refactor(api): migrate functions.invoke to Cloudflare API by riderx · Pull Request #2785 · Cap-go/capgo.app

riderx · 2026-07-28T23:43:46Z

Summary (AI generated)

Route Capgo console supabase.functions.invoke calls through invokeCapgoApi → VITE_API_HOST (api.capgo.app) instead of sb.capgo.app
Route Capgo CLI former invoke call sites through invokeCapgoCliApi → hostApi / hostFilesApi (self-host still uses /functions/v1)
Shrink Capgo cloud Supabase publish allowlist: keep triggers forever; keep bundle, channel, files, private until 2026-10-28 for older CLIs; stop publishing console-only apikey, app, organization, statistics, webhooks

Motivation (AI generated)

Publishing unused Capgo cloud edge functions is an infra abuse risk. Console and new CLI can talk to Cloudflare directly; old CLIs still hit Supabase invoke for a few endpoints, so those stay published for ~3 months.

Business Impact (AI generated)

Fewer Capgo cloud Supabase functions to operate and attack, without breaking existing customer CLIs during the upgrade window. Self-host full deploy is unchanged.

Test Plan (AI generated)

Console: open API keys, webhooks, Stripe portal/checkout, org invites, password compliance — confirm requests go to api.capgo.app, not sb.capgo.app/functions/v1
CLI latest: bundle upload, channel set/delete, upload link / delete failed version / set manifest against Capgo cloud
CLI with --supa-host / self-host: same flows still hit /functions/v1
Capgo cloud deploy only publishes allowlisted functions (bun scripts/supabase-cloud-functions.ts list)
Unit: bunx vitest run tests/supabase-cloud-functions.unit.test.ts
After 2026-10-28: remove bundle/channel/files/private from the allowlist and delete Capgo cloud Supabase deployments

Generated with AI

Made with Cursor

Summary by CodeRabbit

New Features
- Added unified API routing for cloud, self-hosted, and local deployments.
- Standardized dashboard, onboarding, billing, webhooks, access control, and account operations.
- Improved support for configurable hosts and authentication.
Deployment
- Cloud deployments now publish approved functions and remove obsolete ones.
- Added safeguards when no deployable functions are available.
Documentation
- Clarified cloud and self-hosted deployment behavior, routing, and migration timelines.
Tests
- Added coverage for deployment allowlists and API integration updates.

Capgo cloud traffic already runs on Cloudflare Workers; only `triggers` must stay on Supabase for pg_net queue_consumer. Keep full deploy for self-hosting. Co-authored-by: Cursor <cursoragent@cursor.com>

Address review feedback: show allowlisted Capgo Cloud deploy commands and cover empty/multi-target allowlist deploy arg cases. Co-authored-by: Cursor <cursoragent@cursor.com>

supabase.functions.invoke always uses SUPABASE_URL, so console/CLI still need private, apikey, app, bundle, channel, files, organization, statistics, and webhooks published alongside triggers. Co-authored-by: Cursor <cursoragent@cursor.com>

Stop Capgo cloud console traffic on sb.capgo.app edge functions by calling api.capgo.app instead. Migrate CLI the same way while keeping bundle/channel/files/private published until 2026-10-28 for older CLIs. Co-authored-by: Cursor <cursoragent@cursor.com>

coderabbitai · 2026-07-28T23:43:56Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: c1d7adeb-e7c9-4bf3-874a-90fc69b49e8f

📥 Commits

Reviewing files that changed from the base of the PR and between 765679a and 5654159.

📒 Files selected for processing (1)

tests/supabase-cloud-functions.unit.test.ts

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

Cap-go/capacitor-updater (manual)

📝 Walkthrough

Walkthrough

The PR adds allowlisted Supabase deployment with cleanup, shared cloud and self-hosted API routing for the CLI and frontend, migrated Edge Function calls, Cloudflare routes, and updated tests.

