feat: implement persistent session feature for user authentication wi… by Lathiya50 · Pull Request #7 · Lathiya50/CodeReviewAI

Lathiya50 · 2026-05-20T10:58:03Z

…th 7-day cookie persistence

vercel · 2026-05-20T10:58:09Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
code-review-ai	Ready	Preview, Comment	Jun 11, 2026 4:49pm

Lathiya50

🤖 CodeReviewAI

The pull request introduces a persistent session feature for user authentication, automatic PR review on push, and other improvements. The changes include updates to the .env.example file, package.json, and pnpm-lock.yaml. The risk score is 60 due to the introduction of new features and dependencies.

The pull request implements a persistent session feature for user authentication, including changes to the Prisma schema, sign-in and sign-up pages, and the dashboard repository page.

The pull request introduces a persistent session feature for user authentication with GitHub. It includes changes to the webhook verification process, repository management, and session configuration. The code is generally well-structured, but there are some minor issues and suggestions for improvement.

This pull request implements a persistent session feature for user authentication with GitHub. It introduces a new function to create a GitHub PR review and adds an auto-post feature for webhook-originated reviews. The code also includes a new service to register and manage repository webhooks. Overall, the changes are well-structured and follow good practices, but there are some potential issues and improvements to be made.

15 inline comment(s) posted, 1 skipped (outside diff range)

Lathiya50 · 2026-05-20T11:34:54Z

@@ -2,7 +2,11 @@ APP_DOMAIN="app.example.com"
 DATABASE_URL="postgresql://user:password@localhost:5432/mydatabase" # Replace with your actual database URL



🟡 MEDIUM — security

The BETTER_AUTH_SECRET should be a strong secret key and not hardcoded in the .env.example file.

💡 Suggestion: Use environment variables or a secrets manager to store sensitive keys.

Lathiya50 · 2026-05-20T11:34:54Z

+# here to auto-register hooks and post reviews. For local dev, expose your
+# server with a tunnel (e.g. cloudflared / ngrok) and use that URL; GitHub
+# cannot reach http://localhost.
+BETTER_AUTH_URL="https://app.example.com"


🟡 MEDIUM — security

The GH_WEBHOOK_SECRET should be a strong secret key and not hardcoded in the .env.example file.

💡 Suggestion: Use environment variables or a secrets manager to store sensitive keys.

Lathiya50 · 2026-05-20T11:34:54Z

@@ -25,7 +25,7 @@
    "class-variance-authority": "^0.7.1",


⚪ LOW — style

The inngest version has been updated from 3.52.1 to 3.54.0.

💡 Suggestion: Ensure that the updated version is compatible with the existing codebase.

Lathiya50 · 2026-05-20T11:34:54Z

@@ -5,10 +5,13 @@ An intelligent AI-powered code review platform that automatically analyzes GitHu
 ## Features


⚪ LOW — style

The README.md file has been updated with new features and explanations.

💡 Suggestion: Review the updated content for accuracy and clarity.

Lathiya50 · 2026-05-20T11:34:54Z

@@ -90,10 +90,29 @@ model Repository {
  createdAt DateTime @default(now())


🟡 MEDIUM — style

The new fields added to the Repository model should be documented with a description of their purpose.

💡 Suggestion: Add comments to explain the purpose of the new fields.

Lathiya50 · 2026-05-20T11:34:55Z

+ * When no secret is available the request is allowed through (legacy behaviour
+ * for hooks configured before per-repo secrets existed).
+ */
+function verifySignature(


🟡 MEDIUM — performance

The verifySignature function is using crypto.timingSafeEqual which can be slow for large inputs. Consider using a faster alternative.

💡 Suggestion: Use a faster alternative like crypto.timingSafeEqual with a smaller input size or a different algorithm.

Lathiya50 · 2026-05-20T11:34:55Z

@@ -33,6 +33,10 @@ export const auth = betterAuth({
    },
  },


🟡 MEDIUM — security

The session configuration has a hardcoded session lifetime of 7 days. Consider making this configurable.

