Enhance hover effects for Features section#317
Conversation
✅ Deploy Preview for github-spy ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. 📝 WalkthroughWalkthroughBackend: adds helmet, express-rate-limit, env-driven CORS/credentials, session defaults, and starts server after DB connect; updates sample env with CLIENT_URL. Frontend: strengthens feature-card hover styling and adds localhost fallback for backend URL in Login/Signup. ChangesBackend security and configuration
Frontend UI tweaks and backend URL fallbacks
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 1 | ❌ 4❌ Failed checks (3 warnings, 1 inconclusive)
✅ Passed checks (1 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
🎉 Thank you @DineshSivalanka for your contribution. Please make sure your PR follows https://github.com/GitMetricsLab/github_tracker/blob/main/CONTRIBUTING.md#-pull-request-guidelines
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@backend/server.js`:
- Around line 67-72: The current code silently defaults MONGO_URI to localhost;
change the startup logic so you only allow the localhost fallback when
process.env.NODE_ENV === 'development' and otherwise fail fast: first check
process.env.MONGO_URI and if missing and NODE_ENV !== 'development' log an error
via console.error (or processLogger) and exit (process.exit(1)); if NODE_ENV ===
'development' continue but emit a clear warning. Move the MONGO_URI assignment
(the constant MONGO_URI and any warning) to occur after this validation so the
app never silently connects to localhost in non-dev environments.
- Around line 44-49: The code currently falls back to a hard-coded sessionSecret
which is unsafe; replace the permissive fallback with a strict guard: require
process.env.SESSION_SECRET to be set unless NODE_ENV === 'development' (or a
similar explicit dev flag), log a clear error via console.error when missing and
call process.exit(1) to abort startup, and only then set sessionSecret from
process.env.SESSION_SECRET and pass it into app.use(session({ secret:
sessionSecret, ... })); reference the existing symbols sessionSecret,
process.env.SESSION_SECRET, NODE_ENV, and app.use(session(...)) when making the
change.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: da81b258-2e50-4d49-b2e1-8f5d9ac2b70e
📒 Files selected for processing (5)
backend/.env.samplebackend/package.jsonbackend/server.jssrc/pages/Login/Login.tsxsrc/pages/Signup/Signup.tsx
✅ Files skipped from review due to trivial changes (2)
- src/pages/Signup/Signup.tsx
- src/pages/Login/Login.tsx
| const sessionSecret = process.env.SESSION_SECRET || 'dev-secret'; | ||
| if (!process.env.SESSION_SECRET) { | ||
| console.warn('Warning: SESSION_SECRET is not set. Using a fallback development secret. Set SESSION_SECRET in backend/.env for production.'); | ||
| } | ||
| app.use(session({ | ||
| secret: process.env.SESSION_SECRET, | ||
| secret: sessionSecret, |
There was a problem hiding this comment.
Fail fast when SESSION_SECRET is missing outside local development.
The hard-coded fallback makes session signing predictable whenever deployment config is wrong, which quietly weakens auth/session integrity in production. Keep the fallback strictly dev-only and abort startup otherwise.