Changes

Capgo API and deployment routing

Layer / File(s)	Summary
Allowlisted Supabase function publishing and deployment `scripts/supabase-cloud-functions.ts`, `.github/workflows/build_and_deploy.yml`, `package.json`, `README.md`, `tests/supabase-cloud-functions.unit.test.ts`	Cloud deployment selects allowlisted functions, rejects empty selections, deletes skipped functions, and documents cloud and self-hosted procedures.
CLI API routing and authentication infrastructure `cli/src/utils.ts`	CLI routing resolves endpoints, caches remote configuration, applies authentication, serializes requests, and normalizes responses.
CLI upload, channel, and rollout operations `cli/src/bundle/upload.ts`, `cli/src/channel/delete.ts`, `cli/src/channel/set.ts`	CLI operations use the API helper with API keys and optional Supabase connection settings.
Frontend Capgo API service and error handling `src/services/capgoApi.ts`, `tests/capgo-api-error-code.unit.test.ts`	The frontend API helper supports host-based routing, authentication, request serialization, response parsing, and structured error-code extraction.
Frontend services and components API migration `src/services/`, `src/components/`, `src/pages/`, `src/stores/`, `src/utils/`, `cloudflare_workers/api/index.ts`, `tests/`	Frontend requests use `invokeCapgoApi` or service wrappers instead of direct Supabase function calls. Cloudflare registers private routes, and tests mock the new API boundary.

Estimated code review effort: 4 (Complex) | ~75 minutes

Sequence Diagram(s)

sequenceDiagram
  participant FrontendOrCLI
  participant CapgoApiHelper
  participant CapgoCloudOrSupabase
  FrontendOrCLI->>CapgoApiHelper: Send path, method, body, and credentials
  CapgoApiHelper->>CapgoCloudOrSupabase: Route request to cloud or self-hosted endpoint
  CapgoCloudOrSupabase-->>CapgoApiHelper: Return response or error
  CapgoApiHelper-->>FrontendOrCLI: Return standardized data and error

Possibly related PRs

Cap-go/capgo.app#2781: Extends the Supabase function allowlist with deprecation and cleanup behavior.
Cap-go/capgo.app#2737: Shares CLI API routing and Supabase credential propagation changes.
Cap-go/capgo.app#2698: Also changes API-key creation in src/services/apikeys.ts.

Suggested labels: codex

Suggested reviewers: dalanir

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 26.79% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the primary migration from Supabase function invocations to Cloudflare APIs.
Description check	✅ Passed	The description includes a clear summary, motivation, business impact, and test plan, but omits the template's screenshots and checklist sections.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

Create stacked PR
Commit on current branch

_{Comment @coderabbitai help to get the list of available commands.}

codspeed-hq · 2026-07-28T23:46:07Z

Merging this PR will not alter performance

✅ 43 untouched benchmarks
⏩ 2 skipped benchmarks¹

_{Comparing chore/migrate-invoke-to-cloudflare (5654159) with main (2ef8bd6)}

2 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

Default invoke helpers to any like supabase.functions.invoke and tighten the few call sites that still need explicit shapes for typecheck. Co-authored-by: Cursor <cursoragent@cursor.com>

log-as and apikeys unit tests still stubbed supabase.functions.invoke after the Cloudflare helper migration; point them at invokeCapgoApi instead. Co-authored-by: Cursor <cursoragent@cursor.com>

riderx · 2026-07-29T00:03:15Z

@coderabbitai review

cursor · 2026-07-29T00:03:16Z

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_5b4e8f49-4017-49fb-8cfc-975b08519925)

coderabbitai · 2026-07-29T00:03:22Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

cubic-dev-ai

All reported issues were addressed across 39 files

_{Reply with feedback, questions, or to request a fix.

Re-trigger cubic}

Keep unread error bodies for FunctionsHttpError, support anonymous invite bootstrap, fall back to /functions/v1 for self-host consoles, fix CLI auth and Capgo-managed --supa-host routing, and make Capgo cloud deploy fail closed plus delete non-allowlisted functions. Co-authored-by: Cursor <cursoragent@cursor.com>

cursor

Stale comment

Risk: high. Left a non-blocking comment — Cursor Bugbot completed as skipped, so it is not a clean approval signal, and this PR changes console/CLI API routing plus Capgo cloud function publish allowlists (auth, billing, and deploy surface). Assigning reviewers for human review; no approval from this run.

