You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The public devices list API previously had no way to filter or sort by updated_at, so callers had to page through every device and filter client-side. That is inefficient for apps with many devices.
Business Impact (AI generated)
Makes the public devices API usable for incremental sync and monitoring workflows, reducing API traffic and improving integration efficiency for customers building on Capgo.
Test Plan (AI generated)
Unit tests for CF/SB updated_at_gt filter and updated_at ordering
Integration tests for GET /device?updated_at=... and GET /device?order=desc
Integration tests reject invalid updated_at and order values with 400
Verify in CI that device tests pass on both Supabase and Cloudflare paths where applicable
Usage examples
# Devices updated after a timestamp
curl -H "authorization: <apikey>" \
"https://api.capgo.app/device?app_id=com.example.app&updated_at=2026-01-01T00:00:00.000Z"# Newest devices first
curl -H "authorization: <apikey>" \
"https://api.capgo.app/device?app_id=com.example.app&order=desc"
Your recent review volume is higher than typical usage, so adaptive limits are currently applied.
Next review available in:23 minutes
Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).
How can I continue?
After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.
To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.
How do review limits work?
CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.
For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.
Reviewing files that changed from the base of the PR and between 705dc2f and 075570d.
📒 Files selected for processing (4)
supabase/functions/_backend/public/device/get.ts
supabase/functions/_backend/utils/cloudflare.ts
tests/cloudflare-device-pagination.unit.test.ts
tests/device.test.ts
📝 Walkthrough
Walkthrough
The device API now supports validated incremental filtering, sorting, and limits across Cloudflare and Supabase queries. Tests cover these behaviors and invalid inputs. Builtin app versions explicitly set created_by_apikey_rbac_id to null.
Changes
Device listing enhancements
Layer / File(s)
Summary
Device request validation and query wiring supabase/functions/_backend/utils/types.ts, supabase/functions/_backend/public/device/get.ts
The endpoint validates updated_at, order, and limit, then passes normalized values to readDevices.
Cap-go/capgo.app#2698: Updates the schema and migration handling for app_versions.created_by_apikey_rbac_id, which this change explicitly sets for builtin versions.
Suggested reviewers:dalanir
🚥 Pre-merge checks | ✅ 4 | ❌ 1
❌ Failed checks (1 warning)
Check name
Status
Explanation
Resolution
Out of Scope Changes check
⚠️ Warning
src/services/versions.ts changes a builtin version field unrelated to the updated_at device API work.
Remove or justify the builtin version field change, or split it into a separate PR if it is intentional.
✅ Passed checks (4 passed)
Check name
Status
Explanation
Title check
✅ Passed
The title clearly summarizes the main change: adding updated_at filtering and sorting to GET /device.
Description check
✅ Passed
The description covers summary, motivation, impact, tests, and usage examples, but it omits the repository's checklist section.
Linked Issues check
✅ Passed
The PR implements #2714 by adding updated_at filtering and updated_at sorting to the public device listing API.
Docstring Coverage
✅ Passed
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Comment @coderabbitai help to get the list of available commands.
Merging this PR will improve performance by 68.42%
⚠️Different runtime environments detected
Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.
No successful run was found on main (242f735) during the generation of this report, so 239b5a9 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Not approving: Cursor Bugbot skipped (usage limit reached) and this public GET /device API change exceeds the low-risk approval threshold. Assigned reviewers for human review.
Sent by Cursor Approval Agent: Pull Request Approver External
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Not approving: Cursor Bugbot skipped (usage limit reached) and did not complete automated review. Human review is needed for this public GET /device API change.
Sent by Cursor Approval Agent: Pull Request Approver
The reason will be displayed to describe this comment to others. Learn more.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@supabase/functions/_backend/public/device/get.ts`:
- Around line 51-60: Update parseUpdatedAtFilter to validate updatedAt against a
strict ISO timestamp format before constructing the Date, rejecting non-ISO and
rollover dates such as 2024-02-31 with the existing invalid_updated_at error.
Preserve normalization to parsed.toISOString() for valid inputs, and add tests
covering rollover and non-ISO timestamps.
