On Apr 13, 2026, 17:28 +0100, cubic-dev-ai[bot] ***@***.***>, wrote: @cubic-dev-ai[bot] commented on this pull request. 15 issues found across 59 files Prompt for AI agents (unresolved issues) Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately. <file name="src/app/api/admin/settings/route.ts"> <violation number="1" location="src/app/api/admin/settings/route.ts:55"> P1: Unvalidated `search` keys are used as dot-path segments, enabling unintended nested/prototype writes via `updateConfig`.</violation> </file> <file name="README.md"> <violation number="1" location="README.md:39"> P2: README setup commands use `cd Vane` after cloning `Vane-MU`, causing immediate setup failure for default clone behavior.</violation> </file> <file name="src/app/api/admin/users/route.ts"> <violation number="1" location="src/app/api/admin/users/route.ts:108"> P2: PUT/DELETE admin user endpoints return success without verifying that the target user exists, allowing false-positive success responses for nonexistent IDs.</violation> </file> <file name="src/app/api/auth/setup-status/route.ts"> <violation number="1" location="src/app/api/auth/setup-status/route.ts:18"> P1: Database errors from the user-count query are swallowed, causing incorrect 200 responses instead of centralized 500 handling.</violation> </file> <file name="src/app/api/auth/register/route.ts"> <violation number="1" location="src/app/api/auth/register/route.ts:55"> P1: First-user registration is enforced with a non-atomic read-then-write flow, allowing concurrent requests to create multiple initial admin users.</violation> </file> <file name="src/app/api/uploads/route.ts"> <violation number="1" location="src/app/api/uploads/route.ts:9"> P1: Upload auth is gate-only; file storage/retrieval is global and unscoped to authenticated user, enabling potential cross-user file access.</violation> </file> <file name="src/lib/agents/search/researcher/actions/search/baseSearch.ts"> <violation number="1" location="src/lib/agents/search/researcher/actions/search/baseSearch.ts:92"> P2: Payload-sanitization logic is duplicated across multiple branches, increasing drift risk and inconsistent emitted payload shape.</violation> </file> <file name="src/lib/auth.ts"> <violation number="1" location="src/lib/auth.ts:9"> P0: JWT secret falls back to a hardcoded known value, allowing token forgery when env configuration is missing.</violation> <violation number="2" location="src/lib/auth.ts:145"> P1: RBAC uses JWT-embedded role claims without refresh/revocation, allowing stale elevated permissions after role changes.</violation> <violation number="3" location="src/lib/auth.ts:241"> P1: Session cleanup predicate is reversed and deletes active sessions instead of expired sessions.</violation> </file> <file name="src/components/admin/AdminSettingsTab.tsx"> <violation number="1" location="src/components/admin/AdminSettingsTab.tsx:98"> P2: Save remains enabled after initial settings load failure, allowing accidental overwrite with default empty value.</violation> </file> <file name="src/app/api/chat/route.ts"> <violation number="1" location="src/app/api/chat/route.ts:84"> P2: Chat existence is checked only by chatId, so a client can reuse another user’s chatId without an ownership check in multi-user mode. Scope the lookup by userId or handle mismatched ownership explicitly.</violation> </file> <file name="src/app/admin/page.tsx"> <violation number="1" location="src/app/admin/page.tsx:39"> P2: Admin page treats `!user` as loading and shows the Loader, but `useAuth` uses `user: null` to represent an unauthenticated settled state. Unauthenticated users will see an infinite spinner with no denial/redirect.</violation> </file> <file name="src/components/AuthLayout.tsx"> <violation number="1" location="src/components/AuthLayout.tsx:29"> P2: Setup-status error path is fail-open (`setupComplete=true`), which can bypass setup enforcement when status is unknown.</violation> </file> <file name="drizzle/0003_add_users_sessions.sql"> <violation number="1" location="drizzle/0003_add_users_sessions.sql:6"> P2: RBAC role is stored as unrestricted text in migration, allowing invalid role values and weakening authorization data integrity.