GeezerVisonThe World Wide Web, restored to 800 pixels of glory. | |||||||||||||||||||||||||||||||||||||||||||||||||||
| Home|About|Gaming cabinet|Archives|How it works|Starter sites | |||||||||||||||||||||||||||||||||||||||||||||||||||
GeezerVison is showing github.com — feat(webapp): upload and crop a profile picture from the account page by kathiekiwi · Pull Request #4802 · triggerdotdev/trigger.dev Conversation
|
|
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was an error while loading. Please reload this page.
WalkthroughAdds profile photo upload, cropping, removal, and avatar preview handling. Adds validated avatar storage with dedicated object-store configuration, cleanup, presigned downloads, and raw byte reads. Adds authenticated avatar resource actions and loaders with request-size limits. Updates API avatar URLs and CSP image sources. Adds Storybook states, styling, environment examples, local MinIO setup, and tests. Merge Risk: 🟡 Moderate · up to The PR adds S3-backed avatar upload and retrieval, but the current implementation can expose avatar access over unencrypted HTTP, leave removed images reachable after cleanup failures, or break the current avatar during overlapping updates. These concrete security and reliability issues should be fixed or explicitly accepted before merge. 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was an error while loading. Please reload this page.
Observability mapAs of 20/100 over 451 measured of 469 entry points (base 20, no change) What this PR changed
FIX FIRST
AUDIT 3 of 50 sensitive mutations record an actor. 47 without one. What the score is made ofThe score and findings here are report-only and never gate the merge. Separately, a required test suite keeps this tool's symbol and route lists in sync with the code they name, and can fail a pull request that renames or removes a symbol they reference, or that adds the first route with a segment they anticipate. Each failure names the list to edit. The rules and their reasons: internal-packages/observability-map/README.md. |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
The reason will be displayed to describe this comment to others. Learn more.
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
The reason will be displayed to describe this comment to others. Learn more.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
apps/webapp/app/services/dashboardAgentBodyCap.server.ts (1)
82-90: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winAdd required crumb instrumentation to the changed flows.
apps/webapp/app/services/dashboardAgentBodyCap.server.ts#L82-L90: add crumbs for declared-length rejection and request teardown.apps/webapp/app/routes/resources.account.avatar.ts#L18-L25: add crumbs for the impersonation mutation rejection.apps/webapp/test/dashboardAgentBodyCap.test.ts#L174-L187: add crumbs for the stalled-client teardown test path.apps/webapp/app/components/ProfilePhotoEditor.tsx#L94-L97: add crumbs for saved-avatar fallback state.Use an approved crumb namespace where required. As per coding guidelines: “Add crumbs as you write code — not just when debugging.”
Source: Coding guidelines
apps/webapp/app/components/ProfilePhotoEditor.tsx (1)
116-129: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winReject selected files over the 5 MiB limit.
selectFilechecks onlyfile.type. A source image over 5 MiB can still be decoded and cropped into a smaller PNG that passes the server upload limit. Checkfile.sizeagainst the sharedMAX_AVATAR_SIZE_IN_BYTESbefore creating the object URL.Proposed fix
if (!ACCEPTED_TYPES.includes(file.type)) { setError("Choose a PNG, JPEG or WebP image."); return; } + if (file.size > MAX_AVATAR_SIZE_IN_BYTES) { + setError("Choose an image smaller than 5 MB."); + return; + } + setCrop(CENTER);
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro Plus
Run ID: e56b1115-c91b-44a3-9c6d-8bc5d32226bd
apps/webapp/app/components/ProfilePhotoEditor.tsxapps/webapp/app/routes/resources.account.avatar.tsapps/webapp/app/routes/storybook.profile-photo-editor/route.tsxapps/webapp/app/services/dashboardAgentBodyCap.server.tsapps/webapp/test/dashboardAgentBodyCap.test.tsIncluded review availability: Your plan provides up to 10 included reviews per hour; 7 remain after this review.