- Around line 80-83: The device page-limit validation around limit must reject
fractional values so Supabase and Cloudflare behave consistently. Update the
existing finite/positive check to require Number.isInteger(limit), or normalize
the value before passing it to readDevices; preserve the current invalid_limit
error handling.
In `@tests/device.test.ts`:
- Line 105: Remove the duplicate const data declarations in the response parsing
section of the device test, keeping a single declaration with the existing
response.json type and preserving all subsequent uses of data.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
Push a commit to this branch (recommended)
Create a new PR with the fixes
ℹ️ Review info⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 3af791f6-a4f8-414d-8b58-700ecb22302e
📥 Commits
Reviewing files that changed from the base of the PR and between 242f735 and e0c9225.
📒 Files selected for processing (7)
src/services/versions.ts
supabase/functions/_backend/public/device/get.ts
supabase/functions/_backend/utils/cloudflare.ts
supabase/functions/_backend/utils/supabase.ts
supabase/functions/_backend/utils/types.ts
tests/cloudflare-device-pagination.unit.test.ts
tests/device.test.ts
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Not approving: Cursor Bugbot skipped (usage limit reached) and did not complete automated review. Human review is still needed for this public GET /device API change; Dalanir and WcaleNieWolny are already assigned.
Sent by Cursor Approval Agent: Pull Request Approver
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Not approving: Cursor Bugbot skipped (usage limit reached) and this public GET /device API change exceeds the low-risk approval threshold. Reviewers already assigned (Dalanir, WcaleNieWolny).
Sent by Cursor Approval Agent: Pull Request Approver External
?updated_at= becomes an empty string and returns undefined here, silently disabling filtering instead of returning invalid_updated_at. Only omit validation when the value is undefined; let empty strings fail the regex. Add coverage for an empty query value.
Proposed fix
- if (!updatedAt)+ if (updatedAt === undefined)
return undefined
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@supabase/functions/_backend/public/device/get.ts` around lines 52 - 57,
Update the updatedAt guard in the request parsing flow to skip validation only
when updatedAt is undefined, allowing an explicitly empty string to reach the
ISO-date regex and raise invalid_updated_at. Add coverage for a query containing
an empty updated_at value.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@supabase/functions/_backend/public/device/get.ts`:
- Around line 95-100: Move the updatedAtGt, order, and limit computations and
limit validation out of the shared setup and into the list-request branch,
leaving device_id requests to call readDevices with limit: 1 without validating
those parameters. Add a regression test confirming a single-device request with
an otherwise invalid limit such as 0 retains its existing success behavior.
---
Duplicate comments:
In `@supabase/functions/_backend/public/device/get.ts`:
- Around line 52-57: Update the updatedAt guard in the request parsing flow to
skip validation only when updatedAt is undefined, allowing an explicitly empty
string to reach the ISO-date regex and raise invalid_updated_at. Add coverage
for a query containing an empty updated_at value.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
Push a commit to this branch (recommended)
Create a new PR with the fixes
ℹ️ Review info⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: e5254643-19de-4040-889d-68ecb4924396
📥 Commits
Reviewing files that changed from the base of the PR and between e0c9225 and 705dc2f.
📒 Files selected for processing (2)
supabase/functions/_backend/public/device/get.ts
tests/device.test.ts
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Not approving: Cursor Bugbot skipped (usage limit reached) and did not complete automated review. This public GET /device API change exceeds the low-risk approval threshold; Dalanir and WcaleNieWolny are already assigned.
Sent by Cursor Approval Agent: Pull Request Approver External
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Not approving: Cursor Bugbot skipped (usage limit reached) and did not complete automated review. Human review is still needed for this public GET /device API change; Dalanir and WcaleNieWolny are already assigned.
Sent by Cursor Approval Agent: Pull Request Approver
Normalize public device timestamps to ISO UTC, accept Cloudflare's
space-separated UTC format for filter round-trips, push updated_at_gt into
the Analytics Engine inner query, and avoid mutating shared seed devices.
The reason will be displayed to describe this comment to others. Learn more.
Risk: medium. Not approving: Cursor Bugbot skipped (usage limit reached) and did not complete automated review. This public GET /device API change exceeds the low-risk approval threshold; Dalanir and WcaleNieWolny are already assigned.
Sent by Cursor Approval Agent: Pull Request Approver External
The reason will be displayed to describe this comment to others. Learn more.