</violation> </file> Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review. In src/lib/auth.ts: > @@ -0,0 +1,242 @@ +import bcrypt from 'bcryptjs'; +import { v4 as uuidv4 } from 'uuid'; +import { SignJWT, jwtVerify } from 'jose'; +import { eq, and, gt } from 'drizzle-orm'; +import db from '@/lib/db'; +import { users, sessions } from '@/lib/db/schema'; + +const JWT_SECRET = new TextEncoder().encode( + process.env.JWT_SECRET || 'vane-mu-secret-key-change-in-production', P0: JWT secret falls back to a hardcoded known value, allowing token forgery when env configuration is missing. Prompt for AI agents Check if this issue is valid — if so, understand the root cause and fix it. At src/lib/auth.ts, line 9: <comment>JWT secret falls back to a hardcoded known value, allowing token forgery when env configuration is missing.</comment> <file context> @@ -0,0 +1,242 @@ +import { users, sessions } from '@/lib/db/schema'; + +const JWT_SECRET = new TextEncoder().encode( + process.env.JWT_SECRET || 'vane-mu-secret-key-change-in-production', +); +const SESSION_EXPIRY_MS = 7 * 24 * 60 * 60 * 1000; // 7 days </file context> In src/app/api/admin/settings/route.ts: > + const parse = updateSettingsSchema.safeParse(body); + + if (!parse.success) { + return NextResponse.json( + { message: 'Invalid request', errors: parse.error.issues }, + { status: 400 }, + ); + } + + const data = parse.data; + if (data.search) { + const entries = Object.entries(data.search); + for (let i = 0; i < entries.length; i++) { + const k: string = entries[i][0]; + const v: string = entries[i][1]; + (configManager as any).updateConfig(`search.${k}`, v); P1: Unvalidated search keys are used as dot-path segments, enabling unintended nested/prototype writes via updateConfig. Prompt for AI agents Check if this issue is valid — if so, understand the root cause and fix it. At src/app/api/admin/settings/route.ts, line 55: <comment>Unvalidated `search` keys are used as dot-path segments, enabling unintended nested/prototype writes via `updateConfig`.</comment> <file context> @@ -0,0 +1,64 @@ + for (let i = 0; i < entries.length; i++) { + const k: string = entries[i][0]; + const v: string = entries[i][1]; + (configManager as any).updateConfig(`search.${k}`, v); + } + } </file context> In src/app/api/auth/setup-status/route.ts: > +import db from '@/lib/db'; +import { sql } from 'drizzle-orm'; +import { users } from '@/lib/db/schema'; + +export const runtime = 'nodejs'; + +export const GET = async () => { + try { + const setupComplete = configManager.isSetupComplete(); + + // Check if any users exist + let hasUsers = false; + try { + const result = await db.select({ count: sql<number>`count(*)` }).from(users); + hasUsers = result[0]?.count > 0; + } catch { P1: Database errors from the user-count query are swallowed, causing incorrect 200 responses instead of centralized 500 handling. Prompt for AI agents Check if this issue is valid — if so, understand the root cause and fix it. At src/app/api/auth/setup-status/route.ts, line 18: <comment>Database errors from the user-count query are swallowed, causing incorrect 200 responses instead of centralized 500 handling.</comment> <file context> @@ -0,0 +1,33 @@ + try { + const result = await db.select({ count: sql<number>`count(*)` }).from(users); + hasUsers = result[0]?.count > 0; + } catch { + hasUsers = false; + } </file context> In src/app/api/auth/register/route.ts: > + return NextResponse.json( + { message: 'Registration is disabled. Please contact your administrator.' }, + { status: 403 }, + ); + } + + // Check if username already taken + const existing = await getUserByUsername(username); + if (existing) { + return NextResponse.json( + { message: 'Username already exists' }, + { status: 409 }, + ); + } + + const user = await createUser(username, password, 'admin'); P1: First-user registration is enforced with a non-atomic read-then-write flow, allowing concurrent requests to create multiple initial admin users. Prompt for AI agents Check if this issue is valid — if so, understand the root cause and fix it. At src/app/api/auth/register/route.ts, line 55: <comment>First-user registration is enforced with a non-atomic read-then-write flow, allowing concurrent requests to create multiple initial admin users.