[FEAT] Connections Page by OverDsh · Pull Request #38 · rmanager-dev/rmanager-core

OverDsh · 2026-03-27T16:59:24Z

Renamed Database tab in Teams page to Connections to be used to manage different off-site connections
Implemented Roblox Credentials linking (under the connections page)
Added introspection on both database and roblox credentials to have visibility on connections status
Ran security audit using Claude, fixed 2x IDOR (when performing an action like delete or rotate, didn't check if the team owned the target ressource)
Various QOL improvements (icons in dropdowns, consistent time formatting)

github-actions · 2026-03-27T17:02:09Z

🚀 Preview Deployment:

Vercel Deployment: View Deployment
Status: ✅ Ready
Workflow Logs: View Run

unused

button

credential

permissions

in RobloxCredentialService

roblox-credentials-types.ts

…ExternalDatabaseService

…onnections page

- createLogger(service) factory with info/warn/error/debug methods; structured output with timestamp, extracts error.name/message without leaking stacks or raw objects - isSafeEndpointUrl() blocks non-HTTPS and all private/loopback/link-local IP ranges (RFC-1918, 127.x, 169.254.x, 0.x) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

_useCredential and _useDatabase previously fetched by ID only, allowing a credential/database belonging to team A to be accessed via a team B scoped endpoint. WHERE clauses now include an AND on teamId so a cross-team lookup returns nothing and hits the existing AccessDenied guard. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- POST /databases endpoint now rejects non-HTTPS and private/internal endpoint URLs via isSafeEndpointUrl refine - All console.error calls in ExternalDatabaseService and api-utils replaced with createLogger structured calls (teamId/resourceId/operation context, no sensitive values) - Silent empty catch on _applyIntrospectResults in RefreshRobloxCredential now logs the error instead of swallowing it Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Copilot

Pull request overview

Adds a new Connections area to manage external integrations (S3-compatible databases + Roblox API credentials), including connection “health” introspection/status and some UI/QOL improvements, while also refactoring client controllers around a shared fetcher.

Changes:

Introduces Roblox credentials linking/listing/rename/rotate/refresh (DB schema, service layer, API routes, hooks, UI tables).
Adds database introspection/status tracking plus refresh/credential rotation flows (schema + service/API/UI updates).
Refactors client-side controllers to a fetcher helper and renames the Teams “Databases” navigation to “Connections”.

Reviewed changes

Copilot reviewed 50 out of 53 changed files in this pull request and generated 14 comments.

Show a summary per file

File	Description
src/services/TeamService.ts	Switches error imports to `api-utils`.
src/services/TeamService.test.ts	Updates error import path for tests.
src/services/RobloxCredentialsService.ts	New service for Roblox credential CRUD + introspection.
src/services/ExternalDatabaseService.ts	Adds DB status/introspection + refresh/rotate support and logging.
src/lib/utils/url-utils.ts	Adds endpoint URL safety validator for DB endpoint inputs.
src/lib/utils/team-utils.ts	Adds new permissions for refresh/rotate + Roblox credentials actions.
src/lib/utils/logger.ts	Adds lightweight structured logger used across services/utils.
src/lib/utils/api-utils.ts	Adds `fetcher` helper and switches unhandled error logging to new logger.
src/lib/types/roblox-credentials-types.ts	Adds shared types + zod schemas for Roblox credential flows.
src/lib/types/database-types.ts	Adds DB status fields/messages + rotate schema.
src/lib/config.ts	Adds TEAM/USER limits constants.
src/hooks/useTeam.ts	Refactors to `TeamController` object + adds query stale times.
src/hooks/useMember.ts	Refactors member listing to `TeamController` + stale time.
src/hooks/useDatabase.ts	Refactors to `ExternalDatabaseController` + adds refresh/rotate mutations.
src/hooks/useRobloxCredential.ts	New hooks for Roblox credentials queries/mutations.
src/db/schema/roblox_credentials.ts	New table schema for storing encrypted Roblox API keys + metadata.
src/db/schema/index.ts	Exports new `roblox_credentials` schema.
src/db/schema/database.ts	Adds status/error + timestamps (lastUsed/lastRefreshedAt).
src/controllers/TeamController.ts	Refactors to a single `TeamController` object using `fetcher`.
src/controllers/RobloxCredentialController.ts	New controller for Roblox credentials API calls.
src/controllers/ExternalDatabaseController.ts	Refactors to controller object + adds refresh/rotate calls.
src/components/ui/popover.tsx	Adds popover wrapper component.
src/components/ui/badge.tsx	Adds badge component for status display.
src/components/StatusBadge.tsx	Adds status badge UI with popover details.
src/components/LocalTime.tsx	Updates time formatting (relative/absolute modes).
src/components/FormDialog.tsx	Adds internal open-state support and auto-close/reset after submit.
src/app/dashboard/components/TeamColumn.tsx	Adds dropdown icons/UX tweaks and uses `TeamController.removeMember`.
src/app/dashboard/[teamSlug]/databases/page.tsx	Removes old Databases page in favor of Connections.
src/app/dashboard/[teamSlug]/connections/page.tsx	Adds Connections page combining DB + Roblox credentials tables.
src/app/dashboard/[teamSlug]/connections/*	Adds DB/Roblox column components + link dialogs.
src/app/dashboard/[teamSlug]/components/TeamSidebar.tsx	Renames nav item to Connections + updates permission gating.
src/app/api/teams/**	Updates routes to use `api-utils` errors; adds new DB refresh/rotate + Roblox credentials routes.
package.json	Adds `radix-ui` dependency.
package-lock.json	Locks new `radix-ui` dependency tree.

