Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions backend/dist/app.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion backend/dist/app.js.map

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion backend/dist/config/env.d.ts
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
export declare const ENV: {
PORT: number;
DB_URL: string;
NODE_ENV: "DEVELOPMENT" | "TEST" | "production";
NODE_ENV: "development" | "TEST" | "production";
JWT_SECRET: string;
};
//# sourceMappingURL=env.d.ts.map
4 changes: 2 additions & 2 deletions backend/dist/config/env.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion backend/dist/lib/socket.d.ts.map

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

17 changes: 16 additions & 1 deletion backend/dist/lib/socket.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion backend/dist/lib/socket.js.map

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 0 additions & 1 deletion backend/dist/server.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion backend/dist/server.js.map

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion backend/dist/utils/generateToken.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion backend/dist/utils/generateToken.js.map

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 2 additions & 2 deletions backend/src/app.ts
Original file line number Diff line number Diff line change
Expand Up @@ -7,14 +7,14 @@ import { errorHandler } from "./utils/errorHandler.js";
import { app } from "./lib/socket.js"

const corsOptions = {
origin: "https://sect-chat.netlify.app",
origin: process.env.NODE_ENV === "production"? ["https://sect-chat.netlify.app"] : ["http://localhost:5173"],
credentials: true
};

app.use(cors(corsOptions));
app.use(cookieParser());
app.use(express.json());
app.options("/{*path}", cors(corsOptions))
// app.options("/{*path}", cors(corsOptions))
app.use("/api/auth", authRouter);
app.use("/api/conversations", conversationRouter);
app.use(errorHandler);
Expand Down
4 changes: 2 additions & 2 deletions backend/src/config/env.ts
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,8 @@ const EnvSchema = z.object({
PORT: z.coerce.number().int().positive(),
DB_URL: z.string().min(1),
NODE_ENV: z
.enum(["DEVELOPMENT", "TEST", "production"])
.default("DEVELOPMENT"),
.enum(["development", "TEST", "production"])
.default("development"),
Comment on lines 6 to +8

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Find NODE_ENV assignments/usages and confirm whether lowercase `test` is used.
rg -n -C2 "NODE_ENV|(['\"]TEST['\"]|['\"]test['\"])"

Repository: shiv7shukla/sect

Length of output: 5644


🏁 Script executed:

#!/bin/bash
# Search for CI/CD config files
find . -type f \( -name ".github" -o -name ".gitlab-ci.yml" -o -name ".circleci" -o -name "Dockerfile*" -o -name "docker-compose*" -o -name "jest.config.*" -o -name "vitest.config.*" -o -name "mocha.config.*" -o -name ".env*" \) 2>/dev/null | head -20

Repository: shiv7shukla/sect

Length of output: 42


🏁 Script executed:

#!/bin/bash
# Look for any .github workflows
find . -type d -name ".github" 2>/dev/null && find .github -type f 2>/dev/null | head -20

Repository: shiv7shukla/sect

Length of output: 42


🏁 Script executed:

#!/bin/bash
# Check for Dockerfile and docker-compose in root and common locations
fd -t f "(Dockerfile|docker-compose)" . 2>/dev/null | head -10

Repository: shiv7shukla/sect

Length of output: 42


🏁 Script executed:

#!/bin/bash
# Search for test configs and any NODE_ENV assignments
rg -l "NODE_ENV.*test|jest|vitest|mocha" --type-list | head -20

Repository: shiv7shukla/sect

Length of output: 449


🏁 Script executed:

#!/bin/bash
# Look for .env files and environment-related files
fd -t f "^\.env" . 2>/dev/null

Repository: shiv7shukla/sect

Length of output: 42


🏁 Script executed:

#!/bin/bash
# Check package.json npm scripts
cat backend/package.json 2>/dev/null | head -20

Repository: shiv7shukla/sect

Length of output: 568


🏁 Script executed:

#!/bin/bash
# Look for any shell scripts or run scripts
fd -t f "\.(sh|bash)$" . 2>/dev/null | head -20

Repository: shiv7shukla/sect

Length of output: 42


🏁 Script executed:

#!/bin/bash
# Check if NODE_ENV is set to "TEST" (uppercase) anywhere
rg '"TEST"|'"'"'TEST'"'"'|NODE_ENV.*TEST|TEST.*NODE_ENV'

Repository: shiv7shukla/sect

Length of output: 296


Normalize NODE_ENV enum to lowercase convention; uppercase "TEST" is not used.

The enum currently defines "TEST" (uppercase) but no code checks for it—all NODE_ENV comparisons only check === "production". While the repository has no test infrastructure currently, normalizing to lowercase "test" aligns with Node.js conventions and future-proofs against typical test runner setups that would expect NODE_ENV=test.

🛠️ Proposed fix
   NODE_ENV: z
-    .enum(["development", "TEST", "production"])
+    .preprocess(
+      (value) => typeof value === "string" ? value.toLowerCase() : value,
+      z.enum(["development", "test", "production"]),
+    )
     .default("development"),
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
NODE_ENV: z
.enum(["DEVELOPMENT", "TEST", "production"])
.default("DEVELOPMENT"),
.enum(["development", "TEST", "production"])
.default("development"),
NODE_ENV: z
.preprocess(
(value) => typeof value === "string" ? value.toLowerCase() : value,
z.enum(["development", "test", "production"]),
)
.default("development"),
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@backend/src/config/env.ts` around lines 6 - 8, The NODE_ENV enum in
backend/src/config/env.ts includes an uppercase "TEST" which should be
normalized to lowercase; update the z.enum in the NODE_ENV definition to use
"test" instead of "TEST" (keep "development" and "production" and the default
"development") and scan for any places referencing "TEST" to change them to
"test" so environment checks remain consistent with Node.js conventions.