</comment> <file context> @@ -0,0 +1,65 @@ + ); + } + + const user = await createUser(username, password, 'admin'); + + return NextResponse.json({ user }, { status: 201 }); </file context> In src/app/api/uploads/route.ts: > try { + const auth = await requireAuth(req); + if (!auth.success) return auth.error; P1: Upload auth is gate-only; file storage/retrieval is global and unscoped to authenticated user, enabling potential cross-user file access. Prompt for AI agents Check if this issue is valid — if so, understand the root cause and fix it. At src/app/api/uploads/route.ts, line 9: <comment>Upload auth is gate-only; file storage/retrieval is global and unscoped to authenticated user, enabling potential cross-user file access.</comment> <file context> @@ -1,9 +1,13 @@ +export async function POST(req: NextRequest) { try { + const auth = await requireAuth(req); + if (!auth.success) return auth.error; + const formData = await req.formData(); </file context> In src/lib/auth.ts: > + + if (!fullUser) return { success: false, error: 'User not found' }; + + const valid = await verifyPassword(currentPassword, fullUser.passwordHash); + if (!valid) return { success: false, error: 'Current password is incorrect' }; + + const passwordHash = await hashPassword(newPassword); + await db.update(users).set({ passwordHash }).where(eq(users.id, userId)); + + return { success: true }; +} + +// Clean up expired sessions (call periodically) +export async function cleanupExpiredSessions(): Promise<void> { + const now = new Date().toISOString(); + await db.delete(sessions).where(gt(sessions.expiresAt, now)); P1: Session cleanup predicate is reversed and deletes active sessions instead of expired sessions. Prompt for AI agents Check if this issue is valid — if so, understand the root cause and fix it. At src/lib/auth.ts, line 241: <comment>Session cleanup predicate is reversed and deletes active sessions instead of expired sessions.</comment> <file context> @@ -0,0 +1,242 @@ +// Clean up expired sessions (call periodically) +export async function cleanupExpiredSessions(): Promise<void> { + const now = new Date().toISOString(); + await db.delete(sessions).where(gt(sessions.expiresAt, now)); +} </file context> In src/lib/auth.ts: > + + // Check session exists and not expired + const session = await db.query.sessions.findFirst({ + where: and( + eq(sessions.id, sessionId), + eq(sessions.userId, userId), + gt(sessions.expiresAt, new Date().toISOString()), + ), + }); + + if (!session) return null; + + return { + id: userId, + username: payload.username as string, + role: payload.role as UserRole, P1: RBAC uses JWT-embedded role claims without refresh/revocation, allowing stale elevated permissions after role changes. Prompt for AI agents Check if this issue is valid — if so, understand the root cause and fix it. At src/lib/auth.ts, line 145: <comment>RBAC uses JWT-embedded role claims without refresh/revocation, allowing stale elevated permissions after role changes.</comment> <file context> @@ -0,0 +1,242 @@ + return { + id: userId, + username: payload.username as string, + role: payload.role as UserRole, + sessionId, + }; </file context> In README.md: > - <td width="100" align="center"> - <a href="https://dashboard.exa.ai" target="_blank"> - <img src=".assets/sponsers/exa.png" alt="Exa" width="80" height="80" style="border-radius: .75rem;" /> - </a> - </td> - <td> - <a href="https://dashboard.exa.ai">Exa</a> • The Perfect Web Search API for LLMs - web search, crawling, deep research, and answer APIs - </td> - </tr> -</table> - -## Installation +```bash +# Clone the repository +git clone https://github.com/stanleyau-xx/Vane-MU.git +cd Vane P2: README setup commands use cd Vane after cloning Vane-MU, causing immediate setup failure for default clone behavior. Prompt for AI agents Check if this issue is valid — if so, understand the root cause and fix it. At README.md, line 39: <comment>README setup commands use `cd Vane` after cloning `Vane-MU`, causing immediate setup failure for default clone behavior.