts
apps/server/src/lib/logger.ts
apps/server/src/routes/auth.ts
apps/server/src/routes/friends.ts
apps/server/src/routes/users.ts
apps/server/src/server.ts
apps/server/src/services/db.ts
apps/server/src/services/github.ts
apps/server/src/services/redis.ts
apps/server/src/types/fastify.d.ts
apps/server/src/ws/handler.ts
apps/server/src/ws/types.ts
apps/server/tsconfig.json
packages/eslint-config/package.json
packages/shared/package.json
packages/shared/src/validators.ts

🧰 Additional context used

🧬 Code graph analysis (9)

apps/server/src/lib/logger.ts (1)

apps/server/src/config.ts (2)

env (75-75)

isDevelopment (85-85)

apps/server/src/routes/users.ts (5)

packages/shared/src/types.ts (1)

UserDTO (89-99)

apps/server/src/services/db.ts (2)

db (85-85)

getDb (25-39)

apps/server/src/lib/errors.ts (2)

NotFoundError (117-125)

ValidationError (63-77)

apps/server/src/services/redis.ts (1)

getPresence (176-188)

packages/shared/src/validators.ts (1)

UserUpdateSchema (82-85)

apps/server/src/services/redis.ts (3)

apps/server/src/lib/logger.ts (1)

logger (76-76)

apps/server/src/config.ts (1)

env (75-75)

packages/shared/src/constants.ts (2)

REDIS_KEYS (30-36)

PRESENCE_TTL_SECONDS (5-5)

apps/server/src/server.ts (7)

apps/server/src/config.ts (3)

isProduction (80-80)

isDevelopment (85-85)

env (75-75)

apps/server/src/lib/errors.ts (2)

AuthenticationError (91-99)

toAppError (207-217)

apps/server/src/lib/logger.ts (1)

logger (76-76)

apps/server/src/services/db.ts (3)

isDbHealthy (74-82)

connectDb (45-55)

disconnectDb (61-67)

apps/server/src/services/redis.ts (3)

isRedisHealthy (132-140)

connectRedis (98-111)

disconnectRedis (117-127)

apps/server/src/ws/handler.ts (2)

getConnectionCount (384-386)

registerWebSocketHandler (272-367)

apps/server/src/routes/auth.ts (1)

authRoutes (30-144)

apps/server/src/routes/auth.ts (3)

apps/server/src/services/github.ts (2)

getGitHubAuthUrl (64-77)

authenticateWithGitHub (147-185)

apps/server/src/lib/logger.ts (1)

logger (76-76)

apps/server/src/lib/errors.ts (1)

ValidationError (63-77)

apps/server/src/services/db.ts (2)

apps/server/src/config.ts (2)

env (75-75)

isDevelopment (85-85)

apps/server/src/lib/logger.ts (1)

logger (76-76)

apps/server/src/services/github.ts (4)

apps/server/src/config.ts (1)

env (75-75)

apps/server/src/lib/logger.ts (1)

logger (76-76)

apps/server/src/lib/errors.ts (2)

AuthenticationError (91-99)

InternalError (162-170)

apps/server/src/services/db.ts (2)

db (85-85)

getDb (25-39)

apps/server/prisma.config.ts (1)

apps/server/src/config.ts (1)

env (75-75)

apps/server/src/ws/types.ts (1)

packages/shared/src/types.ts (1)

UserStatusType (4-4)

🪛 GitHub Actions: CI

apps/server/src/lib/logger.ts