JWT_SECRET: z.string().min(1),
});

Expand Down
22 changes: 21 additions & 1 deletion backend/src/lib/socket.ts
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ const server = http.createServer(app);

const io = new Server(server, {
cors: {
origin: process.env.NODE_ENV === "production"? ["https://your-frontend.onrender.com"] : ["http://localhost:5173"],
origin: process.env.NODE_ENV === "production"? ["https://sect-chat.netlify.app"] : ["http://localhost:5173"],
credentials: true
}
});
Expand All @@ -33,6 +33,26 @@ io.on("connection", (socket) => {

socket.on("not typing", (room, senderUsername) => socket.in(room).emit("is not typing", senderUsername));

socket.on('call-user', ({ to, fromId, from, offer }) => {
socket.to(to).emit('incoming-call', { fromId, from, offer });
});

socket.on('answer-call', ({ to, answer }) => {
socket.to(to).emit('call-answered', answer);
});

socket.on('decline-call', ({ to }) => {
socket.to(to).emit('call-declined');
});

socket.on('ice-candidate', ({ to, candidate }) => {
socket.to(to).emit('ice-candidate', candidate);
});

socket.on('end-call', ({ to }) => {
socket.to(to).emit('call-ended');
});

})

export {io, app, server};
1 change: 0 additions & 1 deletion backend/src/server.ts
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,6 @@ const startServer = async () => {
await connectDB();
console.log("Mongo connected to:", mongoose.connection.name);
server.listen(PORT, () => {console.log("Backend running on port", ENV.PORT)});
console.log("NEW DEPLOY TEST");
}
catch(error){
console.error("Error starting the server", error);
Expand Down
2 changes: 1 addition & 1 deletion backend/src/utils/generateToken.ts
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ export const generateToken = (id:string, res:Response) => {
res.cookie("jwt", token, {
maxAge: 7*24*60*60*1000, //the age for cookie's lifetime must be in ms
httpOnly: true,
sameSite: "none",
sameSite: "lax",
secure: ENV.NODE_ENV === "production",
Comment on lines +11 to 12

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Read-only verification: confirm whether production is cross-site and whether cookie policy matches it.

set -e

echo "== Backend CORS origins =="
rg -n --type=ts 'origin:|credentials:' backend/src/app.ts

echo
echo "== Frontend API base URL config =="
rg -n --type=ts 'VITE_API_BASE_URL|baseURL|withCredentials' frontend/src/lib/axios.ts

echo
echo "== JWT cookie settings (set + clear) =="
rg -n --type=ts 'res\.cookie\("jwt"|sameSite|secure|httpOnly' backend/src/utils/generateToken.ts backend/src/controllers/auth.controllers.ts

echo
echo "Expected:"
echo "- If frontend domain and API domain differ by site, prefer SameSite=None + Secure in production."
echo "- If same-site, Lax can work."

Repository: shiv7shukla/sect

Length of output: 1073


sameSite: "lax" breaks JWT auth in production (cross-site deployment)

In production, frontend (https://sect-chat.netlify.app) and API are on different sites. On Line 11, sameSite: "lax" prevents the jwt cookie from being sent on credentialed XHR/fetch requests, causing auth to fail with missing token. Use sameSite: "none" + secure: true for production.

Additionally, the logout endpoint in backend/src/controllers/auth.controllers.ts (Line 34) clears the cookie with sameSite: "strict", which also fails cross-site. Apply the same fix there.

Suggested fix

In backend/src/utils/generateToken.ts:

   res.cookie("jwt", token, {
     maxAge: 7*24*60*60*1000,
     httpOnly: true,
-    sameSite: "lax",
+    sameSite: ENV.NODE_ENV === "production" ? "none" : "lax",
     secure: ENV.NODE_ENV === "production",
   })

In backend/src/controllers/auth.controllers.ts:

-  res.cookie("jwt", "", {maxAge: 0, httpOnly: true, secure: ENV.NODE_ENV === "production", sameSite: "strict"});
+  res.cookie("jwt", "", {maxAge: 0, httpOnly: true, secure: ENV.NODE_ENV === "production", sameSite: ENV.NODE_ENV === "production" ? "none" : "lax"});
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
sameSite: "lax",
secure: ENV.NODE_ENV === "production",
sameSite: ENV.NODE_ENV === "production" ? "none" : "lax",
secure: ENV.NODE_ENV === "production",
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@backend/src/utils/generateToken.ts` around lines 11 - 12, The cookie SameSite
setting prevents JWT cookies in cross-site production; update the cookie options
in generateToken (function generateToken in backend/src/utils/generateToken.ts)
to set sameSite: "none" and secure: true when ENV.NODE_ENV === "production"
(keep "lax" for non-production), and mirror that sameSite/secure behavior in the
logout cookie clearing in the logout controller (exported logout handler in
backend/src/controllers/auth.controllers.ts) so the clearCookie call uses
sameSite: "none" and secure: true in production.

})

Expand Down
4 changes: 2 additions & 2 deletions frontend/src/components/AuthForm.tsx
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
import React from 'react'
import {useForm} from "react-hook-form"
import type { SubmitHandler } from 'react-hook-form'
import type { SubmitHandler, UseFormRegister } from 'react-hook-form'
import {zodResolver} from "@hookform/resolvers/zod"
import { authStore } from '../store/useAuthStore';
import { useShallow } from 'zustand/react/shallow'
Expand Down Expand Up @@ -76,7 +76,7 @@ const AuthForm: React.FC = () => {
label={field.label}
type={field.type}
placeholder={field.placeholder}
register={register as any}
register={register as UseFormRegister<SignInData | SignUpData>}
errors={errors}
touched={!!touchedFields[field.name as keyof typeof touchedFields]}
/>
Expand Down
Loading