Remove legacy tenancy config #802

fomalhautb · 2025-07-24T21:08:38Z

Important

Refactor tenancy configuration structure, affecting authentication, email, domain, OAuth, and permissions settings, with updates to feature flag checks, property access, and test assertions.

Refactor:
- Updated configuration structure for authentication, email, domain, OAuth, and permissions settings, affecting feature flag checks and property access in handlers.tsx, route.tsx, and crud.tsx.
- Improved handling of domain and OAuth provider configurations for integrations and CRUD operations.
- Adjusted redirect URL validation and origin checks to use updated tenancy configuration.
- Transformed project and tenancy configuration data returned by API handlers for consistency.
- Centralized email theme and template retrieval from updated configuration paths.
Bug Fixes:
- Corrected error messages related to OTP sign-in feature availability.
Tests:
- Updated test assertions to match new error messages for OTP sign-in.
Chores:
- Reorganized import statements and updated internal logic to align with new configuration structure.

^{This description was created by}^{for ae04ae2. You can customize this summary. It will automatically update as commits are pushed.}

Summary by CodeRabbit

Refactor
- Updated configuration structure for authentication, email, domain, OAuth, and permissions settings, resulting in changes to feature flag checks and property access throughout the backend.
- Improved handling of domain and OAuth provider configurations for integrations and CRUD operations.
- Adjusted redirect URL validation and origin checks to use updated tenancy configuration.
- Transformed project and tenancy configuration data returned by API handlers for consistency.
- Centralized email theme and template retrieval from updated configuration paths.
- Simplified redirect URL validation calls by passing tenancy objects directly.
- Updated passkey, password, OTP, and OAuth feature flag checks to new nested configuration properties.
Bug Fixes
- Corrected error messages related to OTP sign-in feature availability.
Tests
- Updated test assertions to match new error messages for OTP sign-in.
Chores
- Reorganized import statements and updated internal logic to align with new configuration structure.

vercel · 2025-07-24T21:08:43Z

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
stack-backend	🛑 Canceled (Inspect)			Jul 31, 2025 6:06pm
stack-dashboard	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Jul 31, 2025 6:06pm
stack-demo	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Jul 31, 2025 6:06pm
stack-docs	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Jul 31, 2025 6:06pm

apps/backend/prisma/seed.ts

recurseml · 2025-07-24T21:10:06Z

😱 Found 1 issue. Time to roll up your sleeves! 😱

🗒️ View all ignored comments in this repo

The constraint 'TokenStoreType extends string' is too restrictive. It should likely be 'TokenStoreType extends string | object' to match the condition check in line 113 where TokenStoreType is checked against {}
Return type mismatch - the interface declares useUsers() returning ServerUser[] but the Team interface that this extends declares useUsers() returning TeamUser[]
There is a syntax error in the super constructor call due to the ellipsis operator used incorrectly. Objects aren't being merged correctly. This syntax usage can lead to runtime errors when trying to pass the merged object to 'super()'. Verify that the intended alterations to the object occur before or outside of the super() call if needed.
Throwing an error when no active span is found is too aggressive. The log function should gracefully fallback to console.log or another logging mechanism when there's no active span, since not all execution contexts will have an active span. This makes the code less resilient and could break functionality in non-traced environments.

📚 Relevant Docs

Function sets backendContext with a new configuration but doesn't pass 'defaultProjectKeys'. Since defaultProjectKeys is required in the type definition and cannot be updated (throws error if tried to set), this will cause a type error.
The schema is using array syntax for pick() which is incorrect for Yup schemas. The pick() method in Yup expects individual arguments, not an array. Should be changed to: emailConfigSchema.pick('type', 'host', 'port', 'username', 'sender_name', 'sender_email')

📚 Relevant Docs

Creating a refresh token with current timestamp as expiration means it expires immediately. Should set a future date for token expiration.
The 'tools' object is initialized as an empty object, even though 'tools' is presumably expected to contain tool definitions. This could cause the server capabilities to lack necessary tool configurations, thus potentially impacting functionalities that depend on certain tool setups.

📚 Relevant Docs

'STACK_SECRET_SERVER_KEY' is potentially being included in every request header without checking its existence again here. Although it's checked during initialization, this could lead to security issues as it's exposed in all communications where the header is logged or captured.

📚 Relevant Docs

When adding 'use client' directive at the beginning, it doesn't check if file.text already contains the 'use client' directive. This could lead to duplicate 'use client' directives if the file already has one.