📄 CodeRabbit inference engine (apps/webapp/CLAUDE.md)
Files:
apps/webapp/app/routes/resources.account.avatar.ts📄 CodeRabbit inference engine (apps/webapp/CLAUDE.md)
Files:
apps/webapp/app/routes/resources.account.avatar.tsapps/webapp/app/services/dashboardAgentBodyCap.server.ts📄 CodeRabbit inference engine (AGENTS.md)
Files:
apps/webapp/test/dashboardAgentBodyCap.test.ts📄 CodeRabbit inference engine (apps/webapp/CLAUDE.md)
Files:
apps/webapp/test/dashboardAgentBodyCap.test.ts📄 CodeRabbit inference engine (apps/webapp/CLAUDE.md)
Files:
apps/webapp/app/routes/resources.account.avatar.tsapps/webapp/app/components/ProfilePhotoEditor.tsxapps/webapp/app/services/dashboardAgentBodyCap.server.ts📄 CodeRabbit inference engine (AGENTS.md)
Files:
apps/webapp/app/routes/resources.account.avatar.tsapps/webapp/app/components/ProfilePhotoEditor.tsxapps/webapp/app/services/dashboardAgentBodyCap.server.tsapps/webapp/test/dashboardAgentBodyCap.test.ts📄 CodeRabbit inference engine (AGENTS.md)
Files:
apps/webapp/app/routes/resources.account.avatar.tsapps/webapp/app/components/ProfilePhotoEditor.tsxapps/webapp/app/services/dashboardAgentBodyCap.server.tsapps/webapp/test/dashboardAgentBodyCap.test.ts📄 CodeRabbit inference engine (.github/copilot-instructions.md)
Files:
apps/webapp/app/routes/resources.account.avatar.tsapps/webapp/app/components/ProfilePhotoEditor.tsxapps/webapp/app/services/dashboardAgentBodyCap.server.tsapps/webapp/test/dashboardAgentBodyCap.test.ts📄 CodeRabbit inference engine (.cursor/rules/webapp.mdc)
Files:
apps/webapp/test/dashboardAgentBodyCap.test.ts📄 CodeRabbit inference engine (.cursor/rules/webapp.mdc)
Files:
apps/webapp/app/routes/resources.account.avatar.tsapps/webapp/app/components/ProfilePhotoEditor.tsxapps/webapp/app/services/dashboardAgentBodyCap.server.tsapps/webapp/test/dashboardAgentBodyCap.test.ts📄 CodeRabbit inference engine (.github/copilot-instructions.md)
Files:
apps/webapp/test/dashboardAgentBodyCap.test.ts📄 CodeRabbit inference engine (.github/copilot-instructions.md)
Files:
apps/webapp/app/routes/resources.account.avatar.tsapps/webapp/app/components/ProfilePhotoEditor.tsxapps/webapp/app/services/dashboardAgentBodyCap.server.tsapps/webapp/test/dashboardAgentBodyCap.test.ts📄 CodeRabbit inference engine (.github/copilot-instructions.md)
Files:
apps/webapp/app/routes/resources.account.avatar.tsapps/webapp/app/components/ProfilePhotoEditor.tsxapps/webapp/app/services/dashboardAgentBodyCap.server.tsapps/webapp/test/dashboardAgentBodyCap.test.ts📄 CodeRabbit inference engine (.cursor/rules/otel-metrics.mdc)
Files:
apps/webapp/app/routes/resources.account.avatar.tsapps/webapp/app/services/dashboardAgentBodyCap.server.tsapps/webapp/test/dashboardAgentBodyCap.test.ts[warning] 25-25: Express application should use Helmet
Context: express()
Note: [CWE-693] Protection Mechanism Failure (Express app without Helmet security headers).
