[WIP] Feat: add report api (#346) #347
Conversation
Walkthrough보고서 제출 기능을 위한 새로운 API 클라이언트 모듈과 관련 타입 및 훅을 추가했습니다. 🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Fix all issues with AI agents
In `@src/apis/report.ts`:
- Around line 4-33: Add explicit guards that throw a clear error when
API_BASE_URL or API_TOKEN are missing instead of letting undefined propagate;
for example, validate process.env values at module initialization or inside
authHeaderValue() and before building the request in withAuth()/createReport(),
and throw a descriptive Error (e.g., "Missing NEXT_PUBLIC_BASE_API_URL" or
"Missing NEXT_PUBLIC_API_TOKEN") so calls to createReport() fail fast; update
authHeaderValue, withAuth or createReport to check API_BASE_URL/API_TOKEN and
stop execution with a thrown error before calling safeFetch.
- Around line 4-12: The API token (API_TOKEN / NEXT_PUBLIC_API_TOKEN) is exposed
to the client; confirm its sensitivity and if it is sensitive or has high
privileges, remove client-side usage by removing NEXT_PUBLIC_ prefix and moving
token usage to server-side proxies or API routes. Specifically, stop using
API_TOKEN in client modules (e.g., src/apis/report.ts functions authHeaderValue
and withAuth and client components like usePostReport), implement a server-side
endpoint (app/api/... or pages/api/...) that injects the Authorization header
using the non-public env var and have client code call that endpoint instead; if
the token is intended to be public/low-privilege, document that decision and
leave authHeaderValue/withAuth as-is.
| const API_BASE_URL = process.env.NEXT_PUBLIC_BASE_API_URL; | ||
| const API_TOKEN = process.env.NEXT_PUBLIC_API_TOKEN; | ||
|
|
||
| const authHeaderValue = () => `Bearer ${API_TOKEN}`; | ||
|
|
||
| const withAuth = (init?: SafeFetchOptions): SafeFetchOptions => { | ||
| const headers: HeadersInit = { | ||
| Authorization: authHeaderValue(), | ||
| ...(init?.headers ?? {}), |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# First, let's explore the file structure to understand the project
git ls-files | head -20Repository: Team-SoFa/linkiving
Length of output: 507
🏁 Script executed:
# Search for all references to NEXT_PUBLIC_API_TOKEN
rg "NEXT_PUBLIC_API_TOKEN" --type ts --type tsx --type js --type jsx -B2 -A2Repository: Team-SoFa/linkiving
Length of output: 90
🏁 Script executed:
# Check if there are server-side API routes or proxies
find . -type f -path "*/pages/api/*" -o -path "*/app/api/*" | head -20Repository: Team-SoFa/linkiving
Length of output: 125
🏁 Script executed:
# Look for environment configuration files
find . -type f \( -name ".env*" -o -name "*.md" \) | grep -E "\.(env|md)$" | head -10Repository: Team-SoFa/linkiving
Length of output: 713
🏁 Script executed:
# Check the report.ts file more completely
cat src/apis/report.ts 2>/dev/null || echo "File not found, searching for it"Repository: Team-SoFa/linkiving
Length of output: 965
🏁 Script executed:
# Search for all references to NEXT_PUBLIC_API_TOKEN across all file types
rg "NEXT_PUBLIC_API_TOKEN" -B2 -A2Repository: Team-SoFa/linkiving
Length of output: 3425
🏁 Script executed:
# Check the .env.example file for context on this token
cat .env.exampleRepository: Team-SoFa/linkiving
Length of output: 225
🏁 Script executed:
# Look for where report.ts is imported from (to see if it's client or server code)
rg "from.*apis/report" -B1 -A1Repository: Team-SoFa/linkiving
Length of output: 239
🏁 Script executed:
# Check safeFetch implementation to understand if it's server-side only
cat src/hooks/util/server/safeFetch.ts 2>/dev/null || rg "safeFetch" -l --max-count 5Repository: Team-SoFa/linkiving
Length of output: 3758
🏁 Script executed:
# Look for other API route files and patterns
find ./src/app -type f -name "route.ts" -o -name "route.js" 2>/dev/nullRepository: Team-SoFa/linkiving
Length of output: 98
🏁 Script executed:
# Check if there are server-side implementations for these API calls
rg "app/api|pages/api" -l | grep -E "(report|chat|link)" || echo "No server API routes found for these"Repository: Team-SoFa/linkiving
Length of output: 99
🏁 Script executed:
# Search for any configuration or documentation about token security
rg "token|TOKEN" README.md -B2 -A2 | head -30Repository: Team-SoFa/linkiving
Length of output: 1393
🏁 Script executed:
# Check if usePostReport is actually client-side component
cat src/hooks/usePostReport.tsRepository: Team-SoFa/linkiving
Length of output: 1458
🏁 Script executed:
# Look for "use client" or server component indicators in api files
head -5 src/apis/report.ts src/apis/chatApi.ts src/apis/linkApi.tsRepository: Team-SoFa/linkiving
Length of output: 742
NEXT_PUBLIC_API_TOKEN은 클라이언트 번들에 노출되고 있습니다. 토큰이 공개용(읽기 전용)인지 확인이 필요합니다.
현재 코드에서 NEXT_PUBLIC_API_TOKEN은 src/apis/report.ts, src/apis/chatApi.ts, src/apis/linkApi.ts, src/apis/chatSocket.ts 등의 클라이언트 측 API 파일에서 직접 사용되고 있으며, usePostReport와 같은 클라이언트 컴포넌트('use client')에서 호출됩니다. NEXT_PUBLIC_ 접두사가 붙으므로 프로덕션 번들에 평문으로 포함됩니다.
현재 구조에는 서버 프록시나 API 라우트(app/api/ 또는 pages/api/)를 통한 보호 메커니즘이 없습니다.
- 이 토큰이 공개 읽기 전용이거나 낮은 권한이라면 현재 구현이 의도된 것일 수 있습니다.
- 이 토큰이 민감하거나 높은 권한을 가진다면 서버 프록시 또는 서버 액션으로 이동하는 것이 안전합니다.
토큰의 의도된 용도와 권한 수준을 명확히 하고, 필요시 서버 측 보호를 추가하시기 바랍니다.
🤖 Prompt for AI Agents
In `@src/apis/report.ts` around lines 4 - 12, The API token (API_TOKEN /
NEXT_PUBLIC_API_TOKEN) is exposed to the client; confirm its sensitivity and if
it is sensitive or has high privileges, remove client-side usage by removing
NEXT_PUBLIC_ prefix and moving token usage to server-side proxies or API routes.
Specifically, stop using API_TOKEN in client modules (e.g., src/apis/report.ts
functions authHeaderValue and withAuth and client components like
usePostReport), implement a server-side endpoint (app/api/... or pages/api/...)
that injects the Authorization header using the non-public env var and have
client code call that endpoint instead; if the token is intended to be
public/low-privilege, document that decision and leave authHeaderValue/withAuth
as-is.
There was a problem hiding this comment.
토큰 사용에 대해 추후 논의 후 수정 필요
There was a problem hiding this comment.
@Bangdayeon, 알겠습니다! 토큰 사용에 대한 보안 검토를 나중에 진행하시는 것으로 이해했습니다.
이 이슈를 추적하기 위해 GitHub 이슈를 생성해드릴까요? 이슈에는 현재 PR과 이 코멘트의 링크를 포함하여 나중에 쉽게 참고하실 수 있도록 하겠습니다.
Bangdayeon
changed the title
관련 이슈
PR 설명