fix: use CF-Connecting-IP for public rate-limit keys - #542
Merged
Conversation
lilyshen0722
added a commit
that referenced
this pull request
Jul 2, 2026
…erged #542 The README pointed its real-work proof at PR #503, which was closed/reverted (the stale-base squash-merge incident). The live showcase pod ("Commonly Engineering") actually features PR #542 — Cody extending a Cloudflare-aware rate-limit fix across the auth/uploads/showcase routes, with Theo reviewing. Point both README references at #542 so the marketing claim matches the real, merged, showcase-featured exchange.
lilyshen0722
added a commit
that referenced
this pull request
Jul 2, 2026
to #542 Consistent with the README re-anchor — link a merged, live PR instead of the closed/reverted one.
samxu01
added a commit
that referenced
this pull request
Jul 2, 2026
… + button contrast (#555) * fix(showcase): resolve the showcase pod id at build + fix blue-button contrast The public "Watch a live room" CTA was dead in production — it rendered "This room isn't public" because the deployed frontend requested `/api/showcase/__SHOWCASE_POD_ID__` (the literal placeholder). Root cause: vite's `define: { 'process.env': {} }` clobbers all process.env reads, and only REACT_APP_API_URL had an explicit passthrough — REACT_APP_SHOWCASE_POD_ID did not, so V2Showcase fell back to the '__SHOWCASE_POD_ID__' sentinel. (Same trap the API_URL comment already documents.) The showcase API + pod are fine — publicRead:true, 4 members; only the client id substitution was broken. - vite.config.ts: add `'process.env.REACT_APP_SHOWCASE_POD_ID'` to `define` (the Dockerfile + CI already pass it as a build arg/env). - v2-showcase.css: `.v2-showcase__btn--primary` rendered dark-on-blue — the `.v2-root a { color: inherit }` (0,1,1) trap beat the single-class #fff rule. Re-assert with a `.v2-root` prefix (0,2,0). "Sign up to join" / "Start your own room" now compute white (verified live). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MnRCAFgjrrGZxo9VRCmCm9 * docs(readme): re-anchor the "real work" proof from reverted #503 to merged #542 The README pointed its real-work proof at PR #503, which was closed/reverted (the stale-base squash-merge incident). The live showcase pod ("Commonly Engineering") actually features PR #542 — Cody extending a Cloudflare-aware rate-limit fix across the auth/uploads/showcase routes, with Theo reviewing. Point both README references at #542 so the marketing claim matches the real, merged, showcase-featured exchange. * docs(agents): re-anchor the coding-capability example from reverted #503 to #542 Consistent with the README re-anchor — link a merged, live PR instead of the closed/reverted one. --------- Co-authored-by: Lily Shen <ls111@rice.edu> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
samxu01
added a commit
that referenced
this pull request
Jul 2, 2026
…exchange (#556) The old marketing shot was anchored to the reverted #503 story. Recaptured from the now-working public showcase (fixed in #555): the real PR #542 thread — founder flags that routes/showcase.ts still keys its rate-limiter on req.ip; Theo triages; Cody patches it (8e484cd) swapping in cloudflareIpRateLimitKeyGenerator across all three routes; Theo reviews with real depth (shared ipRateLimit.ts reduces duplication, the CJS/ESM module.exports shim is intentional) and ships it. Matches the re-anchored README/agent-docs (#542, not #503). Both copies updated (screenshots/ for README, assets/landing/ for the bundled hero). Captured from commonly.me/v2/showcase. Claude-Session: https://claude.ai/code/session_01MnRCAFgjrrGZxo9VRCmCm9 Co-authored-by: Lily Shen <ls111@rice.edu> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
lilyshen0722
added a commit
that referenced
this pull request
Jul 2, 2026
…573) - Top hero caption described the #542 coding PR, but real-engineering.png is now the GTM-deck collaboration — rewrote it to match the image. - "OpenClaw agents spawn Codex sessions via acpx_run" contradicted the Built-by- Agents section and AGENT_CODING_CAPABILITY.md — OpenClaw agents don't author code; they route coding to Cody (Codex). Fixed the orchestration highlight and the Codex runtime row to reflect that. Claude-Session: https://claude.ai/code/session_01MnRCAFgjrrGZxo9VRCmCm9 Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
CF-Connecting-IPand falls back toipKeyGenerator(req.ip)Testing
npm test -- --runInBand __tests__/unit/middleware/ipRateLimit.test.jsnpm test -- --runInBand __tests__/unit/routes/uploads.signedurl.test.jsnpm test -- --runInBand __tests__/service/uploads.signedurl.integration.test.js(fails in this environment:mongodb-memory-servercannot start becauselibcurl.so.4is missing)npm test -- --runInBand __tests__/service/auth.test.js(blocked in the same Mongo-backed harness path in this environment)