💡 Suggestion: Make the session lifetime configurable by adding an environment variable or a configuration option.

Lathiya50 · 2026-05-20T11:34:55Z

+
+/**
+ * Finds an existing repository webhook whose delivery URL matches `url`.
+ * Returns the hook id, or null if none is found / the lookup fails.


🟡 MEDIUM — performance

The findRepoWebhook function fetches all repository hooks and iterates over them to find a match. This could be inefficient if there are many hooks. Consider using a more efficient approach, such as using the hook.id in the URL to fetch a specific hook.

💡 Suggestion: Use a more efficient approach to find the repository webhook.

Lathiya50 · 2026-05-20T11:34:55Z

+
+  if (!response.ok) return null;
+
+  const hooks = (await response.json()) as GitHubHook[];


🟡 MEDIUM — security

The registerRepoWebhook function does not handle errors properly. If the webhook registration fails, it does not update the error message. Consider adding proper error handling to ensure that the error message is updated correctly.

💡 Suggestion: Add proper error handling to update the error message.

Lathiya50 · 2026-05-20T11:34:55Z

@@ -32,7 +37,8 @@ export const reviewPR = inngest.createFunction(
  },
  { event: "review/pr.requested" },
  async ({ event, step }) => {


🟡 MEDIUM — performance

The reviewPR function uses async/await to run the update-status-processing step. However, it does not handle errors properly. If the step fails, it does not update the error message. Consider adding proper error handling to ensure that the error message is updated correctly.

💡 Suggestion: Add proper error handling to update the error message.

…hook management

Lathiya50

🤖 CodeReviewAI

The pull request implements a persistent session feature for user authentication, automatic PR review on push, and automatic webhook setup. It also updates the Inngest version to 3.54.0.

The pull request implements a persistent session feature for user authentication, adds webhook and automation settings for connected repositories, and updates the sign-in and sign-up pages to include a 'remember me' option.

Persistent session feature for user authentication with GitHub webhooks

This pull request implements a persistent session feature for user authentication with GitHub, enabling auto-posting of reviews back to the PR. The changes introduce a new function createGitHubPRReview and modify the reviewPR function to handle webhook-originated reviews. The code also includes a new service github.ts with functions for managing repository webhooks.

18 inline comment(s) posted, 2 skipped (outside diff range)

Lathiya50 · 2026-05-20T11:57:54Z

@@ -0,0 +1,16 @@
+{


🟡 MEDIUM — security

The permissions in the settings file should be reviewed to ensure they are not too permissive.

💡 Suggestion: Review the permissions to ensure they are necessary and not too permissive.

Lathiya50 · 2026-05-20T11:57:54Z


 BETTER_AUTH_SECRET="supersecretkey" # Replace with a strong secret key
-BETTER_AUTH_URL="https://app.example.com" # Base URL of your app
+# Base URL of your app. MUST be a public HTTPS URL — GitHub delivers webhooks


🟡 MEDIUM — security

The BETTER_AUTH_SECRET should be a strong secret key and not hardcoded.

💡 Suggestion: Use an environment variable or a secrets manager to store the secret key.

Lathiya50 · 2026-05-20T11:57:54Z


+# Optional override for the GitHub webhook endpoint origin. If set, webhooks are
+# registered against this URL instead of the app URL above. Use it in local dev
+# to point GitHub at a public HTTPS tunnel (e.g. ngrok) while BETTER_AUTH_URL /


🟡 MEDIUM — security

The GH_WEBHOOK_SECRET should be a strong secret key and not hardcoded.

💡 Suggestion: Use an environment variable or a secrets manager to store the secret key.

Lathiya50 · 2026-05-20T11:57:54Z

@@ -25,7 +25,7 @@
    "class-variance-authority": "^0.7.1",


⚪ LOW — style

The Inngest version has been updated to 3.54.0.

