fix(auth): tolerate unreadable dashboard fingerprints at startup

[FindMalek]

An unreadable dashboard fingerprint response can abort API startup before the existing warning path runs. Treat invalid JSON as an unavailable fingerprint, preserving the runtime object/string checks and the fatal rejection of a confirmed secret mismatch. Keep the existing synchronous API startup error output.

Validation: 11 isolated tests exercise the real auth guard and fingerprint endpoint, covering malformed JSON, invalid payloads, unreachable/non-OK responses, matching and mismatched secrets, and self-hosted/development skips. The main-source baseline reproduces the malformed-JSON failure; a mutation that bypasses mismatch rejection fails the relevant test. bun run lint and bun run check-types passed.

AI disclosure: Codex assisted the maintainer cleanup, review and regression tests.

Summary by CodeRabbit

• Bug Fixes
  • Authentication checks now handle unreadable dashboard responses without failing unexpectedly.
• Tests
  • Added coverage for matching and mismatched secrets, invalid or missing responses, request failures, and configurations that skip the dashboard check.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
documentation	Skipped		Oct 9, 2026 1:21pm UTC

[vercel]

@FindMalek is attempting to deploy a commit to the Databuddy OSS Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: d8ca3860-e3fe-4ff7-9058-8a7615819e0d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 52a6d6fc-2d5e-4154-983a-89654f5d09bd

📥 Commits

Reviewing files that changed from the base of the PR and between 5a81411 and 2099347.

📒 Files selected for processing (2)

• packages/auth/src/auth-secret-fingerprint.test.ts
• packages/auth/src/auth.ts

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 3 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (2)

• GitHub Check: Greptile Review
• GitHub Check: Test

⚠️ CI failures not shown inline (2)

Commit Status: Vercel – dashboard: Vercel – dashboard

Conclusion: failure

Authorization required to deploy.

Commit Status: Vercel – databuddy-status: Vercel – databuddy-status

Conclusion: failure

Authorization required to deploy.

🧰 Additional context used

📚 Code guidelines (3)

.cursor/rules/performance.mdc — auto-discovered
.cursor/rules/ui-guidelines.mdc — auto-discovered
.cursor/rules/01-MUST-DO.mdc — auto-discovered

📓 Path-based instructions (3)

Source excerpt: When you discover a new performance improvement, optimization pattern, or fix a performance regression, add a concise bullet to the relevant section below in the same session.

📄 CodeRabbit inference engine (.cursor/rules/performance.mdc)

Files:

• packages/auth/src/auth.ts
• packages/auth/src/auth-secret-fingerprint.test.ts

Source excerpt: MUST use Tailwind CSS defaults unless custom values already exist or are explicitly requested Source excerpt: MUST use motion/react (formerly framer-motion) when JavaScript animation is required Source excerpt: SHOULD use tw...

📄 CodeRabbit inference engine (.cursor/rules/ui-guidelines.mdc)

Files:

• packages/auth/src/auth.ts
• packages/auth/src/auth-secret-fingerprint.test.ts

Source excerpt: description: Basic guidelines for the project so vibe coders don't fuck it up globs: alwaysApply: true when using 'text-right', always add 'text-balance' so its not ugly Source excerpt: description: Basic guidelines for the...

📄 CodeRabbit inference engine (.cursor/rules/01-MUST-DO.mdc)

Files:

• packages/auth/src/auth.ts
• packages/auth/src/auth-secret-fingerprint.test.ts

🪛 Betterleaks (1.8.1)

packages/auth/src/auth-secret-fingerprint.test.ts

[high] 40-40: Detected a password embedded in a service connection URI, which may expose direct access to the referenced service.

(generic-credential-uri)

🔇 Additional comments (3)

packages/auth/src/auth-secret-fingerprint.test.ts (2)

40-40: Credential-like URI is a synthetic test value. No change is needed.

The Betterleaks hint flags postgres://test:test@127.0.0.1:1/test. The host is a loopback address on an unusable port. The credentials are dummy values and grant no access. Do not change correct code solely to silence this diagnostic.

1-95: LGTM!

packages/auth/src/auth.ts (1)

1391-1393: LGTM!

Walkthrough

The dashboard auth-secret check now treats a rejected response-body JSON parse as a missing body. New tests cover malformed responses, fetch failures, secret matches and mismatches, and configurations that skip the request.

Changes

Dashboard auth-secret check

Layer / File(s)	Summary
Fingerprint response handling packages/auth/src/auth.ts, packages/auth/src/auth-secret-fingerprint.test.ts	A rejected JSON parse now produces a missing body. Tests check invalid responses, fetch failures, matching and mismatched secrets, and skipped requests in isolated processes.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: izadoesdev

Merge Risk: ⚪ Minimal · up to 20993

Startup no longer fails when the dashboard fingerprint response contains invalid JSON, and a confirmed secret mismatch is still rejected. The new tests cover the main scenarios. No merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: auth startup now tolerates unreadable dashboard fingerprints.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; unreadable responses warn, while confirmed mismatches still reject.

Summary

Dashboard fingerprint responses that cannot be read as JSON now use the existing warning path instead of stopping API startup.

• Unreadable dashboard replies no longer interrupt the API's startup check.

_{Reviews (3) · Last reviewed commit: "test(auth): keep only the fingerprint sc..." · Reviewed by Greptile}

[izadoesdev]

@coderabbitai full review

Please review the complete final two-file auth slice on 2099347 against main, including the real-function regression tests. The existing runtime shape validation, confirmed mismatch rejection and synchronous fatal API logging are preserved.

[izadoesdev]

@greptile-apps review

Please review the final two-file slice on 2099347 against main. Both earlier findings are fixed: the API structured-log change is removed and 11 real-function regressions cover malformed responses, secret mismatch rejection and skipped environments.

[coderabbitai]

✅ Action performed

Full review finished.

[izadoesdev]

Final-head review dispositions for 2099347:

• Both original inline findings are fixed and resolved, including their outdated threads. API startup logging is identical to main, and all 11 real-function auth regressions pass.
• The synthetic credential scanner hint is already correctly dismissed by CodeRabbit: fixtures refer only to inert loopback services and do not grant access. No private account credentials were read or included.
• Declining the generic docstring percentage warning: this slice changes one JSON parsing branch in the existing guard and adds behavioral regression coverage; its runtime checks and warning/error paths express the contract. Adding a docstring solely to satisfy the percentage would add commentary without clarifying this small change.
• Greptile’s summary has an inconsistent “No” label beside its mismatch check, while its explanation and diagram correctly describe rejection. The final source still throws for a readable mismatched string, and the mismatch-bypass mutation fails the test. Its final review reports no outstanding finding.
• Native CI is green, including hosted 54 and self-hosted 14 Playwright tests. Vercel dashboard/status previews separately require Databuddy OSS team authorization for this contributor-fork commit; those failed statuses have not been overridden.

[FindMalek]

merged main into this branch to clear the behind-main status, no changes to the reviewed files (apps/api/src/index.ts, packages/auth/src/auth.ts, packages/auth/src/auth-secret-fingerprint.test.ts are untouched by the merge). just picking up unrelated upstream commits so this can merge cleanly whenever you're ready.

[FindMalek]

@izadoesdev ready whenever, cant add you as reviewer myself (no write access). only red checks are the vercel preview auths you already flagged