Security fixes and improvements

[codeunia-dev]

Summary by CodeRabbit

• New Features
  • Added Admin Settings dashboard with cards for Security, Database, Users, Notifications, and General.
  • Added Admin Test Management page integrating the Test Manager.
• Security
  • Updated Content Security Policy to support Cloudflare Insights and development domains; allows inline/eval scripts where required.
• Refactor
  • Optimized leaderboard API to reuse a single database client for improved efficiency.
• Chores
  • Updated CI/CD workflows to use job-level outputs for Lighthouse tests.

[coderabbitai]

Caution

Review failed

The pull request is closed.

Walkthrough

Updates CI to source deployment URLs via needs.* job outputs. Adds two new admin pages (settings and test). Refactors two leaderboard API routes to use a module-scoped Supabase admin client instead of per-request initialization. Adjusts CSP policies to allow additional script/style sources and Cloudflare Insights.

Changes

Cohort / File(s)	Summary of changes
CI: Lighthouse URL sourcing .github/workflows/ci-cd.yml	Switched Lighthouse steps from steps.deploy-<env>.outputs.deployment-url to needs.deploy-<env>.outputs.deployment-url in config generation and echo logs; control flow unchanged.
Admin UI pages app/admin/settings/page.tsx, app/admin/test/page.tsx	Added stateless Next.js pages: a System Settings dashboard with cards; a Test Management wrapper rendering TestManager.
Leaderboard API: Supabase client singleton app/api/leaderboard/stats/route-unified.ts, app/api/leaderboard/user/[userId]/route-unified.ts	Replaced per-request client creation with a module-scoped supabaseAdmin initialized from env vars; handlers now reuse this instance; route logic otherwise unchanged.
Security: CSP adjustments lib/security/csp-config.ts	Expanded script-src/style-src: allow 'unsafe-inline'/'unsafe-eval' where specified; added Cloudflare Insights and Vercel live/script domains; updated comments.

Sequence Diagram(s)

sequenceDiagram
  autonumber
  actor U as User
  participant R as Next.js Route (GET /leaderboard/...)
  participant S as supabaseAdmin (module-scoped)
  participant DB as Database

  Note over R,S: Module load
  R->>S: import supabaseAdmin (initialized from env)
  Note over S: Singleton client

  U->>R: HTTP GET request
  R->>S: Query user_points / profiles
  S->>DB: SQL (select, aggregate)
  DB-->>S: Rows / aggregates
  S-->>R: Data
  R-->>U: JSON response (stats/user data)

Loading

sequenceDiagram
  autonumber
  participant GH as GitHub Actions
  participant D as deploy-<env> Job
  participant L as Lighthouse Job

  GH->>D: Run deployment
  D-->>GH: Output deployment-url
  GH->>L: Start LHCI with needs.deploy-<env>.outputs.deployment-url
  L->>L: Generate lighthouserc-*.js using needs.* output
  L-->>GH: CI results

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• 🔒 Critical Security Fixes & Code Quality Improvements #225 — Also modifies Lighthouse CI workflow structure/config; closely related to changing how deployment URLs are referenced.

Poem

A bunny taps the pipeline keys,
Needs.* whispers pass with ease.
New pages bloom in admin light,
A singleton sails queries right.
CSP widens, skies grow clear—
Hippity-hop, ship it near! ✨🐇

---

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 8c7d5b6 and f39312b.

📒 Files selected for processing (6)

• .github/workflows/ci-cd.yml (4 hunks)
• app/admin/settings/page.tsx (1 hunks)
• app/admin/test/page.tsx (1 hunks)
• app/api/leaderboard/stats/route-unified.ts (1 hunks)
• app/api/leaderboard/user/[userId]/route-unified.ts (1 hunks)
• lib/security/csp-config.ts (2 hunks)

✨ Finishing Touches

• 📝 Generate Docstrings

🧪 Generate unit tests

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch security-fixes-and-improvements

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
codeunia	Building	Preview	Comment	Sep 8, 2025 8:49am