FE-799, H-6506, H-6511: Fix PDF preview, org invite auto-accept, updating org details#8909
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
2 Skipped Deployments
|
PR SummaryMedium Risk Overview PDF preview pins Org invitations keep Org settings writes Minor: entity page Reviewed by Cursor Bugbot for commit 4b433bc. Bugbot is set up for automated code reviews on this repo. Configure here. |
github-actions
Bot
added
area/deps
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
|
Semgrep found 1 Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase. View Dataflow Graphflowchart LR
classDef invis fill:white, stroke: none
classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none
subgraph File0["<b>apps/hash-frontend/src/pages/signin.page.tsx</b>"]
direction LR
%% Source
subgraph Source
direction LR
v0["<a href=https://github.com/hashintel/hash/blob/8cb0293b16608b451d1c6348965ae7a74842160b/apps/hash-frontend/src/pages/signin.page.tsx#L114 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 114] router.query.return_to</a>"]
end
%% Intermediate
subgraph Traces0[Traces]
direction TB
v2["<a href=https://github.com/hashintel/hash/blob/8cb0293b16608b451d1c6348965ae7a74842160b/apps/hash-frontend/src/pages/signin.page.tsx#L72 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 72] returnTo</a>"]
end
%% Sink
subgraph Sink
direction LR
v1["<a href=https://github.com/hashintel/hash/blob/8cb0293b16608b451d1c6348965ae7a74842160b/apps/hash-frontend/src/pages/signin.page.tsx#L256 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 256] returnTo ?? activeFlow.return_to ?? "/"</a>"]
end
end
%% Class Assignment
Source:::invis
Sink:::invis
Traces0:::invis
File0:::invis
%% Connections
Source --> Traces0
Traces0 --> Sink
|
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #8909 +/- ##
==========================================
+ Coverage 59.61% 59.62% +0.01%
==========================================
Files 1348 1348
Lines 131877 131763 -114
Branches 5944 5942 -2
==========================================
- Hits 78615 78562 -53
+ Misses 52357 52297 -60
+ Partials 905 904 -1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Pull request overview
This PR addresses several frontend signup/auth flow issues (preserving invitation-related query params and preventing duplicate org-invite acceptance), fixes PDF preview worker/dependency resolution, and corrects org websiteUrl updates to use the URI data type.
Changes:
- Pin
pdfjs-distand update PDF preview worker wiring; load the PDF preview client-side only. - Preserve signup/signin query params relevant to invitation flows and add guards to prevent double invitation acceptance.
- Update org settings updates so
websiteUrlis written with theURIdata type.
Reviewed changes
Copilot reviewed 10 out of 11 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| yarn.lock | Locks in pdfjs-dist@4.8.69 to stabilize PDF preview dependencies. |
| apps/hash-frontend/package.json | Adds explicit pdfjs-dist dependency for the frontend app. |
| apps/hash-frontend/src/pages/signup.page/signup-registration-form.tsx | Preserves relevant query params across registration flow navigation. |
| apps/hash-frontend/src/pages/signup.page.tsx | Adds client-side dedupe/guarding around org invitation acceptance during signup. |
| apps/hash-frontend/src/pages/signin.page.tsx | Preserves return_to query/hash and passes returnTo into Kratos login flow creation. |
| apps/hash-frontend/src/pages/shared/pdf-preview.tsx | Sets pdfjs worker source using pdfjs-dist worker URL. |
| apps/hash-frontend/src/pages/shared/entity/entity-editor/file-preview-section.tsx | Dynamically imports PdfPreview with ssr: false to avoid SSR issues. |
| apps/hash-frontend/src/pages/settings/organizations/[shortname]/general.page.tsx | Uses URI data type metadata when patching websiteUrl. |
| apps/hash-frontend/src/pages/@/[shortname]/entities/[entity-uuid].page.tsx | Adjusts entity page <NextSeo> title formatting. |
| apps/hash-frontend/src/pages/_app.page.tsx | Avoids redirecting authenticated users away from /signup when invitationId is present. |
| apps/hash-api/src/graphql/resolvers/knowledge/org/accept-org-invitation.ts | Adds backend in-flight dedupe and a second membership check to prevent duplicate acceptance. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
![graphite-app[bot]](https://avatars.githubusercontent.com/in/158384?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit c302af0. Configure here.
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
🌟 What is the purpose of this PR?
Fix the following frontend bugs:
websiteUrlto use theURIdata type instead ofTextPre-Merge Checklist 🚀
🚢 Has this modified a publishable library?
This PR:
📜 Does this require a change to the docs?
The changes in this PR:
🕸️ Does this require a change to the Turbo Graph?
The changes in this PR:
❓ How to test this?