Report marketplace download via TemplateMarket edge function#142
Conversation
WalkthroughThe marketplace download reporting function is refactored to use a fixed HTTP endpoint and simplified JSON body contract. The function signature is simplified by removing the ChangesMarketplace Download Reporting
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Greptile SummaryThis PR refactors
Confidence Score: 5/5Safe to merge — straightforward endpoint swap with no auth secrets in the CLI, a bounded timeout preventing process hangs, and all 9 existing tests passing. The production code path is clean: the endpoint is a constant (env-overridable), the request body is well-formed, errors are swallowed as intended, and the new AbortSignal.timeout closes a real hang risk. The only gap is a test-environment fragility where the URL assertion breaks if INSFORGE_MARKETPLACE_REPORT_URL is set before the module is imported, and the env-override path has no test coverage — neither affects runtime behaviour. No files require special attention for merging. The test file's hardcoded URL assumption is worth addressing in a follow-up. Important Files Changed
Sequence DiagramsequenceDiagram
participant CLI as CLI (create command)
participant GH as GitHub (template repo)
participant TM as TemplateMarket edge fn<br/>(report-download)
participant DB as TemplateMarket DB<br/>(template_downloads)
CLI->>GH: downloadGitHubTemplate(slug)
GH-->>CLI: downloaded: true/false
alt "downloaded === true"
CLI-)TM: "void POST /functions/report-download<br/>{ slug } — fire-and-forget (5 s timeout)"
TM->>DB: increment_template_download(slug)
DB-->>TM: "{ count }"
TM-->>CLI: "200 { count }"
end
Reviews (3): Last reviewed commit: "fix(cli): bound marketplace download fet..." | Re-trigger Greptile |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/commands/create.ts`:
- Around line 750-756: The fetch in reportMarketplaceDownload currently has no
timeout and can hang; update the fetch call that posts to MARKETPLACE_REPORT_URL
inside reportMarketplaceDownload to include a bounded abort signal by adding
signal: AbortSignal.timeout(3000) to the options object passed to fetch so the
request is aborted after 3s; keep the existing try/catch so the abort error is
handled similarly to other failures.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: b37d67db-61c9-45b4-8c45-6ffccf5f2dc2
📒 Files selected for processing (2)
src/commands/create.marketplace.test.tssrc/commands/create.ts
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 2 files
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
jwfing
left a comment
jwfing
left a comment
There was a problem hiding this comment.
Code Review — #142
Summary: Small, focused PR that redirects marketplace download reporting from the per-user cloud-backend to a fixed TemplateMarket edge function, dropping apiUrl, sending {slug} in the JSON body, and adding a 5-second abort timeout to prevent CLI hangs.
Requirements context
No /docs/superpowers/ directory exists in this repo. Review is assessed against the PR description alone. The stated goals are: (1) POST {slug} to the fixed TemplateMarket edge function URL, (2) drop the apiUrl parameter, (3) add an env override, (4) add a 5 s timeout. All four are implemented.
Findings
Critical
(none)
Suggestion
[Software Engineering] No test coverage for AbortSignal.timeout being wired
src/commands/create.marketplace.test.ts:28-33
The happy-path test uses toMatchObject which does a partial match — it verifies method, headers, and body but not signal. The 5-second timeout is the PR's primary guard against the CLI hanging when the endpoint is unreachable (the PR description explicitly calls this out). It would be worth asserting something like:
expect(init.signal).toBeInstanceOf(AbortSignal);in the existing happy-path case, so a future refactor that accidentally drops the signal doesn't go unnoticed.
Information
[Software Engineering] MARKETPLACE_REPORT_URL is read once at module load time
src/commands/create.ts:741-743
const MARKETPLACE_REPORT_URL =
process.env.INSFORGE_MARKETPLACE_REPORT_URL ??
'https://p8n7m7ci.us-east.insforge.app/functions/report-download';process.env.INSFORGE_MARKETPLACE_REPORT_URL is snapshotted when the module is first imported. The existing tests correctly stub fetch rather than the env var, so this is fine today. Future test authors who try to override the env var after import will be surprised — a one-liner comment like // read once at import; stub fetch (not this const) in tests would save them the head-scratch.
[Security] No new concerns
The slug passes through SAFE_MARKETPLACE_SLUG (/^[a-z0-9][a-z0-9-]{0,99}$/) at action entry — before auth and well before this function is called. JSON.stringify gives natural escaping in the body. No anon key is shipped; auth is handled inside the edge function. No new dependencies.
[Performance] No new concerns
Fire-and-forget (void-awaited), single HTTP call, 5 s hard ceiling — no event-loop blocking, no N+1.
Verdict
approved (informational — human approval still required via the GitHub approve flow)
No Critical findings. The one Suggestion (testing the AbortSignal wiring) is worth a follow-up but does not block merge. The implementation is clean, well-scoped, and the test suite correctly captures the behavioral contract.
2 participants
Summary
reportMarketplaceDownloadnow POSTs{slug}tohttps://p8n7m7ci.us-east.insforge.app/functions/report-download(TemplateMarket project's new public proxy) instead of${apiUrl}/templates/v1/<slug>/downloadson cloud-backend.apiUrlparameter — marketplace is single-tenant so the URL is a constant, not derived from the per-user backend host.increment_template_downloadRPC with the auto-injectedAPI_KEY, so the CLI ships no anon key.insforge-templatesis being repointed in Point sync workflow at TemplateMarket edge function insforge-templates#46. Cloud-backend'stemplate.controller.ts+ migration 073 will drop in a follow-up.Test plan
npx vitest run src/commands/create.marketplace.test.ts— 9/9 passnpx @insforge/cli create test-project --marketplace e-commerceand confirmtemplate_downloads.countincrements by 1 in the TemplateMarket project (verified out-of-band:POST /functions/report-download {"slug":"e-commerce"}returned{count:2}and DB row showscount=2).Backend status (already live)
c6366c10-…): tables, 4 RPCs,sync-templates+report-downloadedge functions all deployed.report-downloadsmoke-tested: existing slug 200/count, unknown slug 200/{count:0,unknown:true}, bad format 400, GET 405.Summary by cubic
Report marketplace downloads via the TemplateMarket edge function. Removes
apiUrl, sends{slug}to a fixed URL (overridable viaINSFORGE_MARKETPLACE_REPORT_URL), and bounds the request to 5s to avoid hangs.{slug}as JSON tohttps://p8n7m7ci.us-east.insforge.app/functions/report-download; override viaINSFORGE_MARKETPLACE_REPORT_URL.apiUrlfromreportMarketplaceDownloadand its call site.AbortSignal.timeoutto prevent the CLI from hanging when the endpoint is unreachable.Written for commit 3c2a947. Summary will update on new commits. Review in cubic
Summary by CodeRabbit
Refactor
Tests
Note
Report marketplace downloads via a fixed TemplateMarket edge function endpoint
reportMarketplaceDownloadin create.ts to POST the templateslugas JSON to a fixed endpoint instead of deriving the URL fromapiUrl.MARKETPLACE_REPORT_URLconstant defaulting tohttps://p8n7m7ci.us-east.insforge.app/functions/report-download, overridable viaINSFORGE_MARKETPLACE_REPORT_URL.AbortSignal.timeoutto bound request duration; network errors and non-2xx responses continue to be swallowed.apiUrltoreportMarketplaceDownload; the endpoint is always resolved internally.Macroscope summarized 3c2a947.