(missing-helmet-typescript)
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was an error while loading. Please reload this page.
|
Preview Deployment
|
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
The reason will be displayed to describe this comment to others. Learn more.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
apps/webapp/test/userAvatar.test.ts (1)
204-210: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winIsolate
AVATARS_OBJECT_STORE_SERVICEin avatar tests.A runner-provided service value can remain active because neither suite resets this new setting. The MinIO test then does not guarantee S3 signing.
apps/webapp/test/userAvatar.test.ts#L204-L210: includeAVATARS_OBJECT_STORE_SERVICEin the saved and reset avatar environment state, then set"s3"for isolated test cases.apps/webapp/test/objectStore.test.ts#L855-L878: save and restore this value, and set it to"s3"before the MinIO upload.Proposed fix
const AVATAR_ENV_KEYS = [ "AVATARS_OBJECT_STORE_BASE_URL", "AVATARS_OBJECT_STORE_BUCKET", "AVATARS_OBJECT_STORE_ACCESS_KEY_ID", "AVATARS_OBJECT_STORE_SECRET_ACCESS_KEY", "AVATARS_OBJECT_STORE_REGION", + "AVATARS_OBJECT_STORE_SERVICE", ] as const;const original = { // existing settings + service: env.AVATARS_OBJECT_STORE_SERVICE, }; afterAll(() => { // existing restores + env.AVATARS_OBJECT_STORE_SERVICE = original.service; }); // MinIO setup +env.AVATARS_OBJECT_STORE_SERVICE = "s3";apps/webapp/app/routes/account._index/route.tsx (1)
457-548: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winAdd crumb instrumentation to the new profile-photo flow.
The new
ChangeProfilePhotoButtonupload and removal flow has no//@Crumbsmarker or `// `#region` `@crumbsblock. Add a crumb around this behavior so development tracing is available beforeagentcrumbs stripremoves it.As per coding guidelines:
**/*: Add crumbs as you write code — not just when debugging.Source: Coding guidelines
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro Plus
Run ID: eba5b1a5-ff6e-456e-b53b-d0807e378893
apps/webapp/app/env.server.tsapps/webapp/app/routes/account._index/route.tsxapps/webapp/app/services/userAvatar.server.tsapps/webapp/test/objectStore.test.tsapps/webapp/test/userAvatar.test.tsIncluded review availability: Your plan provides up to 10 included reviews per hour; 7 remain after this review.
📄 CodeRabbit inference engine (apps/webapp/CLAUDE.md)
Files:
apps/webapp/app/env.server.tsapps/webapp/app/services/userAvatar.server.ts📄 CodeRabbit inference engine (AGENTS.md)
Files:
apps/webapp/test/objectStore.test.tsapps/webapp/test/userAvatar.test.ts📄 CodeRabbit inference engine (apps/webapp/CLAUDE.md)
Files:
apps/webapp/test/objectStore.test.tsapps/webapp/test/userAvatar.test.ts📄 CodeRabbit inference engine (apps/webapp/CLAUDE.md)
Files:
apps/webapp/app/routes/account._index/route.tsxapps/webapp/app/env.server.tsapps/webapp/app/services/userAvatar.server.ts📄 CodeRabbit inference engine (AGENTS.md)
Files:
apps/webapp/app/routes/account._index/route.tsxapps/webapp/test/objectStore.test.tsapps/webapp/app/env.server.tsapps/webapp/test/userAvatar.test.tsapps/webapp/app/services/userAvatar.server.ts📄 CodeRabbit inference engine (AGENTS.md)
Files:
apps/webapp/app/routes/account._index/route.tsxapps/webapp/test/objectStore.test.tsapps/webapp/app/env.server.tsapps/webapp/test/userAvatar.test.tsapps/webapp/app/services/userAvatar.server.ts📄 CodeRabbit inference engine (.github/copilot-instructions.md)
Files:
