Uh oh!
There was an error while loading. Please reload this page.
Staging - #16
Conversation
There was a problem hiding this comment.
Pull request overview
Updates the admin web UI and backend message-send handler to support sending a single message to multiple recipients (comma-separated), alongside some permission/UX improvements and documentation updates.
Changes:
- Add multi-recipient support in Devices UI and split/publish-per-recipient behavior in the API handler.
- Improve Tokens page “no access” UX by showing an access-restricted card instead of an empty table message.
- Update architecture + usage docs to reflect multi-recipient sending; refresh built web
distentrypoint reference.
Reviewed changes
Copilot reviewed 5 out of 8 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| pkg/adminweb/web/src/pages/Tokens.jsx | Renders an “Access Restricted” card when the user lacks tokens:read:*; formatting cleanup. |
| pkg/adminweb/web/src/pages/Devices.jsx | Adds multi-recipient contact collection UI (chips + add button) and sends comma-joined contacts to the API. |
| pkg/adminweb/web/dist/index.html | Updates the hashed JS asset reference for the built admin web bundle. |
| internal/api/v1/handlers/devices/send.go | Splits comma-separated contact and publishes one RabbitMQ message per address; adjusts success message text. |
| docs/architecture/send-message-flow.md | Updates sequence diagram to include splitting + per-address publish loop. |
| docs/USAGE.md | Adds examples for comma-separated multi-recipient usage (JSON + multipart). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
| addresses := strings.SplitSeq(req.Contact, ",") | ||
| for address := range addresses { | ||
| address = strings.TrimSpace(address) | ||
| if address == "" { | ||
| continue | ||
| } | ||
| if err := producer.Publish(exchangeName, routingKey, message, rabbitmq.DefaultPublishOptions()); err != nil { | ||
| logger.Error(fmt.Sprintf("RabbitMQ message publish failed: %v\n%s", err, debug.Stack())) | ||
| return echo.ErrInternalServerError | ||
| message := queuedMessage{ | ||
| DeviceID: deviceID, | ||
| Contact: address, | ||
| PlatformName: req.Platform, | ||
| Text: req.Text, | ||
| Username: matrixUsername, | ||
| FileContent: fileContent, | ||
| FileExtension: fileExtension, | ||
| } | ||
| if err := producer.Publish(exchangeName, routingKey, message, rabbitmq.DefaultPublishOptions()); err != nil { | ||
| logger.Error(fmt.Sprintf("RabbitMQ message publish failed for address %s: %v\n%s", address, err, debug.Stack())) | ||
| return echo.ErrInternalServerError | ||
| } | ||
| } |
There was a problem hiding this comment.
@copilot open an issue for this feedback tag as enhancement
There was a problem hiding this comment.
I don't have the capability to create GitHub issues with my available tools. You can open the issue manually using the details below:
Title: Enforce max-recipients limit on comma-separated contact field to prevent DoS
Labels:enhancement
Body:
Allowing comma-separated recipients in the
POST /api/v1/devices/{device_id}/messageendpoint means a single request can trigger an unbounded number of RabbitMQ publishes (one per address). This is a potential abuse/DoS vector and can cause long request times for legitimate users.Proposed changes:
- Define a configurable constant (e.g.
maxRecipients = 50) for the maximum number of recipients allowed per request.- Define a configurable constant (e.g.
maxContactLength = 1024) for the maximum byte length of the rawcontactfield.- Return HTTP 400 with a clear error message when either limit is exceeded.
Affected file:
internal/api/v1/handlers/devices/send.go(loop starting around line 162)
Agent-Logs-Url: https://github.com/shortmesh/Interface-API/sessions/e6a25409-2ec8-411f-8e62-f9de63676d2d Co-authored-by: PromiseFru <33162641+PromiseFru@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Agent-Logs-Url: https://github.com/shortmesh/Interface-API/sessions/eb59f7cc-87b0-4301-af55-c5d475c56e42 Co-authored-by: PromiseFru <33162641+PromiseFru@users.noreply.github.com>
…ger @success Agent-Logs-Url: https://github.com/shortmesh/Interface-API/sessions/b365e1c8-244d-447e-8777-2d28f70b0181 Co-authored-by: PromiseFru <33162641+PromiseFru@users.noreply.github.com>
No description provided.