FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

fix(web): Fix ask link generation for anonymous access by brendan-kellam · Pull Request #873 · sourcebot-dev/sourcebot · GitHub

/ sourcebot Public

fix(web): Fix ask link generation for anonymous access - #873

Merged
brendan-kellam merged 2 commits into
mainfrom
bkellam/fix-SOU-439
Feb 10, 2026
ConversationCommits (2)ChecksFiles changed
Merged

fix(web): Fix ask link generation for anonymous access#873
brendan-kellam merged 2 commits into
mainfrom
bkellam/fix-SOU-439

Conversation

brendan-kellam commented Feb 10, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Contributor

Fixes #871

Also improves error handling for /api/chat/blocking s.t., errors are actually propagated

Summary by CodeRabbit

  • Bug Fixes
    • Resolved a security vulnerability where session links generated for code analysis operations were accessible to unauthenticated users.
    • Enhanced error handling in chat streaming to provide improved error recovery and reporting.

This comment has been minimized.

Sign in to view

coderabbitai Bot commented Feb 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Caution

Review failed

The pull request is closed.

Walkthrough

This PR fixes an issue where unauthenticated chat sessions created via MCP would be marked as PRIVATE with no owner, resulting in 404 errors when accessed. The fix makes chat visibility conditional (PRIVATE when authenticated, PUBLIC otherwise) and refactors error handling in the chat streaming APIs.

Changes

Cohort / File(s) Summary
Chat Session Visibility Fix
packages/web/src/app/api/(server)/chat/blocking/route.ts		 Made chat visibility conditional based on authentication: PRIVATE when a user is present, PUBLIC otherwise. Enhanced error handling in streaming path to convert non-ServiceError exceptions into ServiceErrorException with INTERNAL_SERVER_ERROR.
Error Handling Refactoring
packages/web/src/app/api/(server)/chat/route.ts		 Externalized error handling via new onError callback parameter in CreateMessageStreamResponseProps interface and createMessageStream function, replacing internal errorHandler logic with plumbed callback invocation.
Documentation
CHANGELOG.md		 Added Fixed entry documenting the resolution of session links being accessible to unauthenticated users in ask_codebase MCP calls.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related PRs

Suggested reviewers

  • msukkari
✨ Finishing touches
  • 📝 Generate docstrings
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch bkellam/fix-SOU-439

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

brendan-kellam merged commit 081dc67 into main Feb 10, 2026
9 of 10 checks passed
github-actions Bot mentioned this pull request Feb 10, 2026
Open

claude Bot commented Feb 10, 2026

Copy link
Copy Markdown
Contributor

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.

This was referenced Feb 14, 2026
Merged
Merged
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

ask_codebase can return 404 research session links when blocking chats are created unauthenticated

1 participant

Back | FazBrowse Home | New Git URL