어드민 로그인 계정에 따라 dev/prod API 서버 런타임 자동 전환 - #615
Conversation
어드민 웹은 서브도메인이 하나뿐이라 web/university-web처럼 빌드타임 .env.development/.env.production 분리가 불가능하다. 로그인 이메일이 @dev.solid-connection.com 도메인이면 stage API로, 그 외는 prod API로 로그인 요청 및 이후 모든 API 호출을 런타임에 라우팅하도록 변경했다. - 선택된 환경은 localStorage에 저장되어 새로고침 후에도 유지되고, 화면에 현재 환경(DEV/PROD)을 배지로 표시한다. - axios 인스턴스는 요청 인터셉터에서 baseURL을 매번 재계산해 런타임 전환을 지원하며, 로컬 개발용 VITE_API_SERVER_URL override는 vinext dev 모드에서만 적용된다. - 재로그인 시 이전 환경의 토큰을 먼저 제거해 다른 환경으로 토큰이 새어나가는 경합을 차단했다.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
1 Skipped Deployment
|
|
Warning Review limit reached
Next review available in: 46 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
Walkthrough
Estimated code review effort: 3 (Moderate) | ~20 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/admin/src/lib/api/auth.ts`:
- Around line 21-23: Update saveAdminApiEnvironment to return whether
localStorage persistence succeeded, then update the sign-in flow around
saveAdminApiEnvironment in the auth request to abort before
authAxiosInstance.post when saving the resolved environment fails. Preserve the
existing token removal and successful-login request behavior, and add a
regression test confirming localStorage.setItem failures prevent the request
from being sent.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 24aa8b54-5936-40de-8e51-76ab60aa5a30
📒 Files selected for processing (12)
apps/admin/.env.exampleapps/admin/src/components/features/bruno/BrunoApiPageContent.tsxapps/admin/src/components/features/chat-socket/ChatSocketPageContent.tsxapps/admin/src/components/layout/AdminLayout.tsxapps/admin/src/components/layout/EnvironmentBanner.tsxapps/admin/src/lib/api/auth.tsapps/admin/src/lib/api/client.tsapps/admin/src/lib/auth/environment.test.tsapps/admin/src/lib/auth/environment.tsapps/admin/src/lib/auth/session.tsapps/admin/src/lib/env.tsapps/admin/src/lib/utils/localStorage.ts
| removeAccessToken(); | ||
| saveAdminApiEnvironment(resolveEnvironmentFromEmail(email)); | ||
| return authAxiosInstance.post("/auth/email/sign-in", { email, password }); |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
1. 환경 저장에 실패하면 로그인 요청을 중단하십시오.
Line 22의 saveAdminApiEnvironment는 localStorage 오류를 내부에서 처리하고 성공 여부를 반환하지 않습니다. 저장이 실패하면 요청 인터셉터는 환경을 읽지 못하고 production URL을 선택합니다. 그러면 dev 계정의 이메일과 비밀번호가 production API로 전송됩니다.
saveAdminApiEnvironment가 성공 여부를 반환하게 하십시오. 저장에 실패하면 Line 23의 로그인 요청을 보내지 마십시오. localStorage.setItem이 예외를 던질 때 요청이 전송되지 않는 회귀 테스트도 추가하십시오.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@apps/admin/src/lib/api/auth.ts` around lines 21 - 23, Update
saveAdminApiEnvironment to return whether localStorage persistence succeeded,
then update the sign-in flow around saveAdminApiEnvironment in the auth request
to abort before authAxiosInstance.post when saving the resolved environment
fails. Preserve the existing token removal and successful-login request
behavior, and add a regression test confirming localStorage.setItem failures
prevent the request from being sent.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 82f0be5945
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| saveAdminApiEnvironment(resolveEnvironmentFromEmail(email)); | ||
| return authAxiosInstance.post("/auth/email/sign-in", { email, password }); |
There was a problem hiding this comment.
When localStorage is unavailable (for example, browser storage is disabled), saveAdminApiEnvironment catches and suppresses the write failure, after which the request interceptor reads no stored environment and defaults to production. A @dev.solid-connection.com login therefore sends the credentials to the production API instead of the stage API; the resolved environment should be applied directly to this sign-in request rather than relying on a successful storage round trip.
Useful? React with 👍 / 👎.
CodeRabbit/Codex 리뷰 지적 반영: saveAdminApiEnvironment의 localStorage 쓰기가 실패하면(프라이빗 브라우징 등) 요청 인터셉터가 저장된 환경을 못 읽어 prod로 기본 처리되면서, dev 계정 자격증명이 prod API로 전송될 수 있었다. adminSignInApi가 이번 요청의 baseURL을 직접 지정하도록 해 localStorage 왕복 결과와 무관하게 올바른 환경으로 가도록 수정했다.
1 participant
요약
apps/admin)은 서브도메인이 하나뿐이라 web/university-web처럼.env.development/.env.production빌드타임 분리를 쓸 수 없었음. 로그인 이메일이@dev.solid-connection.com도메인이면 stage API, 그 외는 prod API로 로그인 요청 및 이후 모든 API 호출이 런타임에 라우팅되도록 변경VITE_API_SERVER_URLoverride는vinext dev모드에서만 적용되어, Vercel에 값이 남아있어도 배포본에는 영향 없음배경
딥 인터뷰(Socratic Q&A, 7라운드)로 요구사항을 정리하고, 별도 code-reviewer 에이전트 검토(HIGH 3건 포함)를 반영해 구현했습니다.
Test plan
pnpm --filter admin typecheckpnpm --filter admin lint:checkpnpm --filter admin test(25 tests passed, 신규environment.test.ts포함)pnpm --filter admin build