apps/webapp/app/routes/account._index/route.tsxapps/webapp/test/objectStore.test.tsapps/webapp/app/env.server.tsapps/webapp/test/userAvatar.test.tsapps/webapp/app/services/userAvatar.server.ts📄 CodeRabbit inference engine (.cursor/rules/webapp.mdc)
Files:
apps/webapp/test/objectStore.test.tsapps/webapp/test/userAvatar.test.ts📄 CodeRabbit inference engine (.cursor/rules/webapp.mdc)
Files:
apps/webapp/app/routes/account._index/route.tsxapps/webapp/test/objectStore.test.tsapps/webapp/app/env.server.tsapps/webapp/test/userAvatar.test.tsapps/webapp/app/services/userAvatar.server.ts📄 CodeRabbit inference engine (.github/copilot-instructions.md)
Files:
apps/webapp/test/objectStore.test.tsapps/webapp/test/userAvatar.test.ts📄 CodeRabbit inference engine (.github/copilot-instructions.md)
Files:
apps/webapp/app/routes/account._index/route.tsxapps/webapp/test/objectStore.test.tsapps/webapp/app/env.server.tsapps/webapp/test/userAvatar.test.tsapps/webapp/app/services/userAvatar.server.ts📄 CodeRabbit inference engine (.github/copilot-instructions.md)
Files:
apps/webapp/app/routes/account._index/route.tsxapps/webapp/test/objectStore.test.tsapps/webapp/app/env.server.tsapps/webapp/test/userAvatar.test.tsapps/webapp/app/services/userAvatar.server.ts📄 CodeRabbit inference engine (.cursor/rules/otel-metrics.mdc)
Files:
apps/webapp/test/objectStore.test.tsapps/webapp/app/env.server.tsapps/webapp/test/userAvatar.test.tsapps/webapp/app/services/userAvatar.server.tsLearnt from: ericallam
Repo: triggerdotdev/trigger.dev PR: 3658
File: packages/core/src/v3/realtimeStreams/manager.test.ts:1-147
Timestamp: 2026-05-18T14:40:02.173Z
Learning: In the triggerdotdev/trigger.dev repo, the policy “Never mock anything — use testcontainers instead” should only be enforced for integration tests that interact with real external services (e.g., Redis, Postgres) via actual infrastructure. For unit tests that exercise pure in-memory logic (e.g., cache semantics) it is OK to stub collaborators such as `ApiClient` using Vitest (`vi.fn()`) to assert call counts or control behavior. Do not flag `vi.fn()`-based `ApiClient` stubs in unit tests as violations of the testcontainers policy.
Applied to files:
apps/webapp/test/objectStore.test.tsLearnt from: d-cs
Repo: triggerdotdev/trigger.dev PR: 3960
File: apps/webapp/test/prismaInfrastructureErrorCapture.test.ts:0-0
Timestamp: 2026-06-16T09:19:47.637Z
Learning: In this repo’s Vitest setup, `vitest.config.ts` uses `globals: true`, so identifiers like `vi`, `describe`, `it`, and `expect` are available as globals in Vitest test files. During code review, do not flag missing `vi`/`describe`/`it`/`expect` imports as a runtime error or correctness issue when they’re used in `*.test.ts/tsx` or `*.spec.ts/tsx` files. Explicit imports are still preferred for consistency, but they’re not required for runtime behavior.
Applied to files:
apps/webapp/test/userAvatar.test.tsapps/webapp/app/routes/account._index/route.tsx (1)
11-11: LGTM!Also applies to: 37-37, 95-95, 267-271, 882-883, 1003-1007
Sorry, something went wrong.
There was an error while loading. Please reload this page.
|
Linear have a nice feature that lets you rotate the uploaded image by 45 degrees if it uploads in the wrong rotation. Like a little rotate icon top right of the image. It would be nice to include this too as it would be a big pain to fix outside the UI. |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
At least 1 approving review is required to merge this pull request.
There was an error while loading. Please reload this page.
Successfully merging this pull request may close these issues.
There was an error while loading. Please reload this page.