📚 Relevant Docs

⚠️ Only 5 files were analyzed due to processing limits.

^{Need help? Join our Discord for support!
https://discord.gg/qEjHQk64Z9}

apps/backend/src/lib/ai-chat/email-template-adapter.ts

apps/backend/src/lib/ai-chat/email-theme-adapter.ts

greptile-apps

Greptile Summary

This PR represents a comprehensive refactoring to remove legacy tenancy configuration patterns throughout the Stack Auth codebase. The changes migrate from a dual configuration system (with both config and completeConfig properties) to a unified, hierarchical configuration structure.

The key architectural changes include:

Configuration Structure Modernization: The PR eliminates the legacy completeConfig property from tenancy objects and consolidates all configuration access through the config property, which now directly contains the rendered organization configuration.
Hierarchical Configuration Schema: The flat configuration structure has been replaced with a nested organization where related settings are grouped logically:
- Authentication settings moved from credential_enabled, sign_up_enabled, passkey_enabled to auth.password.allowSignIn, auth.allowSignUp, auth.passkey.allowSignIn
- Domain configuration restructured from flat arrays to domains.trustedDomains objects with baseUrl and handlerPath properties
- OAuth providers reorganized from arrays to keyed objects under auth.oauth.providers
- Email configuration moved from email_config.type to emails.server.isShared
API Simplification: Functions like validateRedirectUrl have been updated to accept entire tenancy objects instead of individual configuration parameters, centralizing configuration access logic and reducing parameter coupling.
Transformation Layer: The renderedOrganizationConfigToProjectCrud function is now used to transform the new organization config format into the expected project CRUD interface format for API responses, maintaining backward compatibility while supporting the new internal structure.
New Environment Config CRUD: A new environment configuration management system has been introduced with proper CRUD operations, supporting the transition from legacy tenancy-based configuration to environment-level configuration management.

The changes affect authentication flows (password, OTP, passkey, OAuth), email systems, domain validation, API key management, team creation, user management, and various internal configuration endpoints. All modifications maintain functional equivalence while adopting the cleaner, more maintainable configuration architecture.

Confidence score: 3/5

• This PR has significant architectural changes that could introduce subtle bugs if configuration transformations are incorrect
• The migration from legacy to new config structure requires careful validation to ensure all property mappings are accurate
• Files like apps/backend/src/app/api/latest/auth/otp/send-sign-in-code/route.tsx have inconsistent error messaging and several files use generic yupMixed() validation that lacks type safety

_{46 files reviewed, 6 comments}

_{Edit Code Review Bot Settings | Greptile}

apps/backend/prisma/seed.ts

apps/backend/src/app/api/latest/auth/otp/send-sign-in-code/route.tsx

apps/backend/src/app/api/latest/internal/environment-config/current/crud.tsx

apps/backend/src/oauth/index.tsx

apps/backend/src/app/api/latest/integrations/neon/oauth-providers/crud.tsx

apps/backend/src/lib/redirect-urls.tsx

…ers/crud.tsx Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

…te.tsx Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

coderabbitai · 2025-07-31T16:39:34Z

Walkthrough

This update refactors tenancy configuration property access throughout the backend, standardizing on nested and renamed config fields (e.g., tenancy.config.auth.*, tenancy.config.domains.trustedDomains). Numerous handler, CRUD, and utility files are updated to use these new property paths, with helper functions introduced for legacy compatibility. Several function signatures are updated, and test and error messages are aligned with the new structure.