_{Sent by Cursor Approval Agent: Pull Request Approver}

cursor

Stale comment

Risk: high. Left a non-blocking comment — Cursor Bugbot did not complete successfully (skipped due to usage limit), and this PR is above the low-risk approval threshold given broad console/CLI API routing and deploy-surface changes. Assigned reviewers for human review.

_{Sent by Cursor Approval Agent: Pull Request Approver External}

Co-authored-by: Cursor <cursoragent@cursor.com>

coderabbitai

Actionable comments posted: 10

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

src/pages/app/[app].channel.[channel].devices.vue (1)
119-176: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Route setChannelDeviceOverride through invokeCapgoApi.

Self-host/local consoles route API calls through Supabase /functions/v1, but this flow still posts channel_device directly to VITE_API_HOST, bypassing that fallback and potentially sending the override request to Capgo Cloud. Migrate this call to invokeCapgoApi and handle its returned error.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/pages/app/`[app].channel.[channel].devices.vue around lines 119 - 176,
Update setChannelDeviceOverride to call invokeCapgoApi for
private/channel_device instead of fetch against defaultApiHost, preserving the
existing app, channel, and device request fields. Handle the returned error in
customDeviceOverwritePart5 through the existing overwrite-error path, and remove
the direct session/JWT and HTTP response handling.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@cli/src/utils.ts`:
- Around line 792-862: Update invokeCapgoCliApi to reuse the result of
getRemoteConfig(true) across calls during the CLI process, while preserving
explicit supaHost/supaAnon behavior and avoiding stale configuration beyond that
process. Review the non-functions/v1 Authorization construction in
invokeCapgoCliApi against the Cloudflare API contract; use the required Bearer
format if the API validates Authorization, otherwise retain raw-key behavior
only when capgkey is intentionally the sole credential and ensure the
implementation reflects that contract.
- Around line 748-757: Validate the --supa-host value centrally before routing
or invoking the API, using isCapgoManagedSupabaseHost and the existing
host-normalization flow where appropriate. Reject malformed or unsupported hosts
with a clear CLI-facing error that states the required URL format, and ensure
this validation occurs inside invokeCapgoCliApi()’s error-handling path so raw
“Invalid URL” TypeErrors do not escape.

In `@package.json`:
- Around line 187-188: Make Supabase stale-function cleanup fail closed: in
package.json lines 187-188, remove unconditional success masking from
deploy:supabase:prod and deploy:supabase:preprod, ignoring deletion errors only
when the function is confirmed missing; in
.github/workflows/build_and_deploy.yml lines 97-109, ensure cleanup failures
propagate and fail the workflow rather than being masked; in README.md lines
467-470, document the full cleanup-aware deployment procedure or explicitly
state that the alternate command does not remove stale functions.

In `@README.md`:
- Around line 80-83: Correct the console/CLI routing description in the README
paragraph: limit SUPABASE_URL routing to self-hosted deployments and legacy CLI
compatibility through October 28, 2026. State that the migrated Capgo Cloud
console uses VITE_API_HOST and the new CLI uses Capgo API hosts, while
preserving the existing Supabase function and pg_net context.

In `@src/components/dashboard/AppOnboardingFlow.vue`:
- Around line 644-648: Update the organization-creation error handling in the
unified onboarding flow around the `if (error || !data?.id)` block to read the
duplicate-name code from the HTTP error body by parsing the `FunctionsHttpError`
response in `error.context` before checking for `23505`. Use the parsed body
code for the `org-with-this-name-exists` toast, while preserving the generic
`cannot-create-org` fallback.

In `@src/services/apikeys.ts`:
- Line 68: Update each invokeCapgoApi call in src/services/apikeys.ts:68-68 and
124-124, src/services/chartDataService.ts:39-39, src/utils/invites.ts:44-44, and
src/utils/onboardingAppCreateHelpers.ts:124-124 to pass the caller-supplied
Supabase client/context, preserving injected client, session, and configuration
behavior instead of resolving the global client.

In `@src/services/capgoApi.ts`:
- Line 4: Update the method type declaration to use the repository’s accepted
single-quote style for all HTTP method literals, without changing the allowed
values or optional property behavior.