Risk: medium. Not approving: Cursor Bugbot skipped (usage limit reached) and did not complete automated review. Human review is still needed for this public GET /device API change; Dalanir and WcaleNieWolny are already assigned.
Sent by Cursor Approval Agent: Pull Request Approver
The reason will be displayed to describe this comment to others. Learn more.
2 issues found across 4 files (changes from recent commits).
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="supabase/functions/_backend/public/device/get.ts">
<violation number="1" location="supabase/functions/_backend/public/device/get.ts:66">
P2: High-precision cutoffs lose fractional digits beyond milliseconds, so `updated_at_gt` can return devices at or before the requested timestamp. Preserving the validated `normalized` timestamp for the backend comparison would retain the advertised strict greater-than semantics.</violation>
</file>
<file name="supabase/functions/_backend/utils/cloudflare.ts">
<violation number="1" location="supabase/functions/_backend/utils/cloudflare.ts:1012">
P2: Filtered reads that include country data can now return `country_code: null` for a recently updated device whose latest country-bearing row predates the cutoff. The timestamp qualification should identify updated devices without removing older rows needed by the non-empty `country_code` aggregation.</violation>
</file>
Tip: Review your code locally with the cubic CLI to iterate faster.
The reason will be displayed to describe this comment to others. Learn more.
P2: High-precision cutoffs lose fractional digits beyond milliseconds, so updated_at_gt can return devices at or before the requested timestamp. Preserving the validated normalized timestamp for the backend comparison would retain the advertised strict greater-than semantics.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At supabase/functions/_backend/public/device/get.ts, line 66:
<comment>High-precision cutoffs lose fractional digits beyond milliseconds, so `updated_at_gt` can return devices at or before the requested timestamp. Preserving the validated `normalized` timestamp for the backend comparison would retain the advertised strict greater-than semantics.</comment>
<file context>
@@ -41,23 +41,29 @@ interface publicDevice {
}
- const parsed = new Date(updatedAt)
+ const parsed = new Date(normalized)
if (Number.isNaN(parsed.getTime()))
throw simpleError('invalid_updated_at', 'updated_at must be a valid ISO date', { updated_at: updatedAt })
</file context>
The reason will be displayed to describe this comment to others. Learn more.
P2: Filtered reads that include country data can now return country_code: null for a recently updated device whose latest country-bearing row predates the cutoff. The timestamp qualification should identify updated devices without removing older rows needed by the non-empty country_code aggregation.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At supabase/functions/_backend/utils/cloudflare.ts, line 1012:
<comment>Filtered reads that include country data can now return `country_code: null` for a recently updated device whose latest country-bearing row predates the cutoff. The timestamp qualification should identify updated devices without removing older rows needed by the non-empty `country_code` aggregation.</comment>
<file context>
@@ -1007,6 +1007,11 @@ export function buildReadDevicesCFQuery(params: ReadDevicesParams, customIdMode:
+ if (params.updated_at_gt) {
+ const safeUpdatedAtGt = escapeSqlString(formatDateCF(params.updated_at_gt))
+ conditions.push(`timestamp > toDateTime('${safeUpdatedAtGt}')`)
+ }
+
</file context>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Summary (AI generated)
updated_atquery param on publicGET /deviceto return only devices withupdated_atgreater than an ISO timestamporder=asc|descquery param to sort device listings byupdated_atCloses #2714
Motivation (AI generated)
The public devices list API previously had no way to filter or sort by
updated_at, so callers had to page through every device and filter client-side. That is inefficient for apps with many devices.Business Impact (AI generated)
Makes the public devices API usable for incremental sync and monitoring workflows, reducing API traffic and improving integration efficiency for customers building on Capgo.
Test Plan (AI generated)
updated_at_gtfilter andupdated_atorderingGET /device?updated_at=...andGET /device?order=descupdated_atandordervalues with 400Usage examples
Generated with AI
Made with Cursor
Summary by CodeRabbit
New Features
updated_at_gtfilter.order=asc|desc) with consistent results.Bug Fixes
updated_at,order, andlimit, returning clear HTTP 400 errors for invalid values.Tests
updated_at_gtfiltering, ordering, tie-breakers, and malformed input handling.