Merged
Conversation
Contributor
|
Caution Review failedFailed to post review comments. WalkthroughThis PR introduces streaming database connection/loading, adds an API token management feature (backend routes and frontend UI), integrates optional MCP endpoints, refactors loader interfaces to async generators with distinct-values enrichment, updates auth and home routing, removes several legacy loaders/examples/schemas, and reorganizes documentation, env config, CSS/TS, and tests accordingly. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant U as User
participant UI as Database Modal (Frontend)
participant S as Server (/database)
participant L as Loader (Postgres/MySQL)
participant G as Graph DB
U->>UI: Open Connect Database
UI->>S: POST /database { url, type }
Note right of S: StreamingResponse<br/>delimiter: "|||FALKORDB_MESSAGE_BOUNDARY|||"
S-->>UI: reasoning_step: "Starting..."
S->>S: Detect DB type/loader
alt Valid type
S->>L: load(prefix, url) (async generator)
loop Progress
L-->>S: yield (ok, message)
S-->>UI: reasoning_step: message
end
L->>G: Persist schema
S-->>UI: final_result: success
else Invalid/Error
S-->>UI: error message
end
sequenceDiagram
autonumber
participant U as User (Authenticated)
participant UI as Tokens Modal
participant A as API /tokens
participant OG as Orgs Graph
U->>UI: Open Tokens Modal
UI->>A: GET /tokens/list
A->>OG: MATCH Identity-[:HAS_TOKEN]->Token
OG-->>A: Token list
A-->>UI: { tokens: [...] }
U->>UI: Generate New Token
UI->>A: POST /tokens/generate
A->>OG: Persist token (via callback handler)
A-->>UI: { token_id, created_at }
U->>UI: Delete (last4)
UI->>A: DELETE /tokens/{last4}
A->>OG: DELETE matching token
A-->>UI: 200/404
sequenceDiagram
autonumber
participant App as App Factory
participant MCP as FastApiMCP
participant R as Routers
App->>App: Read DISABLE_MCP
alt MCP enabled
App->>MCP: Instantiate (name, description, operations)
MCP->>App: mount_http()
else Disabled
App->>App: Log "MCP disabled"
end
App->>R: include_router(tokens, /tokens)
Estimated code review effort🎯 5 (Critical) | ⏱️ ~120–180 minutes Possibly related PRs
Suggested reviewers
Poem
✨ Finishing Touches
🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
Dependency ReviewThe following issues were found:
License IssuesPipfile
Pipfile.lock
OpenSSF ScorecardScorecard details
Scanned Files
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| "token_id": token_id | ||
| }) | ||
|
|
||
| logging.info("Token deleted for user %s: token_id=%s", user_email, token_id) |
Check failure
Code scanning / CodeQL
Log Injection High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 5 months ago
To fix this issue, we should sanitize the token_id parameter before logging it to ensure that it does not contain any characters which could break or forge log entries (specifically: carriage returns \r or newlines \n). The simplest approach is to remove or replace these characters before writing to logs. We will do this directly before the logging statement in the delete_token handler, by assigning a cleaned version of token_id (e.g., replacing all \r and \n characters with the empty string). No additional dependencies are required.
Edit the region of api/routes/tokens.py within the delete_token handler, immediately before the logging statement that logs token_id. You only need to edit lines you have been shown, and you can define a new variable or overwrite token_id locally.
Suggested changeset
1
api/routes/tokens.py
| @@ -128,7 +128,9 @@ | ||
| "token_id": token_id | ||
| }) | ||
|
|
||
| logging.info("Token deleted for user %s: token_id=%s", user_email, token_id) | ||
| # Sanitize token_id to prevent log injection | ||
| safe_token_id = token_id.replace('\r', '').replace('\n', '') | ||
| logging.info("Token deleted for user %s: token_id=%s", user_email, safe_token_id) | ||
|
|
||
| if result.result_set and result.result_set[0][0] > 0: | ||
| return JSONResponse( |
Copilot is powered by AI and may make mistakes. Always verify output.
galshubeli
approved these changes
Sep 2, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
New Features
Changes
Documentation
Chores