In `@src/services/emailOtp.ts`:
- Around line 52-54: Update the invokeCapgoApi call in the email OTP
verification flow to pass allowAnonymous: true, preserving unauthenticated
access while keeping the existing token sanitization and
private/verify_email_otp endpoint unchanged.

In `@tests/apikeys-service.unit.test.ts`:
- Around line 32-40: Remove the concurrent modifier from the “creates a member
key with only the selected app bindings” test so it runs as a standard
sequential test, preserving the shared hoisted mocks and beforeEach resets.

In `@tests/supabase-cloud-functions.unit.test.ts`:
- Around line 39-41: Extend the existing buildCapgoCloudSupabaseDeployArgs test
coverage to assert that passing an empty array throws, preserving the
fail-closed guard while retaining the explicit-list expectation.

---

Outside diff comments:
In `@src/pages/app/`[app].channel.[channel].devices.vue:
- Around line 119-176: Update setChannelDeviceOverride to call invokeCapgoApi
for private/channel_device instead of fetch against defaultApiHost, preserving
the existing app, channel, and device request fields. Handle the returned error
in customDeviceOverwritePart5 through the existing overwrite-error path, and
remove the direct session/JWT and HTTP response handling.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 24a10173-2a16-4ac1-8f48-d066b11fe8a1

📥 Commits

Reviewing files that changed from the base of the PR and between 622efa9 and a3c0cae.

📒 Files selected for processing (39)

.github/workflows/build_and_deploy.yml
README.md
cli/src/bundle/upload.ts
cli/src/channel/delete.ts
cli/src/channel/set.ts
cli/src/utils.ts
package.json
scripts/supabase-cloud-functions.ts
src/components/dashboard/AppAccess.vue
src/components/dashboard/AppOnboardingFlow.vue
src/components/dashboard/AppSetting.vue
src/components/dashboard/InviteTeammateModal.vue
src/components/dashboard/StepsApp.vue
src/components/dashboard/Usage.vue
src/components/permissions/ChannelAccessPanel.vue
src/components/tables/AccessTable.vue
src/pages/ApiKeys.vue
src/pages/app/[app].channel.[channel].devices.vue
src/pages/invitation.vue
src/pages/onboarding/organization.vue
src/pages/settings/account/ChangePassword.vue
src/pages/settings/account/ManageTwoFactor.vue
src/pages/settings/organization/Members.vue
src/pages/settings/organization/Plans.vue
src/pages/settings/organization/Security.vue
src/pages/settings/organization/index.vue
src/services/apikeys.ts
src/services/capgoApi.ts
src/services/chartDataService.ts
src/services/emailOtp.ts
src/services/logAs.ts
src/services/stripe.ts
src/services/supabase.ts
src/stores/webhooks.ts
src/utils/invites.ts
src/utils/onboardingAppCreateHelpers.ts
tests/apikeys-service.unit.test.ts
tests/log-as-service.unit.test.ts
tests/supabase-cloud-functions.unit.test.ts

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

Cap-go/capacitor-updater (manual)

cursor

Stale comment

Risk: high. Left a non-blocking comment — Cursor Bugbot completed as skipped on this sync, and this PR exceeds the low-risk approval threshold (console/CLI API routing plus Capgo cloud deploy allowlist changes). Reviewers are already assigned; no approval from this run.

_{Sent by Cursor Approval Agent: Pull Request Approver External}

cursor

Stale comment

Risk: high. Left a non-blocking comment — Cursor Bugbot did not complete successfully on this commit (skipped/neutral), and unresolved Bugbot findings remain on this broad console/CLI API-routing and deploy-surface change. Reviewers are already assigned; no additional reviewers added.

_{Sent by Cursor Approval Agent: Pull Request Approver}

cursor

Stale comment

Risk: high. Left a non-blocking comment — Cursor Bugbot completed successfully with no open findings, but this PR exceeds the medium approval threshold (broad console/CLI API routing plus Capgo cloud deploy allowlist). Reviewers are already assigned; no approval from this run.