</comment> <file context> @@ -1,266 +1,151 @@ +```bash +# Clone the repository +git clone https://github.com/stanleyau-xx/Vane-MU.git +cd Vane -There are mainly 2 ways of installing Vane - With Docker, Without Docker. Using Docker is highly recommended. </file context> ⬇️ Suggested change -cd Vane +cd Vane-MU In src/app/api/admin/users/route.ts: > + const parse = updateUserSchema.safeParse(body); + + if (!parse.success) { + return NextResponse.json( + { message: 'Invalid request', errors: parse.error.issues }, + { status: 400 }, + ); + } + + if (!parse.data.username && !parse.data.role) { + return NextResponse.json({ message: 'No fields to update' }, { status: 400 }); + } + + await updateUser(userId, parse.data); + + return NextResponse.json({ message: 'User updated successfully' }); P2: PUT/DELETE admin user endpoints return success without verifying that the target user exists, allowing false-positive success responses for nonexistent IDs. Prompt for AI agents Check if this issue is valid — if so, understand the root cause and fix it. At src/app/api/admin/users/route.ts, line 108: <comment>PUT/DELETE admin user endpoints return success without verifying that the target user exists, allowing false-positive success responses for nonexistent IDs.</comment> <file context> @@ -0,0 +1,141 @@ + + await updateUser(userId, parse.data); + + return NextResponse.json({ message: 'User updated successfully' }); + } catch (err: any) { + console.error('Admin update user error:', err); </file context> In src/lib/agents/search/researcher/actions/search/baseSearch.ts: > @@ -88,13 +88,19 @@ export const executeSearch = async (input: { results.push(...resultChunks); P2: Payload-sanitization logic is duplicated across multiple branches, increasing drift risk and inconsistent emitted payload shape. Prompt for AI agents Check if this issue is valid — if so, understand the root cause and fix it. At src/lib/agents/search/researcher/actions/search/baseSearch.ts, line 92: <comment>Payload-sanitization logic is duplicated across multiple branches, increasing drift risk and inconsistent emitted payload shape.</comment> <file context> @@ -88,13 +88,19 @@ export const executeSearch = async (input: { } + // Strip embeddings before sending to SSE to avoid huge payloads + const cleanResultChunks = resultChunks.map((chunk) => { + const { embedding, ...rest } = chunk.metadata; + return { ...chunk, metadata: { ...rest } }; </file context> In src/components/admin/AdminSettingsTab.tsx: > + </label> + <input + type="url" + value={searxngURL} + onChange={(e) => setSearxngURL(e.target.value)} + className="w-full px-3 py-2 rounded-lg bg-light-primary dark:bg-dark-primary border border-light-200 dark:border-dark-200 text-black dark:text-white text-sm" + placeholder="http://localhost:4000" + /> + <p className="text-xs text-black/50 dark:text-white/50 mt-1"> + Leave empty to disable SearXNG search + </p> + </div> + + <button + type="submit" + disabled={saving} P2: Save remains enabled after initial settings load failure, allowing accidental overwrite with default empty value. Prompt for AI agents Check if this issue is valid — if so, understand the root cause and fix it. At src/components/admin/AdminSettingsTab.tsx, line 98: <comment>Save remains enabled after initial settings load failure, allowing accidental overwrite with default empty value.