🔐 Suggested guard
-const sessionSecret = process.env.SESSION_SECRET || 'dev-secret';
-if (!process.env.SESSION_SECRET) {
- console.warn('Warning: SESSION_SECRET is not set. Using a fallback development secret. Set SESSION_SECRET in backend/.env for production.');
-}
+const isProduction = process.env.NODE_ENV === 'production';
+if (!process.env.SESSION_SECRET && isProduction) {
+ throw new Error('SESSION_SECRET must be set in production');
+}
+
+const sessionSecret = process.env.SESSION_SECRET || 'dev-secret';
+if (!process.env.SESSION_SECRET) {
+ console.warn('Warning: SESSION_SECRET is not set. Using a fallback development secret.');
+}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| const sessionSecret = process.env.SESSION_SECRET || 'dev-secret'; | |
| if (!process.env.SESSION_SECRET) { | |
| console.warn('Warning: SESSION_SECRET is not set. Using a fallback development secret. Set SESSION_SECRET in backend/.env for production.'); | |
| } | |
| app.use(session({ | |
| secret: process.env.SESSION_SECRET, | |
| secret: sessionSecret, | |
| const isProduction = process.env.NODE_ENV === 'production'; | |
| if (!process.env.SESSION_SECRET && isProduction) { | |
| throw new Error('SESSION_SECRET must be set in production'); | |
| } | |
| const sessionSecret = process.env.SESSION_SECRET || 'dev-secret'; | |
| if (!process.env.SESSION_SECRET) { | |
| console.warn('Warning: SESSION_SECRET is not set. Using a fallback development secret.'); | |
| } | |
| app.use(session({ | |
| secret: sessionSecret, |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@backend/server.js` around lines 44 - 49, The code currently falls back to a
hard-coded sessionSecret which is unsafe; replace the permissive fallback with a
strict guard: require process.env.SESSION_SECRET to be set unless NODE_ENV ===
'development' (or a similar explicit dev flag), log a clear error via
console.error when missing and call process.exit(1) to abort startup, and only
then set sessionSecret from process.env.SESSION_SECRET and pass it into
app.use(session({ secret: sessionSecret, ... })); reference the existing symbols
sessionSecret, process.env.SESSION_SECRET, NODE_ENV, and app.use(session(...))
when making the change.
| const PORT = process.env.PORT || 5000; | ||
| const MONGO_URI = process.env.MONGO_URI || 'mongodb://localhost:27017/githubTracker'; | ||
|
|
||
| if (!process.env.MONGO_URI) { | ||
| console.warn('Warning: process.env.MONGO_URI is not set. Using local default:', MONGO_URI); | ||
| } |
There was a problem hiding this comment.
Avoid silently defaulting MONGO_URI to localhost in non-dev environments.
If the env var is missing, this can start the app against the wrong database or hide a broken deployment until data looks inconsistent. Limit the localhost fallback to development and fail startup elsewhere.
🗄️ Suggested guard
const PORT = process.env.PORT || 5000;
-const MONGO_URI = process.env.MONGO_URI || 'mongodb://localhost:27017/githubTracker';
+const isProduction = process.env.NODE_ENV === 'production';
+if (!process.env.MONGO_URI && isProduction) {
+ throw new Error('MONGO_URI must be set in production');
+}
+const MONGO_URI = process.env.MONGO_URI || 'mongodb://localhost:27017/githubTracker';📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| const PORT = process.env.PORT || 5000; | |
| const MONGO_URI = process.env.MONGO_URI || 'mongodb://localhost:27017/githubTracker'; | |
| if (!process.env.MONGO_URI) { | |
| console.warn('Warning: process.env.MONGO_URI is not set. Using local default:', MONGO_URI); | |
| } | |
| const PORT = process.env.PORT || 5000; | |
| const isProduction = process.env.NODE_ENV === 'production'; | |
| if (!process.env.MONGO_URI && isProduction) { | |
| throw new Error('MONGO_URI must be set in production'); | |
| } | |
| const MONGO_URI = process.env.MONGO_URI || 'mongodb://localhost:27017/githubTracker'; | |
| if (!process.env.MONGO_URI) { | |
| console.warn('Warning: process.env.MONGO_URI is not set. Using local default:', MONGO_URI); | |
| } |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@backend/server.js` around lines 67 - 72, The current code silently defaults
MONGO_URI to localhost; change the startup logic so you only allow the localhost
fallback when process.env.NODE_ENV === 'development' and otherwise fail fast:
first check process.env.MONGO_URI and if missing and NODE_ENV !== 'development'
log an error via console.error (or processLogger) and exit (process.exit(1)); if
NODE_ENV === 'development' continue but emit a clear warning. Move the MONGO_URI
assignment (the constant MONGO_URI and any warning) to occur after this
validation so the app never silently connects to localhost in non-dev
environments.
1 participant
Related Issue
Closes #288
Description
Enhanced hover effects for feature cards in both dark and light mode.
Improvements
Type of Change
How Has This Been Tested?
Summary by CodeRabbit
Release Notes
New Features
Bug Fixes
Style