_{Sent by Cursor Approval Agent: Pull Request Approver}

cursor

Stale comment

Risk: high. Left a non-blocking comment — Cursor Bugbot completed successfully with no open findings, but this PR exceeds the low-risk approval threshold (broad console/CLI API routing plus Capgo cloud deploy allowlist). Reviewers are already assigned; no approval from this run.

_{Sent by Cursor Approval Agent: Pull Request Approver External}

Co-authored-by: Cursor <cursoragent@cursor.com>

cursor

Stale comment

Risk: high. Left a non-blocking comment — Cursor Bugbot completed as skipped on this sync and still has an unresolved finding, and this PR exceeds the low-risk approval threshold (broad console/CLI API routing plus Capgo cloud deploy allowlist). Reviewers are already assigned; no approval from this run.

_{Sent by Cursor Approval Agent: Pull Request Approver External}

cursor

Stale comment

Risk: high. Left a non-blocking comment — Cursor Bugbot completed as skipped/neutral with an unresolved finding, and this PR exceeds the medium approval threshold (broad console/CLI API routing plus Capgo cloud deploy allowlist). Reviewers are already assigned; no approval from this run.

_{Sent by Cursor Approval Agent: Pull Request Approver}

Co-authored-by: Cursor <cursoragent@cursor.com>

cursor

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 27bfda5. Configure here.}

cursor

Stale comment

Risk: high. Left a non-blocking comment — Cursor Bugbot completed as skipped on this sync and still has unresolved findings, and this PR exceeds the low-risk approval threshold (broad console/CLI API routing plus Capgo cloud deploy allowlist). Reviewers are already assigned; no approval from this run.

_{Sent by Cursor Approval Agent: Pull Request Approver External}

cursor

Stale comment

Risk: high. Left a non-blocking comment — Cursor Bugbot completed as skipped/neutral with 2 unresolved findings, and this PR exceeds the medium approval threshold (broad console/CLI API routing plus Capgo cloud deploy allowlist). Reviewers are already assigned; no approval from this run.

_{Sent by Cursor Approval Agent: Pull Request Approver}

Co-authored-by: Cursor <cursoragent@cursor.com>

cursor

Risk: high. Left a non-blocking comment — Cursor Bugbot completed successfully with no open findings, but this PR exceeds the medium approval threshold (broad console/CLI API routing plus Capgo cloud deploy allowlist). Reviewers are already assigned; no approval from this run.

_{Sent by Cursor Approval Agent: Pull Request Approver}

cursor

Risk: high. Left a non-blocking comment — Cursor Bugbot completed successfully with no open findings, but this PR exceeds the low-risk approval threshold (broad console/CLI API routing plus Capgo cloud deploy allowlist). Reviewers are already assigned; no approval from this run.

_{Sent by Cursor Approval Agent: Pull Request Approver External}

Co-authored-by: Cursor <cursoragent@cursor.com>

cursor · 2026-08-04T08:52:31Z

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_f58a5981-fb7f-436a-babb-c229cc4d8299)

coderabbitai

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

cli/src/utils.ts (1)
993-1002: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Fall back when the action RPC is unavailable for any caller.

When appId is omitted, Line 995 calls is_allowed_action_org_action without an app ID. If an older self-hosted server lacks that RPC, PostgREST returns PGRST202. Line 1000 does not handle that path, so checkPlanValidUpload(supabase, orgId) fails instead of using the stable isAllowedActionOrg RPC.

Apply the PGRST202 fallback regardless of appId. Add coverage for both app-scoped and org-scoped calls.
Proposed fix
-    if (appId && error.code === 'PGRST202')
+    if (error.code === 'PGRST202')
       return isAllowedActionOrg(supabase, orgId)
As per coding guidelines, “Public API and plugin changes must remain backward compatible: do not remove or change existing fields, meanings, formats, or status codes.”
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@cli/src/utils.ts` around lines 993 - 1002, Update the error handling around
the is_allowed_action_org_action RPC in the relevant utility so any PGRST202
error, with or without appId, falls back to isAllowedActionOrg(supabase, orgId).
Preserve throwing formatted errors for all other failures, and add coverage for
both app-scoped and org-scoped calls.
Source: Coding guidelines

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/supabase-cloud-functions.unit.test.ts`:
- Around line 13-60: Run the independent test cases in this suite concurrently
by replacing each applicable `it` declaration with `it.concurrent`. Apply this
to the tests covering function lists, deploy arguments, empty selections, and
skipped local functions, without changing their assertions or shared behavior.