Comments suppressed due to low confidence (1)

src/lib/utils/api-utils.ts:75

fetcher assumes every response has a JSON body and that error bodies match {code,message}. If an endpoint returns 204/empty body or ErrorToNextResponse returns {error: ...} for unknown errors, response.json()/ResponseToError will throw or produce an unhelpful Error. Consider guarding JSON parsing (e.g., handle empty bodies) and normalizing server error responses to a single shape before calling ResponseToError.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

src/components/LocalTime.tsx

src/hooks/useRobloxCredential.ts

src/hooks/useDatabase.ts

src/lib/utils/url-utils.ts

Copilot · 2026-03-27T17:05:30Z

package.json

    "next-themes": "^0.4.6",
    "nodemailer": "^7.0.10",
    "qrcode": "^1.5.4",
+    "radix-ui": "^1.4.3",


radix-ui is added as a dependency, but the codebase already depends on individual @radix-ui/react-* packages. Pulling in the umbrella package can duplicate dependencies and increase bundle size; consider removing radix-ui and adding only the specific missing primitive packages (e.g. @radix-ui/react-popover) to match existing usage.

Suggested change

"radix-ui": "^1.4.3",

Copilot · 2026-03-27T17:05:32Z

src/app/dashboard/[teamSlug]/connections/RobloxCredentialColumn.tsx

+      callback={({ name }) => {
+        const id = toast.loading("Renaming Roblox credential...");
+        renameRobloxCredential
+          .mutateAsync({ teamId: team!.id, credId, newName: name })
+          .then(() => {
+            toast.success("Successfully renamed Roblox credential!", { id });
+          })
+          .catch((error) => {
+            if (error instanceof Error) {
+              toast.error(error.message, { id });
+            } else {
+              toast.error(
+                "An unknown error happened while renaming Roblox credential. Please try again later.",
+                { id },
+              );
+            }
+          });


The callback passed to FormDialog here starts an async mutation via .mutateAsync(...).then().catch() but does not return/await that promise. With the updated FormDialog implementation awaiting the callback, this means the dialog may close/reset immediately while the mutation is still in flight. Make the callback async and await/return the mutation promise so FormDialog can reliably manage loading/close behavior.

Suggested change

callback={({ name }) => {

const id = toast.loading("Renaming Roblox credential...");

renameRobloxCredential

.mutateAsync({ teamId: team!.id, credId, newName: name })

.then(() => {

toast.success("Successfully renamed Roblox credential!", { id });

})

.catch((error) => {

if (error instanceof Error) {

toast.error(error.message, { id });

} else {

toast.error(

"An unknown error happened while renaming Roblox credential. Please try again later.",

{ id },

);

}

});

callback={async ({ name }) => {

const id = toast.loading("Renaming Roblox credential...");

try {

await renameRobloxCredential.mutateAsync({ teamId: team!.id, credId, newName: name });

toast.success("Successfully renamed Roblox credential!", { id });

} catch (error) {

if (error instanceof Error) {

toast.error(error.message, { id });

} else {

toast.error(

"An unknown error happened while renaming Roblox credential. Please try again later.",

{ id },

);