Changes

Cohort / File(s)	Change Summary
Tenancy Config Refactor: Auth, Domains, Emails, Teams, Users, Permissions `apps/backend/src/app/api/latest/auth/`, `apps/backend/src/app/api/latest/connected-accounts/[user_id]/[provider_id]/access-token/crud.tsx`, `apps/backend/src/app/api/latest/emails/`, `apps/backend/src/app/api/latest/internal/email-templates/`, `apps/backend/src/app/api/latest/internal/email-themes/`, `apps/backend/src/app/api/latest/internal/projects/crud.tsx`, `apps/backend/src/app/api/latest/internal/projects/current/crud.tsx`, `apps/backend/src/app/api/latest/internal/send-sign-in-invitation/route.tsx`, `apps/backend/src/app/api/latest/oauth-providers/crud.tsx`, `apps/backend/src/app/api/latest/projects/current/crud.tsx`, `apps/backend/src/app/api/latest/teams/crud.tsx`, `apps/backend/src/app/api/latest/users/crud.tsx`, `apps/backend/src/lib/permissions.tsx`, `apps/backend/src/lib/ai-chat/email-template-adapter.ts`, `apps/backend/src/lib/ai-chat/email-theme-adapter.ts`, `apps/backend/src/lib/email-rendering.tsx`, `apps/backend/src/lib/emails.tsx`, `apps/backend/src/prisma-client.tsx`	All references to tenancy config properties are updated to use new nested structures (e.g., `auth`, `emails`, `domains.trustedDomains`). Legacy property names are replaced with new ones (e.g., `allowSignUp`, `allowSignIn`, `isShared`). Helper functions are introduced for legacy compatibility in CRUD handlers.
Domain CRUD Handlers Refactor `apps/backend/src/app/api/latest/integrations/custom/domains/crud.tsx`, `apps/backend/src/app/api/latest/integrations/neon/domains/crud.tsx`	Domain CRUD handlers are refactored to operate on `trustedDomains` objects, with a helper function converting to legacy format for compatibility.
OAuth Providers CRUD Handler Refactor `apps/backend/src/app/api/latest/integrations/neon/oauth-providers/crud.tsx`	Introduces helper functions to convert new OAuth provider config structures to legacy format and locate providers by type. All CRUD operations are updated to use these helpers.
OAuth Provider and Model Refactor `apps/backend/src/oauth/index.tsx`, `apps/backend/src/oauth/model.tsx`	Updates parameter types and logic to use new config structure for OAuth providers and domain handling. Adjusts property names and validation logic accordingly.
Redirect URL Validation Refactor `apps/backend/src/lib/redirect-urls.tsx`, `apps/backend/src/route-handlers/verification-code-handler.tsx`, `apps/backend/src/app/api/latest/internal/send-sign-in-invitation/route.tsx`	`validateRedirectUrl` now accepts a tenancy object instead of separate parameters. All usages are updated to pass tenancy directly. Logic is updated for new domain config structure.
Prisma Seed and Tenancy Conversion `apps/backend/prisma/seed.ts`, `apps/backend/src/lib/tenancies.tsx`	Refactors domain array construction for seeding and removes transformation of config in tenancy conversion, returning raw config.
API Key Handler Signature Update `apps/backend/src/app/api/latest/(api-keys)/handlers.tsx`	Updates `throwIfFeatureDisabled` to accept a `Tenancy` object and changes feature flag checks to new config paths.
Test Update: OTP Sign-in Error Message `apps/e2e/tests/backend/endpoints/api/v1/auth/otp/send-sign-in-code.test.ts`	Updates test assertion to match new error message for OTP sign-in when disabled.

Sequence Diagram(s)

sequenceDiagram
    participant Client
    participant API_Handler
    participant Tenancy_Config

    Client->>API_Handler: Request (e.g., sign-in, domain CRUD)
    API_Handler->>Tenancy_Config: Access nested config (auth, domains, emails)
    Tenancy_Config-->>API_Handler: Return structured config
    API_Handler->>API_Handler: Validate/Process using new config paths
    API_Handler-->>Client: Response (success/error)

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~40 minutes

Suggested reviewers

N2D4

Poem

A bunny with code on its mind,
Hopped through configs, old and entwined.
With tidy new paths,
And helpers for maths,
Now tenancy’s logic’s aligned!
🐇✨
“Refactor complete—let’s hop to the next find!”

Note

⚡️ Unit Test Generation is now available in beta!

Learn more here, or try it out under "Finishing Touches" below.

📜 Recent review details

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 9fa42c7 and ae04ae2.

📒 Files selected for processing (2)

apps/backend/src/app/api/latest/integrations/custom/domains/crud.tsx (3 hunks)
apps/backend/src/app/api/latest/integrations/neon/domains/crud.tsx (3 hunks)

🚧 Files skipped from review as they are similar to previous changes (2)

apps/backend/src/app/api/latest/integrations/custom/domains/crud.tsx
apps/backend/src/app/api/latest/integrations/neon/domains/crud.tsx

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (9)

GitHub Check: build (22.x)
GitHub Check: build (22.x)
GitHub Check: restart-dev-and-test
GitHub Check: setup-tests
GitHub Check: docker
GitHub Check: docker
GitHub Check: all-good
GitHub Check: lint_and_build (latest)
GitHub Check: Security Check

✨ Finishing Touches

📝 Generate Docstrings

🧪 Generate unit tests

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch remove-old-config

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

Review comments: Directly reply to a review comment made by CodeRabbit. Example:
- I pushed a fix in commit <commit_id>, please review it.
- Explain this complex logic.
- Open a follow-up GitHub issue for this discussion.
Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
- @coderabbitai explain this code block.
- @coderabbitai modularize this function.
PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
- @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
- @coderabbitai read src/utils.ts and explain its main purpose.
- @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
- @coderabbitai help me debug CodeRabbit configuration file.

Support

Need help? Create a ticket on our support page for assistance with any issues or questions.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

@coderabbitai pause to pause the reviews on a PR.
@coderabbitai resume to resume the paused reviews.
@coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
@coderabbitai full review to do a full review from scratch and review all the files again.
@coderabbitai summary to regenerate the summary of the PR.
@coderabbitai generate docstrings to generate docstrings for this PR.
@coderabbitai generate sequence diagram to generate a sequence diagram of the changes in this PR.
@coderabbitai generate unit tests to generate unit tests for this PR.
@coderabbitai resolve resolve all the CodeRabbit review comments.
@coderabbitai configuration to show the current CodeRabbit configuration for the repository.
@coderabbitai help to get help.

Other keywords and placeholders

Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (`.coderabbit.yaml`)

You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
Please see the configuration documentation for more information.
If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

Visit our Documentation for detailed information on how to use CodeRabbit.
Join our Discord Community to get help, request features, and share feedback.
Follow us on X/Twitter for updates and announcements.

coderabbitai

Actionable comments posted: 1

♻️ Duplicate comments (5)

apps/backend/src/lib/ai-chat/email-theme-adapter.ts (1)
21-21: Config path updated correctly, but potential runtime error remains unaddressed.

The change from completeConfig to config is correct and consistent with the refactor. However, the code still accesses themes[context.threadId].tsxSource without safe navigation, which could cause a runtime error if the threadId doesn't exist in the themes object.

Consider applying the previously suggested fix:
- const currentEmailTheme = context.tenancy.config.emails.themes[context.threadId].tsxSource || "";
+ const currentEmailTheme = context.tenancy.config.emails.themes[context.threadId]?.tsxSource || "";
apps/backend/src/app/api/latest/auth/otp/send-sign-in-code/route.tsx (1)

35-36: Changes look good and align with configuration refactoring.

The update from tenancy.config.magic_link_enabled to tenancy.config.auth.otp.allowSignIn correctly reflects the new nested configuration structure, and the error message appropriately describes OTP sign-in functionality.

apps/backend/src/app/api/latest/auth/passkey/register/verification-code-handler.tsx (1)

72-75: Verify the domain validation logic handles the new structure correctly.

The change from a flat domains array to the nested trustedDomains object structure is implemented correctly. The filtering for entries with baseUrl and subsequent mapping is appropriate for the new data structure.

apps/backend/src/lib/redirect-urls.tsx (1)

14-17: Domain validation correctly adapted to new structure.

The logic properly handles the transition to the trustedDomains object structure, correctly checking for the presence of baseUrl before processing domains.
apps/backend/src/oauth/index.tsx (1)
60-60: Error message incorrectly states 'for shared providers' but applies to all providers.

The error message is misleading since provider.type is required for all providers, not just shared ones. At this point in the code, we haven't yet checked if the provider is shared.
-  const providerType = provider.type || throwErr("Provider type is required for shared providers");
+  const providerType = provider.type || throwErr("Provider type is required");

🧹 Nitpick comments (1)

apps/backend/src/app/api/latest/integrations/custom/domains/crud.tsx (1)
48-50: Consider extracting shared domain conversion logic.

This domainConfigToLegacyConfig function is identical to the one in neon/domains/crud.tsx. Consider extracting it to a shared utility module to avoid duplication and ensure consistency.

Create a shared utility file:
// apps/backend/src/lib/domain-utils.tsx
import { Tenancy } from "@/lib/tenancies";
import { throwErr } from "@stackframe/stack-shared/dist/utils/errors";

export function domainConfigToLegacyConfig(domain: Tenancy['config']['domains']['trustedDomains'][string]) {
  return { 
    domain: domain.baseUrl || throwErr('Domain base URL is required'), 
    handler_path: domain.handlerPath 
  };
}
Then import and use it in both CRUD files.

