fix: authorization type error

[mdatelle]

Fixes the dependency injection issue happening with the validateCookiesCasbin method TypeError in cookie.strategy.ts by updating the vite.config to include the passport modules.

Summary by CodeRabbit

• New Features

  • Enhanced dependency management for the build process.
  • Added new GraphQL input types and mutations for improved role and permission management.
  • Introduced a new configuration file for GraphQL code generation.
  • Updated volume mapping in Docker configuration for code generation.

• Bug Fixes

  • Improved handling of module interoperability.

• Chores

  • Reformatted configuration files for consistency.
  • Updated scripts in package.json for streamlined development processes.

[coderabbitai]

Walkthrough

The pull request introduces modifications to the Vite configuration and package.json in the API directory. The changes enhance dependency optimization, module handling, and development environment configuration. The Vite configuration (vite.config.ts) is updated to include additional dependencies for optimization, adjust module interoperability settings, and refine CommonJS module handling. The package.json is reformatted for consistency, and the build script now includes the vite.config.ts file in the deployment process. Additionally, a new GraphQL code generation configuration file is added, replacing an older YAML file, and several updates are made to the GraphQL schema in the graphql.ts file.

Changes

File	Change Summary
api/vite.config.ts	- Enhanced optimizeDeps.include with additional dependencies - Introduced build.rollupOptions.output.interop and updated external configurations - Enhanced commonjsOptions with new settings for module handling
api/package.json	- Complete reformatting for consistent styling while retaining original content in all sections - Updated scripts section and added new dependencies
api/scripts/build.mjs	- Added vite.config.ts to the list of files copied to the deployment directory
api/codegen.ts	- New configuration object const config: CodegenConfig added - Default export export default config; added
api/codegen.yml	- Deleted file containing previous GraphQL code generation settings
web/composables/gql/graphql.ts	- Added new input types: AddPermissionInput, AddRoleForApiKeyInput, AddRoleForUserInput - Updated ApiKey type structure - Added new mutations and updated existing types for enhanced role management
api/docker-compose.yml	- Updated volume mapping from codegen.yml to codegen.ts
api/src/unraid-api/graph/resolvers/notifications/notifications.resolver.ts	- Updated import statements for types to use type keyword for type-checking purposes without altering resolver logic

Possibly related PRs

• feat(web): notification settings link & delete all button #962: The main PR introduces a new mutation for deleting all notifications, which is directly related to the changes in the deleteAllNotifications mutation in the retrieved PR. Both PRs enhance the notification management system by allowing bulk deletion of notifications.
• fix(web): notifications consistency on unraid servers #961: This PR also deals with notifications and includes modifications to the NotificationsService class, which may relate to the overall notification handling improvements in the main PR.
• refactor(api): delete only archived notifications in deleteAll #983: This PR refactors the deletion functionality to specifically target archived notifications, which aligns with the main PR's focus on enhancing notification management capabilities.

Suggested reviewers

• zackspear
• pujitm

Poem

🐰 Vite's config, a rabbit's delight,
Optimizing deps with all my might!
CommonJS dancing, modules so free,
Development mode, just watch and see!
A config leap of pure coding glee! 🚀

Tip

CodeRabbit's docstrings feature is now available as part of our Early Access Program! Simply use the command @coderabbitai generate docstrings to have CodeRabbit automatically generate docstrings for your pull request. We would love to hear your feedback on Discord. This feature will be included in our new Pro Plan when released, so please consider upgrading your current plan.

---

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

• Review comments: Directly reply to a review comment made by CodeRabbit. Example:
  • I pushed a fix in commit <commit_id>, please review it.
  • Generate unit testing code for this file.
  • Open a follow-up GitHub issue for this discussion.
• Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
  • @coderabbitai generate unit testing code for this file.
  • @coderabbitai modularize this function.
• PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
  • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
  • @coderabbitai read src/utils.ts and generate unit testing code.
  • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
  • @coderabbitai help me debug CodeRabbit configuration file.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

• @coderabbitai pause to pause the reviews on a PR.
• @coderabbitai resume to resume the paused reviews.
• @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
• @coderabbitai full review to do a full review from scratch and review all the files again.
• @coderabbitai summary to regenerate the summary of the PR.
• @coderabbitai generate docstrings to generate docstrings for this PR. (Beta)
• @coderabbitai resolve resolve all the CodeRabbit review comments.
• @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
• @coderabbitai help to get help.

Other keywords and placeholders

• Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
• Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
• Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

• You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
• Please see the configuration documentation for more information.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

• Visit our Documentation for detailed information on how to use CodeRabbit.
• Join our Discord Community to get help, request features, and share feedback.
• Follow us on X/Twitter for updates and announcements.