---

Outside diff comments:
In `@cli/src/utils.ts`:
- Around line 993-1002: Update the error handling around the
is_allowed_action_org_action RPC in the relevant utility so any PGRST202 error,
with or without appId, falls back to isAllowedActionOrg(supabase, orgId).
Preserve throwing formatted errors for all other failures, and add coverage for
both app-scoped and org-scoped calls.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 5909b8b2-35e5-469c-9acd-16e34ea3ce0d

📥 Commits

Reviewing files that changed from the base of the PR and between a3c0cae and 765679a.

📒 Files selected for processing (23)

.github/workflows/build_and_deploy.yml
README.md
cli/src/bundle/upload.ts
cli/src/channel/set.ts
cli/src/utils.ts
cloudflare_workers/api/index.ts
package.json
scripts/supabase-cloud-functions.ts
src/components/dashboard/AppOnboardingFlow.vue
src/components/dashboard/Usage.vue
src/pages/ApiKeys.vue
src/pages/onboarding/organization.vue
src/pages/settings/account/ChangePassword.vue
src/services/apikeys.ts
src/services/capgoApi.ts
src/services/chartDataService.ts
src/services/emailOtp.ts
src/services/supabase.ts
src/utils/invites.ts
src/utils/onboardingAppCreateHelpers.ts
tests/apikeys-service.unit.test.ts
tests/capgo-api-error-code.unit.test.ts
tests/supabase-cloud-functions.unit.test.ts

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

Cap-go/capacitor-updater (manual)

Co-authored-by: Cursor <cursoragent@cursor.com>

cursor · 2026-08-06T07:59:34Z

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_339ee2f9-d7d9-45b9-8e50-de578087d48e)

sonarqubecloud · 2026-08-06T08:03:23Z

Quality Gate passed

Issues
7 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

riderx and others added 4 commits July 28, 2026 18:44

chore(supabase): stop publishing unused Capgo cloud edge functions

0ff7ed0

Capgo cloud traffic already runs on Cloudflare Workers; only `triggers` must stay on Supabase for pg_net queue_consumer. Keep full deploy for self-hosting. Co-authored-by: Cursor <cursoragent@cursor.com>

docs(supabase): clarify Capgo cloud vs self-host function deploy

ce7774a

Address review feedback: show allowlisted Capgo Cloud deploy commands and cover empty/multi-target allowlist deploy arg cases. Co-authored-by: Cursor <cursoragent@cursor.com>

riderx temporarily deployed to deepsec-pr July 28, 2026 23:43 — with GitHub Actions Inactive

fix(api): restore invoke response typing for Cloudflare helper

cef6fa3

Default invoke helpers to any like supabase.functions.invoke and tighten the few call sites that still need explicit shapes for typecheck. Co-authored-by: Cursor <cursoragent@cursor.com>

riderx temporarily deployed to deepsec-pr July 28, 2026 23:46 — with GitHub Actions Inactive

test(api): mock invokeCapgoApi in console unit tests

77b952c

log-as and apikeys unit tests still stubbed supabase.functions.invoke after the Cloudflare helper migration; point them at invokeCapgoApi instead. Co-authored-by: Cursor <cursoragent@cursor.com>

riderx temporarily deployed to deepsec-pr July 28, 2026 23:49 — with GitHub Actions Inactive

riderx marked this pull request as ready for review July 29, 2026 00:03

riderx mentioned this pull request Jul 29, 2026

chore(supabase): stop publishing unused Capgo cloud edge functions #2781

Closed

6 tasks

cubic-dev-ai Bot reviewed Jul 29, 2026

View reviewed changes

riderx temporarily deployed to deepsec-pr July 30, 2026 23:30 — with GitHub Actions Inactive