</comment> <file context> @@ -0,0 +1,149 @@ + + <button + type="submit" + disabled={saving} + className="px-4 py-2 rounded-lg bg-[#24A0ED] text-white text-sm hover:bg-[#1e8fd1] disabled:opacity-60 transition-colors" + > </file context> In src/app/api/chat/route.ts: > sources: SearchSources[]; query: string; fileIds: string[]; }) => { try { - const exists = await db.query.chats - .findFirst({ - where: eq(chats.id, input.id), - }) - .execute(); + const [exists] = await db + .select() + .from(chats) + .where(eq(chats.id, input.id)) P2: Chat existence is checked only by chatId, so a client can reuse another user’s chatId without an ownership check in multi-user mode. Scope the lookup by userId or handle mismatched ownership explicitly. Prompt for AI agents Check if this issue is valid — if so, understand the root cause and fix it. At src/app/api/chat/route.ts, line 84: <comment>Chat existence is checked only by chatId, so a client can reuse another user’s chatId without an ownership check in multi-user mode. Scope the lookup by userId or handle mismatched ownership explicitly.</comment> <file context> @@ -70,20 +72,22 @@ const safeValidateBody = (data: unknown) => { + const [exists] = await db + .select() + .from(chats) + .where(eq(chats.id, input.id)) + .limit(1); </file context> In src/app/admin/page.tsx: > + Access Denied + </h1> + <p className="text-black/60 dark:text-white/60"> + You do not have permission to access this page. + </p> + <a + href="/" + className="mt-4 px-4 py-2 rounded-lg bg-[#24A0ED] text-white text-sm hover:bg-[#1e8fd1] transition-colors" + > + Go Home + </a> + </div> + ); + } + + if (!user) { P2: Admin page treats !user as loading and shows the Loader, but useAuth uses user: null to represent an unauthenticated settled state. Unauthenticated users will see an infinite spinner with no denial/redirect. Prompt for AI agents Check if this issue is valid — if so, understand the root cause and fix it. At src/app/admin/page.tsx, line 39: <comment>Admin page treats `!user` as loading and shows the Loader, but `useAuth` uses `user: null` to represent an unauthenticated settled state. Unauthenticated users will see an infinite spinner with no denial/redirect.</comment> <file context> @@ -0,0 +1,85 @@ + ); + } + + if (!user) { + return ( + <div className="flex items-center justify-center min-h-screen"> </file context> In src/components/AuthLayout.tsx: > +}: { + children: React.ReactNode; +}) { + const { user, loading } = useAuth(); + const pathname = usePathname(); + const [setupComplete, setSetupComplete] = useState<boolean | null>(null); + + const isAuthRoute = pathname?.startsWith('/login'); + const isSetupRoute = pathname?.startsWith('/setup'); + + useEffect(() => { + // Check if setup is complete + fetch('/api/auth/setup-status') + .then((r) => r.json()) + .then((d) => setSetupComplete(d.setupComplete)) + .catch(() => setSetupComplete(true)); P2: Setup-status error path is fail-open (setupComplete=true), which can bypass setup enforcement when status is unknown. Prompt for AI agents Check if this issue is valid — if so, understand the root cause and fix it. At src/components/AuthLayout.tsx, line 29: <comment>Setup-status error path is fail-open (`setupComplete=true`), which can bypass setup enforcement when status is unknown.</comment> <file context> @@ -0,0 +1,56 @@ + fetch('/api/auth/setup-status') + .then((r) => r.json()) + .then((d) => setSetupComplete(d.setupComplete)) + .catch(() => setSetupComplete(true)); + }, []); + </file context> In drizzle/0003_add_users_sessions.sql: > @@ -0,0 +1,15 @@ +-- Migration: Add users and sessions tables for multi-user auth +CREATE TABLE IF NOT EXISTS `users` ( + `id` text PRIMARY KEY NOT NULL, + `username` text NOT NULL UNIQUE, + `password_hash` text NOT NULL, + `role` text DEFAULT 'user' NOT NULL, P2: RBAC role is stored as unrestricted text in migration, allowing invalid role values and weakening authorization data integrity. Prompt for AI agents Check if this issue is valid — if so, understand the root cause and fix it. At drizzle/0003_add_users_sessions.sql, line 6: <comment>RBAC role is stored as unrestricted text in migration, allowing invalid role values and weakening authorization data integrity.</comment> <file context> @@ -0,0 +1,15 @@ + `id` text PRIMARY KEY NOT NULL, + `username` text NOT NULL UNIQUE, + `password_hash` text NOT NULL, + `role` text DEFAULT 'user' NOT NULL, + `createdAt` text NOT NULL +); </file context> — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you authored the thread.Message ID: ***@***.***>