💡 Suggestion: Ensure that the updated version is compatible with the existing codebase.

Lathiya50 · 2026-05-20T11:57:54Z

@@ -5,10 +5,13 @@ An intelligent AI-powered code review platform that automatically analyzes GitHu
 ## Features


⚪ LOW — style

The features list has been updated to include automatic PR review on push and automatic webhook setup.

💡 Suggestion: Review the features list to ensure it is accurate and up-to-date.

Lathiya50 · 2026-05-20T11:57:55Z

+  config?: { url?: string };
+}
+
+const WEBHOOK_EVENTS = ["pull_request"] as const;


🟡 MEDIUM — security

The fetch function is used without a AbortController to handle potential network errors. Consider using AbortController to improve error handling.

💡 Suggestion: Use AbortController to handle potential network errors.

Lathiya50 · 2026-05-20T11:57:55Z

+  repo: string,
+  url: string,
+): Promise<bigint | null> {
+  const response = await fetch(


🟡 MEDIUM — security

The fetch function is used without a AbortController to handle potential network errors. Consider using AbortController to improve error handling.

💡 Suggestion: Use AbortController to handle potential network errors.

Lathiya50 · 2026-05-20T11:57:55Z

+
+  const hooks = (await response.json()) as GitHubHook[];
+  const match = hooks.find((hook) => hook.config?.url === url);
+  return match ? BigInt(match.id) : null;


🟡 MEDIUM — security

The fetch function is used without a AbortController to handle potential network errors. Consider using AbortController to improve error handling.

💡 Suggestion: Use AbortController to handle potential network errors.

Lathiya50 · 2026-05-20T11:57:55Z

@@ -121,6 +127,42 @@ export const reviewPR = inngest.createFunction(
      });


🟡 MEDIUM — performance

The db.review.update function is called multiple times in the reviewPR function. Consider batching updates to improve performance.

💡 Suggestion: Batch updates to improve performance.

Lathiya50 · 2026-05-20T11:57:55Z

+          const result = await createGitHubPRReview(
+            accessToken,
+            owner,
+            repo,


🟡 MEDIUM — performance

The db.review.update function is called multiple times in the reviewPR function. Consider batching updates to improve performance.

💡 Suggestion: Batch updates to improve performance.

Lathiya50

🤖 CodeReviewAI

The pull request implements a persistent session feature for user authentication, including auto-review on push and automatic webhook setup. The changes include updates to the .env.example file, README.md, and package.json. The risk score is 60 due to potential security issues with the new features.

The pull request introduces a persistent session feature for user authentication, including changes to the Prisma schema, sign-in and sign-up pages, and the dashboard repos page. The changes aim to improve user experience and automate review and posting processes.

This pull request implements a persistent session feature for user authentication with GitHub. It introduces a new verifySignatureAgainstSecrets function to verify GitHub HMAC signatures against multiple secrets, including per-repo secrets. The code also includes improvements to the repositoryRouter and auth configurations. Overall, the changes enhance the security and functionality of the GitHub integration.

Persistent session feature for user authentication with GitHub.
This PR introduces a new feature to auto-post reviews back to GitHub for webhook-originated reviews.
However, there are some security concerns and code style issues that need to be addressed.

15 inline comment(s) posted, 1 skipped (outside diff range)

Lathiya50 · 2026-05-20T12:19:24Z

@@ -2,16 +2,31 @@ APP_DOMAIN="app.example.com"
 DATABASE_URL="postgresql://user:password@localhost:5432/mydatabase" # Replace with your actual database URL



🟡 MEDIUM — security

The BETTER_AUTH_SECRET should be a strong secret key and not hardcoded in the .env.example file.

💡 Suggestion: Use environment variables or a secrets manager to store sensitive keys.