}

}

Copilot · 2026-03-27T17:05:32Z

src/app/dashboard/[teamSlug]/connections/RobloxCredentialColumn.tsx

+import {
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger,
+} from "@/src/components/ui/dropdown-menu";
+import { FormControl, FormField, FormItem, FormLabel, FormMessage } from "@/src/components/ui/form";
+import { Input } from "@/src/components/ui/input";
+import { Skeleton } from "@/src/components/ui/skeleton";
+import { useRobloxCredentialMutations } from "@/src/hooks/useRobloxCredential";
+import { useTeam } from "@/src/hooks/useTeam";
+import {
+  RobloxCredential,
+  RobloxCredentialRenameSchema,
+  RobloxCredentialRotateSchema,
+} from "@/src/lib/types/roblox-credentials-types";
+import { hasPermission } from "@/src/lib/utils/team-utils";
+import { zodResolver } from "@hookform/resolvers/zod";
+import { DropdownMenu } from "@radix-ui/react-dropdown-menu";
+import { ColumnDef } from "@tanstack/react-table";


This file mixes the project’s UI dropdown menu wrappers with a direct import from @radix-ui/react-dropdown-menu (DropdownMenu). For consistency (and to ensure styling/props match), import DropdownMenu from @/src/components/ui/dropdown-menu alongside the other dropdown menu components instead of using the Radix primitive directly.

Copilot · 2026-03-27T17:05:32Z

src/app/dashboard/[teamSlug]/connections/LinkRoCredDialog.tsx

+      callback={({ name, key }) => {
+        const id = toast.loading("Linking Roblox API key to your team...");
+        linkRobloxCredential
+          .mutateAsync({
+            teamId: team!.id,
+            data: { name, key },
+          })
+          .then(() => {
+            toast.success("Successfully linked Roblox API key to your team!", {
+              id,
+            });
+            setIsOpen(false);
+          })
+          .catch((error) => {
+            if (error instanceof Error) {
+              toast.error(error.message, { id });
+            } else {
+              toast.error(
+                "An unknown error happened while linking Roblox API key to your team. Please try again later.",
+                { id },
+              );
+            }
+          });


Similarly, this FormDialog callback triggers mutateAsync(...).then().catch() without returning the promise. With FormDialog now awaiting callback, the dialog can close/reset immediately and isLoading won’t reflect the actual request lifecycle. Consider making the callback async and await/return the mutation promise (and remove the redundant setIsOpen(false) since FormDialog can handle closing on success).

Suggested change

callback={({ name, key }) => {

const id = toast.loading("Linking Roblox API key to your team...");

linkRobloxCredential

.mutateAsync({

teamId: team!.id,

data: { name, key },

})

.then(() => {

toast.success("Successfully linked Roblox API key to your team!", {

id,

});

setIsOpen(false);

})

.catch((error) => {

if (error instanceof Error) {

toast.error(error.message, { id });

} else {

toast.error(

"An unknown error happened while linking Roblox API key to your team. Please try again later.",

{ id },

);

}

});

callback={async ({ name, key }) => {

const id = toast.loading("Linking Roblox API key to your team...");

try {

await linkRobloxCredential.mutateAsync({

teamId: team!.id,

data: { name, key },

});

toast.success("Successfully linked Roblox API key to your team!", {

id,

});

} catch (error) {

if (error instanceof Error) {

toast.error(error.message, { id });

} else {

toast.error(

"An unknown error happened while linking Roblox API key to your team. Please try again later.",

{ id },

);

}

throw error;

}

Copilot · 2026-03-27T17:05:32Z

src/services/RobloxCredentialsService.ts

+    return await db.transaction(async (tx) => {
+      await tx
+        .update(roblox_credentials)
+        .set({
+          keyCiphertext: newKeyEncrypted.encryptedData,
+          keyIv: newKeyEncrypted.initializationVector,
+          keyTag: newKeyEncrypted.authTag,
+        })
+        .where(eq(roblox_credentials.id, credId));
+
+      return this._applyIntrospectResults(credId, keyInfo, tx);
+    });


RotateRobloxCredential updates the credential row using only id, without verifying that the credential belongs to the provided teamId. This reintroduces an IDOR risk (a user with admin on one team could rotate another team’s credential if they know the credId). Use the existing _useCredential helper or add teamId to the update WHERE clause and ensure you throw AccessDenied when no row is updated/returned.

Copilot · 2026-03-27T17:05:33Z

src/components/FormDialog.tsx

    await callback(data);
+    onOpenChange(false);
    form.reset();
    setIsLoading(false);


handleSubmit sets isLoading to true, awaits callback, and then unconditionally closes/resets the dialog. If callback throws/rejects, isLoading will never be reset (no try/finally) and the dialog state can get stuck. Consider wrapping in try/finally and only closing/resetting on success (or allow callers to control close behavior).