coderabbitai Bot added the codex label Jul 30, 2026

cursor Bot reviewed Jul 30, 2026

View reviewed changes

Comment thread src/services/capgoApi.ts

Comment thread src/components/dashboard/Usage.vue Outdated

cursor Bot requested review from Dalanir and WcaleNieWolny July 30, 2026 23:34

cursor Bot reviewed Jul 30, 2026

View reviewed changes

style(api): use single quotes for CapgoApi method union

b967e30

Co-authored-by: Cursor <cursoragent@cursor.com>

riderx temporarily deployed to deepsec-pr July 30, 2026 23:39 — with GitHub Actions Inactive

coderabbitai Bot requested changes Jul 30, 2026

View reviewed changes

cursor Bot reviewed Jul 30, 2026

View reviewed changes

riderx temporarily deployed to deepsec-pr July 31, 2026 00:13 — with GitHub Actions Inactive

cursor Bot reviewed Jul 31, 2026

View reviewed changes

docs: correct Capgo cloud console/CLI routing description

a84fcee

Co-authored-by: Cursor <cursoragent@cursor.com>

riderx temporarily deployed to deepsec-pr July 31, 2026 00:29 — with GitHub Actions Inactive

cursor Bot reviewed Jul 31, 2026

View reviewed changes

Comment thread src/components/dashboard/AppOnboardingFlow.vue

cursor Bot reviewed Jul 31, 2026

View reviewed changes

fix(frontend): detect duplicate org name from Capgo API moreInfo

27bfda5

Co-authored-by: Cursor <cursoragent@cursor.com>

riderx temporarily deployed to deepsec-pr July 31, 2026 00:48 — with GitHub Actions Inactive

cursor Bot reviewed Jul 31, 2026

View reviewed changes

Comment thread src/utils/invites.ts

Comment thread cli/src/utils.ts

cursor Bot reviewed Jul 31, 2026

View reviewed changes

fix(api): pass caller client and clone cached CLI config

548d2fc

Co-authored-by: Cursor <cursoragent@cursor.com>

riderx temporarily deployed to deepsec-pr July 31, 2026 01:06 — with GitHub Actions Inactive

cursor Bot reviewed Jul 31, 2026

View reviewed changes

coderabbitai Bot mentioned this pull request Aug 1, 2026

fix(cli): validate app-scoped plans with app context #2825

Merged

4 tasks

merge(main): resolve onboarding organization import conflict

765679a

Co-authored-by: Cursor <cursoragent@cursor.com>

riderx temporarily deployed to deepsec-pr August 4, 2026 08:52 — with GitHub Actions Inactive

coderabbitai Bot requested changes Aug 4, 2026

View reviewed changes

Comment thread tests/supabase-cloud-functions.unit.test.ts Outdated

coderabbitai Bot mentioned this pull request Aug 4, 2026

fix(onboarding): seed demo data when skipping CLI setup #2854

Merged

8 tasks

test(supabase): run cloud function allowlist tests concurrently

5654159

Co-authored-by: Cursor <cursoragent@cursor.com>

riderx temporarily deployed to deepsec-pr August 6, 2026 07:59 — with GitHub Actions Inactive

coderabbitai Bot approved these changes Aug 6, 2026

View reviewed changes

riderx merged commit 6187bcb into main Aug 6, 2026
92 checks passed

riderx deleted the chore/migrate-invoke-to-cloudflare branch August 6, 2026 08:44

Uh oh!

Uh oh!

Conversation

riderx commented Jul 28, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary (AI generated)

Motivation (AI generated)

Business Impact (AI generated)

Test Plan (AI generated)

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

❌ Failed checks (1 warning)

Uh oh!

codspeed-hq Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will not alter performance

Footnotes

Uh oh!

riderx commented Jul 29, 2026

Uh oh!

cursor Bot commented Jul 29, 2026

Bugbot couldn't run - usage limit reached

Uh oh!

coderabbitai Bot commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

riderx commented Jul 28, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 28, 2026 •

edited

Loading

codspeed-hq Bot commented Jul 28, 2026 •

edited

Loading

coderabbitai Bot commented Jul 29, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading