Dev by SteakFisher · Pull Request #99 · ScrawnDotDev/Scrawn

SteakFisher · 2026-07-07T07:02:40Z

No description provided.

…race, scoped clearClients

…eAITokenUsageDataSchema

…query registry

…lidation

…vices

…dularization) Phase 1 — SQL Dialect Abstraction: - fieldRegistry.ts: single source of truth for event field definitions - sqlDialect.ts: common interface (buildSelect, buildWhere, getTotalCount) - postgresDialect.ts / clickHouseDialect.ts: dialect implementations - queryEvents.ts: unified handler that picks dialect via STORAGE_ADAPTER - Both PG and CH handlers now thin re-exports from common/queryEvents Phase 3 — Data Engine Modularization: - Extract dataQuery module from routes/gRPC/data/query into storage/query/ - Explicit field alias registry with auto-derived cast types from Drizzle metadata - Thin handler in routes/gRPC/data/query delegates to executeDataQuery/getDataTable - hasMore support in DataQueryResult

…TPUT_FIELDS

…board keys

0xanshu/project

…update proto submodule

chore: rename SCRAWN_KEY to MASTER_API_KEY, add MASTER_API_KEY_HASH, …

Refactor/analytics

Feat/dodo products creation

greptile-apps · 2026-07-07T07:06:38Z

Greptile Summary

This PR adds project-scoped backend support across auth, billing, and query paths. The main changes are:

Project ownership on API keys, metadata, webhooks, sessions, users, and usage events.
Master-key onboarding and project management endpoints.
Project-scoped Dodo payment configuration and webhook routing.
Shared query-event SQL dialects for Postgres and ClickHouse.
New integration coverage for data and event queries.

Confidence Score: 4/5

The query-events path needs a tenant-scope fix before merging.

Authenticated event queries can read rows outside the caller's project. The problem affects list, aggregation, and count queries in both SQL dialects. The reviewed HTTP project and payment paths otherwise use projectId consistently.

src/storage/adapter/common/queryEvents.ts, src/storage/adapter/common/postgresDialect.ts, src/storage/adapter/common/clickHouseDialect.ts

T-Rex Logs

What T-Rex did

Reproduced the tenant-scoping guard in handleQueryEvents by running a focused Bun test that mocks the SQL dialect and exercises the list and aggregation paths with an auth.projectId of project-A-tenant-id and unscoped filters, including no projectId or mode predicate.
Prepared reproducible artifacts documenting the reproduction, including the Bun test harness that instruments dialect calls from handleQueryEvents and the test output showing unscoped list and aggregation dialect arguments.
Validated blocker evidence for the DB reachability probe: the corrected probe shows the required DB command and failure details, while the fallback smoke test confirms all tests pass, and an earlier probe is preserved for reference.

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
src/storage/adapter/common/queryEvents.ts	Adds the shared queryEvents handler, but drops the authenticated project context before SQL generation.
src/storage/adapter/common/postgresDialect.ts	Builds Postgres event queries from request filters only, so it depends on the caller to provide required tenant predicates.
src/storage/adapter/common/clickHouseDialect.ts	Builds ClickHouse event queries from request filters only, with the same missing tenant predicate issue.
src/routes/http/api/onboarding.ts	Adds master-key onboarding, project creation, Dodo setup, and rollback handling.
src/routes/http/api/projects.ts	Adds master-key project list, update, and delete endpoints.
src/routes/gRPC/payment/paymentProvider.ts	Moves Dodo client and metadata lookup to project-scoped configuration.

_{Reviews (1): Last reviewed commit: "Merge pull request #98 from 0xanshu/feat..." | Re-trigger Greptile}

greptile-apps · 2026-07-07T07:06:42Z

+      return await dialect.executeAggregationQuery(request, filtered);
+    }
+    return await dialect.executeListQuery(request, filtered);


Query Events Ignore Tenant Scope

When any API key calls queryEvents, the authenticated projectId is accepted by this function but never reaches the Postgres or ClickHouse dialects. The generated list, aggregation, and count queries only use request filters, so a valid key can receive events from other projects and modes in the shared event tables.

Artifacts

Repro: Bun test harness instrumenting dialect calls from handleQueryEvents

Contains supporting evidence from the run (text/typescript; charset=utf-8).

Repro: test output showing unscoped list and aggregation dialect arguments

Keeps the command output available without making the summary code-heavy.

_{Ran code and verified through T-Rex}

SteakFisher and others added 30 commits June 17, 2026 01:12

feat(project): Added projects

bd201c3

fix(datetime): Slight changes

bfdfe30

fix(webhooks): potential leak)

4cbc1ed

fix(user): Cache invalidation

4b9f81e

fix: composite PK for usersTable, token validation, ensureUserExists …

2b54ffb

…race, scoped clearClients

fix: add model.min(1), provider default, token count .min(0) in creat…

287a146

…eAITokenUsageDataSchema

fix: scope row lock, deleteWebhookEndpoint, and remove metadata from …

3821899

…query registry

fix: resolve all greptile findings — billing, auth, tests, schema, va…

c0755c7

…lidation

fix: prevent dashboard self-revoke, remove unsafe cast in query.ts

7b6179f

fix(schema.ts): added project_id to clickhouse db schema

91b3696

fix(generateInitialAPIKey): now API key gets inserted into the db

b6410a7

fix(generateInitialAPIKey): idempotency gaurd added

d998a50

fix(project): schema fixes

97cb89e

test: add integration tests for Query Engine and Data Engine gRPC ser…

37d1423

…vices

chore: custom error types, derive Zod enum from registry, explicit OU…

16bf9cb

…TPUT_FIELDS

feat(createDashboardKey): made a new route to handle creation of dash…

4788da8

…board keys

fix(resgisterApiRoutes.ts): fixed params

94184ac

fix(apiKeys.ts): fixed linting errors

e9348f1

fix(apiKeys): fixed greptile issues

06e61d9

fix(queryEvents): fixed greptile issues

1f4553b

fix(db): constrain config keys

e3fee51

feat(projects): added project create, update, delete routes and func

1550d8d

fix(projects): fixed projects checking

4ca65cb

fix(project.ts): fixed multiple grep issues

8b2fa2b

fix(projcets.ts): handling failure in updating dodo webhooks

8441040

fix(projcets.ts): now accepting a dashboard-only target apiKeyId

3a45993

fix(projcets.ts): fixed greptile issues

f076f9f

fix(projcets.ts): using left join to insert data for projects

0f6fae9

fix(projcets.ts): currency mismatch fixed

a63ee9b

0xanshu and others added 27 commits June 29, 2026 09:44

fix(projects.ts): clickhouse startup cleanup

6f309e7

fix(projects): handling partial metadata insertion failure

aa3ea44

fix(projects): fixed multiple greptile issues

4951286

Merge pull request #93 from 0xanshu/0xanshu/project

3380597

0xanshu/project

chore: rename SCRAWN_KEY to MASTER_API_KEY, add MASTER_API_KEY_HASH, …

5184332

…update proto submodule

Merge pull request #96 from ScrawnDotDev/feat/cli_autogen

d0986f5

chore: rename SCRAWN_KEY to MASTER_API_KEY, add MASTER_API_KEY_HASH, …

refactor(query): refactoring the query engine

39df8f4

fix(analytics): computed filters now have the condition

c71e760

fix(analytics): implemented auth checks in query

c37c05c

fix(analytics): fixed linting errors

b47f89f

fix(analytics): taking orderBy in query now

e527bc4

fix(analytics): applied pagination globally

99407f5

fix(analytics): matched protobuf orderBy field with zod

6eea7cf

fix(analytics): restored output-cache fields

ea6d3ac

fix(analytics): preserve eventType predicates

37c0862

fix(analytics): fixed values in fieldRegistery

b0fed5c

fix(analytics): fixed AI debit assertions

043c29f

fix(analytics): reject unknown aggregations

feddc3a

Merge pull request #97 from 0xanshu/refactor/analytics

462c9ff

Refactor/analytics

fix(products): products are now created automatically

7610b1d

fix(products): removed product_id from zod

9bde46f

fix(products): webhook url now contains product id

6f55b52

fix(products): handling rejected promise better now

ed81030

fix(products): removed typecasting from promise results

2595e00

fix(products): changed to Currency type from dodo

f9be0c5

fix(products): correct path to import Currency type now

e2cb64a

Merge pull request #98 from 0xanshu/feat/dodo-products-creation

41ebfe6

Feat/dodo products creation

greptile-apps Bot reviewed Jul 7, 2026

View reviewed changes

SteakFisher merged commit 95a9f9a into main Jul 7, 2026
3 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Dev#99

Dev#99
SteakFisher merged 60 commits into
mainfrom
dev

SteakFisher commented Jul 7, 2026

Uh oh!

greptile-apps Bot commented Jul 7, 2026

T-Rex Logs

Uh oh!

greptile-apps Bot Jul 7, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

SteakFisher commented Jul 7, 2026

Uh oh!

greptile-apps Bot commented Jul 7, 2026

Greptile Summary

Confidence Score: 4/5

T-Rex Logs

Important Files Changed

Uh oh!

greptile-apps Bot Jul 7, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants