Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 9 additions & 5 deletions frontend/components/table/use-row-change-detection.ts
Original file line number Diff line number Diff line change
Expand Up @@ -53,11 +53,15 @@ export function useRowChangeDetection(rows: DatasetRow[]) {
prevRowsRef.current = nextMap;

if (newFlashes.size > 0) {
setFlashingCells((prev) => {
const merged = new Set(prev);
for (const key of newFlashes) merged.add(key);
return merged;
});
const updateTimer = setTimeout(() => {
setFlashingCells((prev) => {
const merged = new Set(prev);
for (const key of newFlashes) merged.add(key);
return merged;
});
flashTimersRef.current.delete(updateTimer);
}, 0);
flashTimersRef.current.add(updateTimer);

const timer = setTimeout(() => {
setFlashingCells((prev) => {
Expand Down
54 changes: 38 additions & 16 deletions frontend/convex/runStats.ts
Original file line number Diff line number Diff line change
@@ -1,6 +1,9 @@
import { internalMutation, internalQuery } from "./_generated/server.js";
import { v } from "convex/values";

const DEFAULT_PAGE_SIZE = 50;
const MAX_PAGE_SIZE = 200;

/**
* Insert a populate-run metrics record.
*
Expand Down Expand Up @@ -68,33 +71,52 @@ export const getByWorkflowRunId = internalQuery({
});

/**
* List all runs for a dataset, newest first.
* TODO: paginate — .collect() loads all docs into memory and will degrade
* as run history grows. Add cursor-based pagination when this is exposed
* to the frontend or run counts become large.
* List runs for a dataset, newest first.
* Cursor-based pagination keeps memory bounded as run history grows.
*/
export const listByDataset = internalQuery({
args: { datasetId: v.string() },
args: {
datasetId: v.string(),
cursor: v.optional(v.string()),
limit: v.optional(v.number()),
},
handler: async (ctx, args) => {
const runs = await ctx.db
const limit = Math.min(args.limit ?? DEFAULT_PAGE_SIZE, MAX_PAGE_SIZE);
const { page, isDone, continueCursor } = await ctx.db
.query("runStats")
.withIndex("by_dataset", (q) => q.eq("datasetId", args.datasetId))
.collect();
return runs.sort((a, b) => b.startedAt - a.startedAt);
.withIndex("by_dataset_started_at", (q) =>
q.eq("datasetId", args.datasetId),
)
.order("desc")
.paginate({
cursor: args.cursor ?? null,
numItems: limit,
});
Comment on lines +84 to +94

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Clamp and normalize numItems before calling paginate.

Line 84 and Line 110 only cap the upper bound. Passing limit <= 0 (or a fractional value) can trigger runtime failures or undefined pagination behavior.

Suggested fix
-    const limit = Math.min(args.limit ?? DEFAULT_PAGE_SIZE, MAX_PAGE_SIZE);
+    const requested = args.limit ?? DEFAULT_PAGE_SIZE;
+    const limit = Math.max(1, Math.min(Math.floor(requested), MAX_PAGE_SIZE));
@@
-    const limit = Math.min(args.limit ?? DEFAULT_PAGE_SIZE, MAX_PAGE_SIZE);
+    const requested = args.limit ?? DEFAULT_PAGE_SIZE;
+    const limit = Math.max(1, Math.min(Math.floor(requested), MAX_PAGE_SIZE));

Also applies to: 110-118

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@frontend/convex/runStats.ts` around lines 84 - 94, The current code only caps
the upper bound for args.limit but can pass zero, negative, fractional or NaN to
paginate; update the computation of limit (used before
ctx.db.query(...).paginate and the similar block around paginate at lines
~110-118) to normalize and clamp numItems to an integer in [1, MAX_PAGE_SIZE] by
coercing args.limit to a number, using Math.floor (or equivalent) and
Math.max(1, ...), then Math.min(..., MAX_PAGE_SIZE) so paginate always receives
a positive integer; reference the variables/functions limit, args.limit,
DEFAULT_PAGE_SIZE, MAX_PAGE_SIZE and the paginate call in runStats.


return { runs: page, isDone, continueCursor };
},
});

