chore(audit): add fetch timeouts on the checkout path by kk-agent · Pull Request #2562 · groupthinking/EventRelay

kk-agent · 2026-11-03T16:05:01Z

Outcome

Live checkout fetches now stop after 30 seconds, matching apps/web/src/lib/billing/grok-client.ts. The video generate route no longer casts aspectRatio with as any.

Findings

Done: apps/web/src/lib/billing/turnstile.ts siteverify POST now passes signal: AbortSignal.timeout(30_000).
Done: apps/web/src/components/billing/ProCheckoutButton.tsx checkout fetch.
Done: apps/web/src/components/billing/ProRenewPanel.tsx status and renew fetches.
Done: apps/web/src/components/billing/CheckoutSuccessActivator.tsx activate fetch.
Done: apps/web/src/app/api/video/generate/route.ts replaces both aspectRatio as any uses with isAllowedAspectRatio against ['16:9', '9:16', '1:1', '4:3'].
Not in this diff: StudioIdeChat.tsx and lib/action-surface.ts (follow-up on PR feat(web): synchronized Step Runner for Studio Deliverables #2441).

rg on this branch: each of those four checkout fetch calls has one signal: AbortSignal.timeout(30_000). rg "as any" apps/web/src/app/api/video/generate/route.ts is empty.

Verification

Local, head 9ec93e8d1:

npm ci --legacy-peer-deps exit 0
cd apps/web && npm run lint exit 0
cd apps/web && npm run type-check exit 0
npx vitest run src/lib/billing/__tests__/turnstile.test.ts src/app/api/__tests__/video-generate-route.test.ts — 16 passed
npm run build:web exit 0
ORIGIN_GATE_REDIS_TESTS=1 npm --workspace=apps/web test — 1560 passed, 1 skipped, 2 failed in src/lib/__tests__/home-sell-surface.test.ts

GitHub checks on this PR:

build passed (https://github.com/groupthinking/EventRelay/actions/runs/41670542455/job/126037407575)
lint-frontend, both Python test jobs, security scans, and coverage passed
test-frontend failed on the same two home-sell-surface.test.ts assertions already failing on main (cd7e1998f, run https://github.com/groupthinking/EventRelay/actions/runs/41659258955): the test wants prepares proposed work and build rails for you to review in Studio, and app/page.tsx says Studio prepares proposed work and build rails for you to review. This diff does not touch that file. Vitest artifact: 1560 passed, 2 failed, same counts as main.

No Python files changed.

Closing keyword check

Risk

Low. A hung checkout request now rejects through the existing catch paths. Invalid aspect ratios still return 400. Rollback is reverting this commit.

Related: #2328

Closes #2580

Bound the live checkout fetches with AbortSignal.timeout(30_000) and replace aspectRatio `as any` with an allow-list type guard. Co-authored-by: KK <kk-agent@users.noreply.github.com>

vercel · 2026-11-03T16:05:18Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
v0-uvai	Ready	Preview, v0	Nov 4, 2026 7:13am UTC

coderabbitai · 2026-11-03T16:05:21Z

Important

Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

Source mode: Auto
Repository: groupthinking/EventRelay
Branch: cursor/checkout-fetch-timeouts-7822
File: .coderabbit.yaml
Commit: 7e37802
Layers: Repository YAML
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 7f39f74b-8b47-4c6c-b1e7-9a386c00ee59

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

chatgpt-codex-connector · 2026-11-03T16:05:27Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-03T16:06:41.467626Z	`9ec93e8`	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

github-actions · 2026-11-03T16:08:06Z

✅ E2E Test Results: ALL TESTS PASSED

Metric	Value
Status	🟢 GREEN
Total Tests
Passed	16
Failed
Deployment	https://v0-uvai-5uy8bdgfa-garv1.vercel.app

Test Output

every request without persisting it�[32m 1�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mTemplate Gallery�[2m > �[22mhomepage returns 200 with HTML�[33m 311�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mTemplate Gallery�[2m > �[22mfeatures page contains template/workflow markup�[33m 318�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mTemplate Gallery�[2m > �[22mfeatures page surfaces at least 5 workflow/template indicators�[32m 230�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mVideo Pack Pipeline�[2m > �[22mPOST /api/video/pack accepts a YouTube URL without hanging�[33m 2388�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mVideo Pack Pipeline�[2m > �[22mGET /api/video/pack resolves to a ready pack with evidence lineage�[33m 793�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mError Handling�[2m > �[22mmissing URL returns 400, not a hang�[32m 177�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mError Handling�[2m > �[22minvalid URL returns 400 quickly, not a hang�[32m 188�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mError Handling�[2m > �[22mPOST /api/video/pack with no body returns 400�[32m 174�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mDashboard�[2m > �[22m/dashboard returns 200�[32m 246�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mDashboard�[2m > �[22m/dashboard contains agent or pipeline visualization markup�[32m 188�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mAPI Health�[2m > �[22mGET /api returns a response (not 404)�[33m 331�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mAPI Health�[2m > �[22mretired /api/pipeline routes are gone (no pipeline served)�[32m 93�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mStatic Assets�[2m > �[22mhomepage has proper meta tags�[33m 337�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mStatic Assets�[2m > �[22m/features page returns 200�[32m 214�[2mms�[22m�[39m

�[2m Test Files �[22m �[1m�[32m1 passed�[39m�[22m�[90m (1)�[39m
�[2m      Tests �[22m �[1m�[32m16 passed�[39m�[22m�[90m (16)�[39m
�[2m   Start at �[22m 16:07:57
�[2m   Duration �[22m 7.85s�[2m (transform 39ms, setup 0ms, import 50ms, tests 7.70s, environment 0ms)�[22m

github-actions · 2026-11-03T16:09:36Z

⚠️ Repository reconciliation: this PR does not reference exactly one canonical issue.

Please add a Closes #<issue> reference in the PR description so it can be tracked against the delivery plan.

See governance: #898

github-actions · 2026-11-04T07:17:47Z

✅ E2E Test Results: ALL TESTS PASSED

Metric	Value
Status	🟢 GREEN
Total Tests
Passed	16
Failed
Deployment	https://v0-uvai-nbd074avf-garv1.vercel.app

Test Output

ss on every request without persisting it�[32m 1�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mTemplate Gallery�[2m > �[22mhomepage returns 200 with HTML�[32m 102�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mTemplate Gallery�[2m > �[22mfeatures page contains template/workflow markup�[32m 157�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mTemplate Gallery�[2m > �[22mfeatures page surfaces at least 5 workflow/template indicators�[32m 73�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mVideo Pack Pipeline�[2m > �[22mPOST /api/video/pack accepts a YouTube URL without hanging�[33m 1997�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mVideo Pack Pipeline�[2m > �[22mGET /api/video/pack resolves to a ready pack with evidence lineage�[33m 616�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mError Handling�[2m > �[22mmissing URL returns 400, not a hang�[32m 65�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mError Handling�[2m > �[22minvalid URL returns 400 quickly, not a hang�[32m 111�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mError Handling�[2m > �[22mPOST /api/video/pack with no body returns 400�[32m 54�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mDashboard�[2m > �[22m/dashboard returns 200�[32m 136�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mDashboard�[2m > �[22m/dashboard contains agent or pipeline visualization markup�[32m 97�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mAPI Health�[2m > �[22mGET /api returns a response (not 404)�[32m 187�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mAPI Health�[2m > �[22mretired /api/pipeline routes are gone (no pipeline served)�[32m 59�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mStatic Assets�[2m > �[22mhomepage has proper meta tags�[32m 97�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mStatic Assets�[2m > �[22m/features page returns 200�[32m 87�[2mms�[22m�[39m

�[2m Test Files �[22m �[1m�[32m1 passed�[39m�[22m�[90m (1)�[39m
�[2m      Tests �[22m �[1m�[32m16 passed�[39m�[22m�[90m (16)�[39m
�[2m   Start at �[22m 07:17:41
�[2m   Duration �[22m 5.31s�[2m (transform 45ms, setup 0ms, import 56ms, tests 5.16s, environment 0ms)�[22m

chore(audit): add fetch timeouts on the checkout path

9ec93e8

Bound the live checkout fetches with AbortSignal.timeout(30_000) and replace aspectRatio `as any` with an allow-list type guard. Co-authored-by: KK <kk-agent@users.noreply.github.com>

kk-agent requested a review from groupthinking as a code owner November 3, 2026 16:05

vercel Bot deployed to Preview November 3, 2026 16:06

View deployment

github-actions Bot added javascript Pull requests that update javascript code tests labels Nov 3, 2026

github-actions Bot mentioned this pull request Nov 3, 2026

[automation] Repository drift report #2306

Open

Merge branch 'main' into cursor/checkout-fetch-timeouts-7822

7e37802

vercel Bot deployed to Preview November 4, 2026 07:13

View deployment

kk-agent mentioned this pull request Nov 4, 2026

Audit cleanup: chore(audit): add fetch timeouts on the checkout path #2580

Closed

kk-agent merged commit e17f1da into main Nov 4, 2026
32 of 33 checks passed

kk-agent deleted the cursor/checkout-fetch-timeouts-7822 branch November 4, 2026 08:58

groupthinking mentioned this pull request Nov 4, 2026

Repo audit cleanup (Nov 2026) #2587

Closed

Navigation Menu

Repository navigation

chore(audit): add fetch timeouts on the checkout path - #2562

chore(audit): add fetch timeouts on the checkout path#2562
kk-agent merged 2 commits into
mainfrom
cursor/checkout-fetch-timeouts-7822

kk-agent commented Nov 3, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Nov 3, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Nov 3, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Nov 3, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Nov 3, 2026

Uh oh!

github-actions Bot commented Nov 3, 2026

Uh oh!

github-actions Bot commented Nov 4, 2026

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

kk-agent commented Nov 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Outcome

Findings

Verification

Closing keyword check

Risk

Uh oh!

vercel Bot commented Nov 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Nov 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Nov 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

github-actions Bot commented Nov 3, 2026

✅ E2E Test Results: ALL TESTS PASSED

Uh oh!

github-actions Bot commented Nov 3, 2026

Uh oh!

github-actions Bot commented Nov 4, 2026

✅ E2E Test Results: ALL TESTS PASSED

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

kk-agent commented Nov 3, 2026 •

edited

Loading

vercel Bot commented Nov 3, 2026 •

edited

Loading

coderabbitai Bot commented Nov 3, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Nov 3, 2026 •

edited

Loading