Lathiya50 · 2026-05-20T12:19:24Z

+# cannot reach http://localhost.
+BETTER_AUTH_URL="https://app.example.com"
 NEXT_PUBLIC_APP_URL="https://app.example.com"



🟡 MEDIUM — security

The GH_WEBHOOK_SECRET should be a strong secret key and not hardcoded in the .env.example file.

💡 Suggestion: Use environment variables or a secrets manager to store sensitive keys.

Lathiya50 · 2026-05-20T12:19:24Z

@@ -25,7 +25,7 @@
    "class-variance-authority": "^0.7.1",


⚪ LOW — style

The inngest version has been updated from 3.52.1 to 3.54.0.

💡 Suggestion: Verify that the updated version is compatible with the existing codebase.

Lathiya50 · 2026-05-20T12:19:24Z

@@ -90,10 +90,29 @@ model Repository {
  createdAt DateTime @default(now())


🟡 MEDIUM — style

The added fields and enums are not following a consistent naming convention.

💡 Suggestion: Use a consistent naming convention throughout the schema.

Lathiya50 · 2026-05-20T12:19:24Z

@@ -5,7 +5,6 @@ import Link from "next/link";
 import { useRouter, useSearchParams } from "next/navigation";


⚪ LOW — style

The removed import statement for Checkbox is not used anywhere in the file.

💡 Suggestion: Remove unused import statements to improve code readability.

Lathiya50 · 2026-05-20T12:19:25Z

@@ -23,7 +23,11 @@ export const auth = betterAuth({
    github: {
      clientId: process.env.GH_CLIENT_ID ?? "",
      clientSecret: process.env.GH_CLIENT_SECRET ?? "",


🟡 MEDIUM — security

The auth configuration now includes the admin:repo_hook scope, which is required for creating and updating per-repo PR webhooks. However, this scope is not explicitly mentioned in the commit message or documentation.

💡 Suggestion: Add a note in the commit message or documentation to explain the addition of the admin:repo_hook scope.

Lathiya50 · 2026-05-20T12:19:25Z

+}
+
+const WEBHOOK_EVENTS = ["pull_request"] as const;
+


🟠 HIGH — security

Insecure use of BigInt for hook ID. Consider using a safer approach.

💡 Suggestion: Use a safer approach to handle hook IDs, such as using a string or a number.

Lathiya50 · 2026-05-20T12:19:25Z

+  repo: string,
+  url: string,
+): Promise<bigint | null> {
+  const response = await fetch(


🟡 MEDIUM — style

Consider using a more descriptive variable name instead of status.

💡 Suggestion: Use a more descriptive variable name to improve code readability.

Lathiya50 · 2026-05-20T12:19:25Z

@@ -32,7 +37,8 @@ export const reviewPR = inngest.createFunction(
  },


🟡 MEDIUM — performance

Consider using a more efficient approach to update the review status.

💡 Suggestion: Use a more efficient approach to update the review status, such as using a single database query.

Lathiya50 · 2026-05-20T12:19:25Z

+    const { reviewId, repositoryId, prNumber, userId, autoPost, postEvent } =
+      event.data;

    await step.run("update-status-processing", async () => {


🟡 MEDIUM — style

Consider using a more consistent naming convention for function parameters.

💡 Suggestion: Use a more consistent naming convention for function parameters to improve code readability.

Lathiya50

🤖 CodeReviewAI

The pull request implements a persistent session feature for user authentication, including auto-review on push and automatic webhook setup. The changes include updates to the .env.example file, README.md, and package.json. The risk score is 60 due to potential security issues with the new features.

The pull request introduces a persistent session feature for user authentication, including changes to the Prisma schema, sign-in and sign-up pages, and the dashboard repos page. The changes aim to improve user experience and automate review and posting processes.

This pull request implements a persistent session feature for user authentication with GitHub. It introduces a new verifySignatureAgainstSecrets function to verify GitHub HMAC signatures against multiple secrets, including per-repo secrets. The code also includes improvements to the repositoryRouter and auth configurations. Overall, the changes enhance the security and functionality of the GitHub integration.

Persistent session feature for user authentication with GitHub.
This PR introduces a new feature to auto-post reviews back to GitHub for webhook-originated reviews.
However, there are some security concerns and code style issues that need to be addressed.

1 inline comment(s) posted

Lathiya50 · 2026-05-20T12:21:19Z

@@ -2,16 +2,31 @@ APP_DOMAIN="app.example.com"
 DATABASE_URL="postgresql://user:password@localhost:5432/mydatabase" # Replace with your actual database URL



🟡 MEDIUM — security

The BETTER_AUTH_SECRET should be a strong secret key and not hardcoded in the .env.example file.

💡 Suggestion: Use environment variables or a secrets manager to store sensitive keys.

… derive legacy flags

…process

feat: implement persistent session feature for user authentication wi…

954e15c

…th 7-day cookie persistence

chore: update README file

6f5f8d7

Lathiya50 commented May 20, 2026

View reviewed changes

vercel Bot had a problem deploying to Preview May 20, 2026 11:34 Failure

feat: add support for configurable GitHub webhook URL and enhance web…

258c8cc

…hook management

Lathiya50 commented May 20, 2026

View reviewed changes

vercel Bot had a problem deploying to Preview May 20, 2026 11:58 Failure

feat: enhance signature verification to support multiple secrets

481750a

Lathiya50 commented May 20, 2026

View reviewed changes

vercel Bot had a problem deploying to Preview May 20, 2026 12:19 Failure

Lathiya50 commented May 20, 2026

View reviewed changes

refactor: update UI components and styles for consistency

ffe393e

vercel Bot had a problem deploying to Preview June 6, 2026 14:17 Failure

build fix

b0bfbde

vercel Bot deployed to Preview June 6, 2026 14:29

View deployment

Lathiya50 added 2 commits June 9, 2026 23:57

Add Feature User AI Settings (Model + API Key + Custom Instructions)

61b0fa3

refactor: update color schemes and gradients across components

0dd1e49

vercel Bot deployed to Preview June 9, 2026 19:13

View deployment

feat: implement unified automation mode for repository management and…

25d3057

… derive legacy flags

vercel Bot deployed to Preview June 11, 2026 16:40

View deployment

feat: add transient network error handling and retry logic in review …

67db4b3

…process

vercel Bot deployed to Preview June 11, 2026 16:49

View deployment

		@@ -2,7 +2,11 @@ APP_DOMAIN="app.example.com"
		DATABASE_URL="postgresql://user:password@localhost:5432/mydatabase" # Replace with your actual database URL

		@@ -5,10 +5,13 @@ An intelligent AI-powered code review platform that automatically analyzes GitHu
		## Features

		@@ -90,10 +90,29 @@ model Repository {
		createdAt DateTime @default(now())


		if (!response.ok) return null;

		const hooks = (await response.json()) as GitHubHook[];

		@@ -121,6 +127,42 @@ export const reviewPR = inngest.createFunction(
		});

		@@ -2,16 +2,31 @@ APP_DOMAIN="app.example.com"
		DATABASE_URL="postgresql://user:password@localhost:5432/mydatabase" # Replace with your actual database URL

		@@ -5,7 +5,6 @@ import Link from "next/link";
		import { useRouter, useSearchParams } from "next/navigation";

		@@ -32,7 +37,8 @@ export const reviewPR = inngest.createFunction(
		},

Conversation

Lathiya50 commented May 20, 2026

Uh oh!

vercel Bot commented May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Lathiya50 left a comment

Choose a reason for hiding this comment

🤖 CodeReviewAI

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Lathiya50 left a comment

Choose a reason for hiding this comment

🤖 CodeReviewAI

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Lathiya50 left a comment

Choose a reason for hiding this comment

🤖 CodeReviewAI

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Lathiya50 left a comment

Choose a reason for hiding this comment

vercel Bot commented May 20, 2026 •

edited

Loading