📜 Review details

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between d573acd and 079df58.

📒 Files selected for processing (45)

apps/backend/prisma/seed.ts (1 hunks)
apps/backend/src/app/api/latest/(api-keys)/handlers.tsx (7 hunks)
apps/backend/src/app/api/latest/auth/oauth/authorize/[provider_id]/route.tsx (2 hunks)
apps/backend/src/app/api/latest/auth/oauth/callback/[provider_id]/route.tsx (4 hunks)
apps/backend/src/app/api/latest/auth/otp/send-sign-in-code/route.tsx (1 hunks)
apps/backend/src/app/api/latest/auth/otp/sign-in/verification-code-handler.tsx (1 hunks)
apps/backend/src/app/api/latest/auth/passkey/initiate-passkey-authentication/route.tsx (1 hunks)
apps/backend/src/app/api/latest/auth/passkey/initiate-passkey-registration/route.tsx (1 hunks)
apps/backend/src/app/api/latest/auth/passkey/register/verification-code-handler.tsx (3 hunks)
apps/backend/src/app/api/latest/auth/passkey/sign-in/verification-code-handler.tsx (3 hunks)
apps/backend/src/app/api/latest/auth/password/reset/verification-code-handler.tsx (1 hunks)
apps/backend/src/app/api/latest/auth/password/send-reset-code/route.tsx (1 hunks)
apps/backend/src/app/api/latest/auth/password/set/route.tsx (1 hunks)
apps/backend/src/app/api/latest/auth/password/sign-in/route.tsx (1 hunks)
apps/backend/src/app/api/latest/auth/password/sign-up/route.tsx (2 hunks)
apps/backend/src/app/api/latest/auth/password/update/route.tsx (1 hunks)
apps/backend/src/app/api/latest/connected-accounts/[user_id]/[provider_id]/access-token/crud.tsx (1 hunks)
apps/backend/src/app/api/latest/emails/render-email/route.tsx (2 hunks)
apps/backend/src/app/api/latest/emails/send-email/route.tsx (1 hunks)
apps/backend/src/app/api/latest/integrations/custom/domains/crud.tsx (3 hunks)
apps/backend/src/app/api/latest/integrations/neon/domains/crud.tsx (3 hunks)
apps/backend/src/app/api/latest/integrations/neon/oauth-providers/crud.tsx (3 hunks)
apps/backend/src/app/api/latest/internal/email-templates/[templateId]/route.tsx (1 hunks)
apps/backend/src/app/api/latest/internal/email-templates/route.tsx (1 hunks)
apps/backend/src/app/api/latest/internal/email-themes/[id]/route.tsx (3 hunks)
apps/backend/src/app/api/latest/internal/email-themes/route.tsx (1 hunks)
apps/backend/src/app/api/latest/internal/projects/crud.tsx (3 hunks)
apps/backend/src/app/api/latest/internal/projects/current/crud.tsx (3 hunks)
apps/backend/src/app/api/latest/internal/send-sign-in-invitation/route.tsx (1 hunks)
apps/backend/src/app/api/latest/oauth-providers/crud.tsx (1 hunks)
apps/backend/src/app/api/latest/projects/current/crud.tsx (2 hunks)
apps/backend/src/app/api/latest/teams/crud.tsx (1 hunks)
apps/backend/src/app/api/latest/users/crud.tsx (4 hunks)
apps/backend/src/lib/ai-chat/email-template-adapter.ts (1 hunks)
apps/backend/src/lib/ai-chat/email-theme-adapter.ts (1 hunks)
apps/backend/src/lib/email-rendering.tsx (2 hunks)
apps/backend/src/lib/emails.tsx (2 hunks)
apps/backend/src/lib/permissions.tsx (8 hunks)
apps/backend/src/lib/redirect-urls.tsx (1 hunks)
apps/backend/src/lib/tenancies.tsx (2 hunks)
apps/backend/src/oauth/index.tsx (3 hunks)
apps/backend/src/oauth/model.tsx (4 hunks)
apps/backend/src/prisma-client.tsx (1 hunks)
apps/backend/src/route-handlers/verification-code-handler.tsx (1 hunks)
apps/e2e/tests/backend/endpoints/api/v1/auth/otp/send-sign-in-code.test.ts (1 hunks)

🧰 Additional context used

📓 Path-based instructions (5)

**/*.{ts,tsx}