Actionable comments posted: 1

packages/web/src/features/search/searchApi.ts (1)

31-40: Consider extracting duplicated audit logic.

The audit blocks in search() and streamSearch() are identical. This duplication exists across multiple files in this PR. Consider extracting a helper function to reduce repetition and centralize the audit pattern.

♻️ Suggested helper extraction (local to this file or shared)

// Could be placed in a shared audit utilities file
const auditCodeSearch = async (user: UserWithAccounts, org: { id: number }) => {
    const source = (await headers()).get('X-Sourcebot-Client-Source') ?? undefined;
    getAuditService().createAudit({
        action: 'user.performed_code_search',
        actor: { id: user.id, type: 'user' },
        target: { id: org.id.toString(), type: 'org' },
        orgId: org.id,
        metadata: { source },
    }).catch(() => {});
};

Then in both functions:

 withOptionalAuthV2(async ({ prisma, user, org }) => {
     if (user) {
-        const source = (await headers()).get('X-Sourcebot-Client-Source') ?? undefined;
-        getAuditService().createAudit({
-            action: 'user.performed_code_search',
-            actor: { id: user.id, type: 'user' },
-            target: { id: org.id.toString(), type: 'org' },
-            orgId: org.id,
-            metadata: { source },
-        }).catch(() => {});
+        await auditCodeSearch(user, org);
     }

Also applies to: 62-71

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@packages/web/src/features/search/searchApi.ts` around lines 31 - 40, Extract
the duplicated audit logic into a helper (e.g., auditCodeSearch) and replace the
repeated blocks in search() and streamSearch() with a single call to that
helper; the helper should capture the source via (await
headers()).get('X-Sourcebot-Client-Source') ?? undefined and call
getAuditService().createAudit({ action: 'user.performed_code_search', actor: {
id: user.id, type: 'user' }, target: { id: org.id.toString(), type: 'org' },
orgId: org.id, metadata: { source } }).catch(() => {}), then invoke
auditCodeSearch(user, org) from both search() and streamSearch() to remove
duplication.

packages/web/src/ee/features/analytics/types.ts (1)

9-11: Tighten counter field validation to integer, non-negative values.

These are count metrics; enforcing .int().nonnegative() avoids silently accepting invalid payloads.

Suggested schema hardening

-  mcp_requests: z.number(),
-  api_requests: z.number(),
-  active_users: z.number(),
+  mcp_requests: z.number().int().nonnegative(),
+  api_requests: z.number().int().nonnegative(),
+  active_users: z.number().int().nonnegative(),

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@packages/web/src/ee/features/analytics/types.ts` around lines 9 - 11, The
count fields mcp_requests, api_requests, and active_users in the analytics
schema are plain z.number() and should be restricted to integer, non-negative
values; update their validators to use .int().nonnegative() on each of those
fields (locate the schema definition in types.ts where mcp_requests,
api_requests, and active_users are declared) so the schema enforces integer
non-negative counters.

packages/web/src/ee/features/analytics/analyticsContent.tsx (1)

178-178: Avoid hardcoded skeleton count drift.

Line 178 hardcodes 6; consider deriving from a shared chart-count constant to keep loading UI in sync when charts are added/removed.

Minimal refactor

+const ANALYTICS_CHART_COUNT = 6
+
 function LoadingSkeleton() {
   return (
@@
-            {[1, 2, 3, 4, 5, 6].map((chartIndex) => (
+            {Array.from({ length: ANALYTICS_CHART_COUNT }, (_, i) => i + 1).map((chartIndex) => (

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@packages/web/src/ee/features/analytics/analyticsContent.tsx` at line 178,
Replace the hardcoded array [1,2,3,4,5,6] used to render skeletons with a single
source-of-truth chart count constant (e.g., CHART_COUNT) exported from the
analytics/chart configuration or the component that defines the list of charts;
update the mapping to iterate based on that CHART_COUNT (e.g., Array.from({
length: CHART_COUNT })) so the skeleton count automatically stays in sync
whenever charts are added/removed (ensure you add or import CHART_COUNT and
replace occurrences in analyticsContent.tsx where the hardcoded six is used).

packages/web/src/ee/features/analytics/actions.ts (1)

87-87: Use an explicit API-source allowlist for api_requests.

Line 87 currently treats any non-null, non-mcp source as API. That can overcount if new source labels are introduced later (e.g., non-API internal clients). Prefer explicit allowed API source values.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@packages/web/src/ee/features/analytics/actions.ts` at line 87, The COUNT(*)
FILTER that defines api_requests currently treats any non-null/non-'mcp'
metadata->>'source' as API; change this to an explicit allowlist check against
known API source values (e.g. metadata->>'source' IN ( ... )) so only intended
sources count as api_requests, update the SQL expression that produces
api_requests accordingly, and if the allowed sources are used elsewhere consider
extracting them to a shared constant or config and adjust any tests that rely on
the previous behavior.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@CHANGELOG.md`:
- Line 11: The changelog entry mixes tenses—change the phrase "Move audit events
from client-side to service functions to capture all API calls (web UI, MCP, and
non-MCP)" to past tense (e.g., "Moved audit events from client-side to service
functions to capture all API calls (web UI, MCP, and non-MCP)") so the entire
bullet reads consistently in past tense with the rest of the entry.

---

Nitpick comments:
In `@packages/web/src/ee/features/analytics/actions.ts`:
- Line 87: The COUNT(*) FILTER that defines api_requests currently treats any
non-null/non-'mcp' metadata->>'source' as API; change this to an explicit
allowlist check against known API source values (e.g. metadata->>'source' IN (
... )) so only intended sources count as api_requests, update the SQL expression
that produces api_requests accordingly, and if the allowed sources are used
elsewhere consider extracting them to a shared constant or config and adjust any
tests that rely on the previous behavior.

In `@packages/web/src/ee/features/analytics/analyticsContent.tsx`:
- Line 178: Replace the hardcoded array [1,2,3,4,5,6] used to render skeletons
with a single source-of-truth chart count constant (e.g., CHART_COUNT) exported
from the analytics/chart configuration or the component that defines the list of
charts; update the mapping to iterate based on that CHART_COUNT (e.g.,
Array.from({ length: CHART_COUNT })) so the skeleton count automatically stays
in sync whenever charts are added/removed (ensure you add or import CHART_COUNT
and replace occurrences in analyticsContent.tsx where the hardcoded six is
used).

In `@packages/web/src/ee/features/analytics/types.ts`:
- Around line 9-11: The count fields mcp_requests, api_requests, and
active_users in the analytics schema are plain z.number() and should be
restricted to integer, non-negative values; update their validators to use
.int().nonnegative() on each of those fields (locate the schema definition in
types.ts where mcp_requests, api_requests, and active_users are declared) so the
schema enforces integer non-negative counters.

In `@packages/web/src/features/search/searchApi.ts`:
- Around line 31-40: Extract the duplicated audit logic into a helper (e.g.,
auditCodeSearch) and replace the repeated blocks in search() and streamSearch()
with a single call to that helper; the helper should capture the source via
(await headers()).get('X-Sourcebot-Client-Source') ?? undefined and call
getAuditService().createAudit({ action: 'user.performed_code_search', actor: {
id: user.id, type: 'user' }, target: { id: org.id.toString(), type: 'org' },
orgId: org.id, metadata: { source } }).catch(() => {}), then invoke
auditCodeSearch(user, org) from both search() and streamSearch() to remove
duplication.

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Reviewing files that changed from the base of the PR and between 8e0e737 and 6726cf2.

• CHANGELOG.md
• packages/web/src/app/[domain]/components/searchBar/searchBar.tsx
• packages/web/src/app/api/(server)/repos/listReposApi.ts
• packages/web/src/ee/features/analytics/actions.ts
• packages/web/src/ee/features/analytics/analyticsContent.tsx
• packages/web/src/ee/features/analytics/types.ts
• packages/web/src/ee/features/audit/types.ts
• packages/web/src/features/git/getFileSourceApi.ts
• packages/web/src/features/git/getTreeApi.ts
• packages/web/src/features/search/searchApi.ts

• packages/web/src/app/[domain]/components/searchBar/searchBar.tsx