[coderabbitai]

Actionable comments posted: 0

🧹 Nitpick comments (1)

api/src/unraid-api/main.ts (1)

Line range hint 21-53: Consider documenting the authentication flow.

The bootstrap configuration correctly supports the authentication setup. Consider adding documentation about the authentication flow, particularly around the validateCookiesCasbin usage, to help future maintainers understand the system's security model.

📜 Review details

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro (Legacy)

📥 Commits

Reviewing files that changed from the base of the PR and between a99ee03 and 4dedcb0.

📒 Files selected for processing (2)

• api/src/unraid-api/main.ts (1 hunks)
• api/vite.config.ts (2 hunks)

🔇 Additional comments (5)

api/vite.config.ts (4)

66-67: LGTM! Appropriate module interop settings.

The ES format with auto interop will ensure proper compatibility between CommonJS and ES modules, which is essential for NestJS and Passport integration.

---

70-70: LGTM! Correct external dependency configuration.

The external configuration properly excludes NestJS modules and class transformation libraries from bundling, which is the recommended approach for Node.js applications.

---

78-80: LGTM! Strict CommonJS settings will improve reliability.

The strict CommonJS settings and proper exclusions will help catch module loading issues early, particularly important for the authentication flow.

---

46-54: LGTM! Dependencies align with authorization requirements.

The added dependencies correctly include the necessary modules for NestJS authentication with Passport.

Let's verify if all required peer dependencies are included:

✅ Verification successful

Dependencies are correctly configured and complete

The package.json confirms all required dependencies are properly included:

• @nestjs/core: ^10.4.7
• @nestjs/platform-fastify: ^10.4.7 (platform integration)
• @nestjs/passport: ^10.0.3
• passport-custom: ^1.1.1
• reflect-metadata: ^0.1.14

The optimizeDeps configuration in vite.config.ts aligns with the installed dependencies, and all necessary peer dependencies are present. The slight difference in platform package (@nestjs/platform-express in vite vs fastify in package.json) is acceptable as both are valid NestJS HTTP platforms.

🏁 Scripts executed

The following scripts were executed for the analysis:

Script:

#!/bin/bash
# Check for any missing peer dependencies in package.json
jq -r '.dependencies | keys[]' package.json | grep -E '@nestjs/|passport|reflect-metadata'

Length of output: 163

---

Script:

#!/bin/bash
# Let's first find the package.json file in the api directory
fd -t f "package.json" api/

# Then check its contents for dependencies
fd -t f "package.json" api/ -x cat {}

Length of output: 6598

api/src/unraid-api/main.ts (1)

5-5: LGTM! Required reflect-metadata import for decorator support.

The reflect-metadata import is correctly placed at the top of the file, which is essential for NestJS decorators including those used in authentication.

Let's verify if the import is necessary for the validateCookiesCasbin decorator:

✅ Verification successful

LGTM! The reflect-metadata import is essential for NestJS decorators.

The codebase extensively uses NestJS decorators such as @Module, @Injectable, @Resolver, @Query, @UsePermissions, etc., which require reflect-metadata to function properly. The import is correctly placed at the top of the entry file, following NestJS best practices.

🏁 Scripts executed

The following scripts were executed for the analysis:

Script:

#!/bin/bash
# Search for validateCookiesCasbin decorator usage
ast-grep --pattern 'validateCookiesCasbin($$$)'

# Check for other decorator usage that requires reflect-metadata
rg '@\w+\(' --type ts

Length of output: 16142

[github-actions]

This plugin has been deployed to Cloudflare R2 and is available for testing.
Download it at this URL: https://preview.dl.unraid.net/unraid-api/pr/987/dynamix.unraid.net.staging.plg

[github-actions]

This plugin has been deployed to Cloudflare R2 and is available for testing.
Download it at this URL: https://preview.dl.unraid.net/unraid-api/pr/987/dynamix.unraid.net.staging.plg

[github-actions]

This plugin has been deployed to Cloudflare R2 and is available for testing.
Download it at this URL: https://preview.dl.unraid.net/unraid-api/pr/987/dynamix.unraid.net.staging.plg

[github-actions]

This plugin has been deployed to Cloudflare R2 and is available for testing.
Download it at this URL: https://preview.dl.unraid.net/unraid-api/pr/987/dynamix.unraid.net.staging.plg

[github-actions]

This plugin has been deployed to Cloudflare R2 and is available for testing.
Download it at this URL: https://preview.dl.unraid.net/unraid-api/pr/987/dynamix.unraid.net.staging.plg

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (3)

api/vite.config.ts (3)

31-43: Extract duplicate SWC configuration.

The SWC configuration is duplicated between VitePluginNode and swc.vite. Consider extracting it into a shared constant.