Suggested change

await callback(data);

onOpenChange(false);

form.reset();

setIsLoading(false);

try {

await callback(data);

onOpenChange(false);

form.reset();

} finally {

setIsLoading(false);

}

OverDsh self-assigned this Mar 27, 2026

Copilot AI review requested due to automatic review settings March 27, 2026 16:59

OverDsh added enhancement New feature or request dashboard ui security labels Mar 27, 2026

OverDsh had a problem deploying to Preview March 27, 2026 16:59 — with GitHub Actions Error

Copilot started reviewing on behalf of OverDsh March 27, 2026 16:59 View session

OverDsh added 21 commits March 27, 2026 18:02

feat: renamed databases page to connections

42170f5

feat: create the RobloxCredentialsService

db3b741

feat: create api routes for RobloxCredentialService

ec31b19

refactor: renamed errors.ts to api-utils.ts

48299fd

refactor: create fetcher util to use in controllers

5ee0e88

feat: create frontend hooks for RobloxCredentialService

1fde0be

fix: include roblox credentials table in drizzle schema

5bc40c2

fix: return mutations in useRobloxCredentialMutations

66dbf02

fix: remove type from RobloxCredentialInfoSchema

8f8bf90

enhancement: remove unused imports

50e65e8

feat: implement roblox credentials data table in the connections page

38b437a

enhancement: close form dialog after running callback

1471545

enhancement: set submit button text to "Link" in RobloxCredentialDialog

28e71e9

fix: return success: true after rotating roblox credential key

4f204db

feat: implement rename and roatate roblox credential

0632c83

enhancement: require roblox credential key to be at least 1 character

2131f91

enhancement: add a 5 min stale time to hooks using react query

74f453f

chore: updated radix ui

8dbdca1

feat: install badge and popover components

5f964a2

feat: add refresh credential method, and various QOL improvements

24a8fe9

feat: implement credential status on the frontend

d6ecc2e

OverDsh and others added 16 commits March 27, 2026 18:02

fix: fix request object being cleared by the linter because treated as

6b086cf

unused

enhancement: change time format to be consistent and add View Profile

fa02d2b

button

fix: add icon to error badge

9edd48d

enhancement: changed popover style

c992973

fix: list roblox credential checked permission for rename roblox

faf30f8

credential

feat: dynamically show databases/roblox credentials data table based on

db70949

permissions

fix: fix wrong key lookup for expiration date in the introspection table

06e1499

in RobloxCredentialService

refactor: move roblox credential status error message to

66a7819

roblox-credentials-types.ts

feat: add database introspection, refresh, and rotate credentials to …

730b357

…ExternalDatabaseService

feat: add refresh and rotate API routes for databases

ec1ad1f

feat: add refresh status and rotate credentials actions to database c…

ee6ae59

…onnections page

enhancement: added icons to teams list's dropdown

582e11c

feat: generate migration for roblox_credentials table

d88d0b3

OverDsh force-pushed the feat/connections_page branch from fd37b7d to d88d0b3 Compare March 27, 2026 17:04

OverDsh temporarily deployed to Preview March 27, 2026 17:04 — with GitHub Actions Inactive

Copilot AI reviewed Mar 27, 2026

View reviewed changes

fix: add VERCEL_URL to better auth trusted origins

cd753c1

OverDsh temporarily deployed to Preview March 27, 2026 17:11 — with GitHub Actions Inactive

OverDsh merged commit 4282df4 into dev Mar 27, 2026
2 checks passed

OverDsh deleted the feat/connections_page branch March 27, 2026 17:27

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[FEAT] Connections Page#38

[FEAT] Connections Page#38
OverDsh merged 38 commits intodevfrom
feat/connections_page

OverDsh commented Mar 27, 2026

Uh oh!

github-actions bot commented Mar 27, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Mar 27, 2026

Uh oh!

Copilot AI Mar 27, 2026

Uh oh!

Copilot AI Mar 27, 2026

Uh oh!

Copilot AI Mar 27, 2026

Uh oh!

Copilot AI Mar 27, 2026

Uh oh!

Copilot AI Mar 27, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

OverDsh commented Mar 27, 2026

Uh oh!

github-actions bot commented Mar 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Preview Deployment:

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions bot commented Mar 27, 2026 •

edited

Loading