/**
* List all runs for a user, newest first.
* TODO: paginate — same concern as listByDataset above.
* List runs for a user, newest first.
*/
export const listByUser = internalQuery({
args: { userId: v.string() },
args: {
userId: v.string(),
cursor: v.optional(v.string()),
limit: v.optional(v.number()),
},
handler: async (ctx, args) => {
const runs = await ctx.db
const limit = Math.min(args.limit ?? DEFAULT_PAGE_SIZE, MAX_PAGE_SIZE);
const { page, isDone, continueCursor } = await ctx.db
.query("runStats")
.withIndex("by_user", (q) => q.eq("userId", args.userId))
.collect();
return runs.sort((a, b) => b.startedAt - a.startedAt);
.withIndex("by_user_started_at", (q) => q.eq("userId", args.userId))
.order("desc")
.paginate({
cursor: args.cursor ?? null,
numItems: limit,
});

return { runs: page, isDone, continueCursor };
},
});
2 changes: 2 additions & 0 deletions frontend/convex/schema.ts
Original file line number Diff line number Diff line change
Expand Up @@ -170,6 +170,8 @@ export default defineSchema({
rowsUpdated: v.optional(v.number()),
})
.index("by_dataset", ["datasetId"])
.index("by_dataset_started_at", ["datasetId", "startedAt"])
.index("by_user", ["userId"])
.index("by_user_started_at", ["userId", "startedAt"])
.index("by_workflow_run", ["workflowRunId"]),
});
19 changes: 15 additions & 4 deletions scripts/verify-authz.sh
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,17 @@
# bash scripts/verify-authz.sh
set -u

# Use python3 if available, fallback to python (common on Windows)
PYTHON="python3"
if ! command -v python3 &>/dev/null; then
if command -v python &>/dev/null; then
PYTHON="python"
else
echo "Error: python3 or python is required to run this script."
exit 1
fi
fi

CONVEX="${CONVEX_URL:-http://localhost:3210}"
FRONTEND="${FRONTEND_URL:-http://localhost:3500}"
FAIL=0
Expand Down Expand Up @@ -34,11 +45,11 @@ mutation() {
}

assert_success() {
python3 -c "import json,sys; d=json.load(sys.stdin); print('PASS' if d.get('status')=='success' else 'FAIL: '+d.get('errorMessage','?')[:60])"
$PYTHON -c "import json,sys; d=json.load(sys.stdin); print('PASS' if d.get('status')=='success' else 'FAIL: '+d.get('errorMessage','?')[:60])"
}
assert_error_contains() {
local needle="$1"
python3 -c "import json,sys; d=json.load(sys.stdin); print('PASS' if '$needle' in d.get('errorMessage','') else 'FAIL: '+d.get('errorMessage','?')[:80])"
$PYTHON -c "import json,sys; d=json.load(sys.stdin); print('PASS' if '$needle' in d.get('errorMessage','') else 'FAIL: '+d.get('errorMessage','?')[:80])"
}

echo "════════════════════════════════════════════════════════════════"
Expand All @@ -47,7 +58,7 @@ echo " convex=$CONVEX frontend=$FRONTEND"
echo "════════════════════════════════════════════════════════════════"

PUB_ID=$(query '{"path":"datasets:listPublic","args":{},"format":"json"}' \
| python3 -c "import json,sys; print(json.load(sys.stdin)['value'][0]['_id'])")
| $PYTHON -c "import json,sys; print(json.load(sys.stdin)['value'][0]['_id'])")
if [ -z "${PUB_ID:-}" ]; then
echo "No public dataset found. Seed curated data first (publicSeed:seedPublicDatasets)."
exit 1
Expand All @@ -65,7 +76,7 @@ section "Anonymous WRITES — must all be rejected"
run_test "anon datasets.listMine -> Not authenticated" \
"$(query '{"path":"datasets:listMine","args":{},"format":"json"}' | assert_error_contains 'Not authenticated')"
run_test "anon datasets.create -> Not authenticated" \
"$(mutation '{"path":"datasets:create","args":{"name":"x","description":"x","cadence":"daily","columns":[]},"format":"json"}' | assert_error_contains 'Not authenticated')"
"$(mutation '{"path":"datasets:create","args":{"name":"x","description":"x","refreshCadence":"daily","columns":[]},"format":"json"}' | assert_error_contains 'Not authenticated')"
run_test "anon datasets.updateStatus -> Not authenticated" \
"$(mutation "{\"path\":\"datasets:updateStatus\",\"args\":{\"id\":\"$PUB_ID\",\"status\":\"paused\"},\"format\":\"json\"}" | assert_error_contains 'Not authenticated')"
run_test "anon datasets.remove -> Not authenticated" \
Expand Down