+const swcConfig = {
+    jsc: {
+        parser: {
+            syntax: 'typescript',
+            decorators: true,
+        },
+        target: 'es2024',
+        transform: {
+            legacyDecorator: true,
+            decoratorMetadata: true,
+        },
+    },
+};

 VitePluginNode({
     adapter: 'nest',
     appPath: 'src/index.ts',
     tsCompiler: 'swc',
-    swcOptions: {
-        jsc: {
-            parser: {
-                syntax: 'typescript',
-                decorators: true,
-            },
-            target: 'es2024',
-            transform: {
-                legacyDecorator: true,
-                decoratorMetadata: true,
-            },
-        },
-    },
+    swcOptions: swcConfig,
 })

-swc.vite({
-    jsc: {
-        parser: {
-            syntax: 'typescript',
-            decorators: true,
-        },
-        target: 'es2024',
-        transform: {
-            legacyDecorator: true,
-            decoratorMetadata: true,
-        },
-    },
-}),
+swc.vite(swcConfig),

Also applies to: 47-59

---

98-116: Remove duplicate external module entries.

The external modules list contains a duplicate entry:

• passport-http-header-strategy appears twice (lines 109 and 114)

Also, consider using regex patterns to group related modules for better maintainability.

 external: [
     'class-validator',
     'class-transformer',
     /^@nestjs\/.*/,
     'reflect-metadata',
     'rxjs',
     'fastify',
     '@fastify/cors',
     '@fastify/cookie',
-    'passport',
-    'passport-custom',
-    'passport-http-header-strategy',
+    /^passport(-.*)?$/,
     'casbin',
     'nest-authz',
     'nest-access-control',
-    '@nestjs/passport',
-    'passport-http-header-strategy',
     'accesscontrol',
 ],

---

Line range hint 1-159: Overall configuration changes effectively support authorization fix.

The Vite configuration changes comprehensively address the authorization type error by:

1. Including necessary passport modules in optimization
2. Properly handling module interoperability
3. Configuring appropriate build settings for NestJS and authorization modules

While the changes look good, consider the suggested improvements for better maintainability.

📜 Review details

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro (Legacy)

📥 Commits

Reviewing files that changed from the base of the PR and between 6d74fbc and 4177c2e.

⛔ Files ignored due to path filters (1)

• api/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (3)

• api/package.json (1 hunks)
• api/src/unraid-api/graph/resolvers/notifications/notifications.resolver.ts (1 hunks)
• api/vite.config.ts (4 hunks)

✅ Files skipped from review due to trivial changes (1)

• api/src/unraid-api/graph/resolvers/notifications/notifications.resolver.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• api/package.json

🔇 Additional comments (2)

api/vite.config.ts (2)

74-82: LGTM! Dependencies align with authorization requirements.

The addition of passport and passport-custom to optimizeDeps.include aligns with the PR objective to fix the authorization type error.

---

123-133: LGTM! Verify build output with strict CommonJS settings.

The CommonJS configuration looks good with:

• Strict requires enabled
• Appropriate module exclusions
• Preferred default exports handling

These changes should help with the authorization module integration.

✅ Verification successful

The previous command failed because the dist directory wasn't available in the sandbox. Let's analyze the codebase directly to understand the CommonJS usage and configuration patterns. This will help us verify if the strict CommonJS settings are appropriate.

---

CommonJS configuration is appropriate for the codebase's mixed module usage

The strict CommonJS settings are verified to be appropriate based on the codebase analysis:

• The project uses a mix of ESM and CommonJS modules, particularly in:
  • Build configurations (CommonJS in tailwind.config.ts, tailwind-shadcn.config.ts)
  • Scripts (fix-array-type.cjs, add-timestamp-webcomponent-manifest.js)
• The exclude/include patterns match the actual CommonJS dependencies found in the codebase
• The viteCommonjs plugin is already configured to handle mixed module scenarios

🏁 Scripts executed

The following scripts were executed for the analysis:

Script:

#!/bin/bash
# Check for any CommonJS-related issues in build output
rg -i "commonjs|cjs|require" dist/

Length of output: 82

---

Script:

#!/bin/bash
# Check for any CommonJS-related dependencies and imports in the codebase
rg -i "require\(|module\.exports|exports\." -A 2

# Check for any CommonJS configuration in build-related files
fd -e config.js -e config.ts -e config.mjs | xargs cat

# Check package.json for module type and dependencies
cat package.json

Length of output: 22245

[github-actions]

This plugin has been deployed to Cloudflare R2 and is available for testing.
Download it at this URL: https://preview.dl.unraid.net/unraid-api/pr/987/dynamix.unraid.net.staging.plg