Skip to content

chore(scripts): drop internal tracker refs from comments and docstrings - #213

Merged
sparkyfen merged 2 commits into
mainfrom
chore/scrub-internal-finding-refs
Jul 30, 2026
Merged

sparkyfen merged 2 commits into
mainfrom
chore/scrub-internal-finding-refs

Conversation

@sparkyfen

@sparkyfen sparkyfen commented Jul 28, 2026

Copy link
Copy Markdown
Contributor

Comment-only cleanup of the setup/provisioning scripts.

What

Sixteen comments across eight files carried an internal issue identifier that is meaningless outside the project. Two module docstrings also described endpoint behaviour in more operational detail than a fork operator reading the setup scripts needs.

Both replaced with plain descriptions of what the code does. The genuinely useful engineering notes are untouched — the cf.colo.id requirement and its API error code, the Free-plan mitigation_timeout constraint, the widget name-plus-host matching rationale, the idempotency and token-handling notes all stay exactly as they were.

Why

This repo is public and every fork operator syncs it, so these comments ship to everyone. Neither category earns its place in a template other people run.

Scope

file comments
scripts/setup.ts 7
scripts/turnstile-lib.ts 2
src/csp-config.test.ts 2
scripts/waf-lib.ts, scripts/apply-download-ratelimit.ts, scripts/turnstile-lib.test.ts, src/hooks.server.test.ts, src/turnstile-deploy-sync.test.ts 1 each

Comment-only apart from three describe() labels, which are test names rather than logic. No behaviour change, no control flow touched.

git diff filtered to non-comment lines returns only those three labels.

Verification

  • 1113 tests pass, 99 files
  • npm run check — 0 errors

Note

I ran prettier over these files at one point, which reformatted them wholesale to its defaults — this repo has no prettier config or format script, so that was wrong. Reset and redone as targeted edits; the diff here is only the intended change.

Summary by CodeRabbit

  • Documentation

    • Clarified setup guidance for custom-domain preflight checks and how download rate-limit status is reported.
    • Refined Turnstile and admin-login enforcement descriptions, emphasizing conditional behavior and server-only secrets.
    • Shortened Cloudflare WAF rate-limit documentation for the download-metrics beacon.
    • Removed internal security-finding identifiers from technical comments.
  • Tests

    • Updated Vitest suite names and related comments for clearer, consistent security coverage.
    • No test logic or assertions changed.

Sixteen comments across eight files carried an internal issue identifier that
means nothing outside the project, and two module docstrings characterised
endpoint behaviour in more operational detail than a fork operator reading the
setup scripts needs.

This repo is public and every fork operator syncs it, so both are worth not
shipping. Replaced with plain descriptions of what the code does.

Comment-only apart from three describe() labels. No behaviour change, no
control flow touched. 1113 tests pass, check reports 0 errors.
@sparkyfen sparkyfen added the documentation Improvements or additions to documentation label Jul 28, 2026
@coderabbitai

coderabbitai Bot commented Jul 28, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: abdb05cd-4ff1-4067-8711-fd92011c0c6f

📥 Commits

Reviewing files that changed from the base of the PR and between a8c031d and da28c4a.

📒 Files selected for processing (1)
  • scripts/setup.ts
🚧 Files skipped from review as they are similar to previous changes (1)
  • scripts/setup.ts

📝 Walkthrough

Walkthrough

Documentation comments and test suite labels were updated across rate limiting, Turnstile, CSP, and security-header coverage. No runtime logic, API behavior, assertions, or exported interfaces changed.

Changes

Documentation and test label cleanup

Layer / File(s) Summary
Setup status documentation
scripts/setup.ts
Comments clarify rate-limit status handling, Turnstile scope expectations, server-only secrets, and next-step reporting.
Turnstile documentation
scripts/turnstile-lib.ts, scripts/turnstile-lib.test.ts
Turnstile provisioning and wrong-domain failure comments were reworded.
Security labels and WAF documentation
scripts/apply-download-ratelimit.ts, scripts/waf-lib.ts, src/csp-config.test.ts, src/hooks.server.test.ts, src/turnstile-deploy-sync.test.ts
WAF documentation and security-focused test labels no longer use finding or fork-specific suffixes.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately summarizes the main change: removing internal tracker references from comments and docstrings in scripts and tests.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch chore/scrub-internal-finding-refs

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Biome (2.5.5)
scripts/setup.ts

File contains syntax errors that prevent linting: Line 656: expected } but instead the file ends


Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/setup.ts`:
- Around line 620-621: Update the comment describing the download-beacon
rate-limit result near the preflight logic to define null as “not attempted”
when there is no domain, no zone, or no token, matching the contract established
around the preflight handling. Keep the existing “error” token-scope explanation
unchanged.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 3851134c-b09e-47cf-843b-c3252a0b4154

📥 Commits

Reviewing files that changed from the base of the PR and between 7942cb4 and a8c031d.

📒 Files selected for processing (8)
  • scripts/apply-download-ratelimit.ts
  • scripts/setup.ts
  • scripts/turnstile-lib.test.ts
  • scripts/turnstile-lib.ts
  • scripts/waf-lib.ts
  • src/csp-config.test.ts
  • src/hooks.server.test.ts
  • src/turnstile-deploy-sync.test.ts

Comment thread scripts/setup.ts Outdated
The declaration defines null as not-attempted for no domain, no zone or no
token; the Next-steps comment named only the no-zone case, which could read
as though a missing domain or token were a token-scope failure.
@sparkyfen
sparkyfen merged commit cd8ab16 into main Jul 30, 2026
4 checks passed
@sparkyfen
sparkyfen deleted the chore/scrub-internal-finding-refs branch July 30, 2026 22:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

documentation Improvements or additions to documentation

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant