[#553] Add Saicharan Ramineni developer application - #554
Conversation
Co-authored-by: Codex <codex@openai.com>
Co-authored-by: Codex <codex@openai.com>
Co-authored-by: Codex <codex@openai.com>
📝 WalkthroughWalkthroughAdds the public Priority: ➖ Normal Merge Risk: 🟠 High · up to A compromised portfolio dependency could access Blade-origin state, and upstream or WebGL failures can leave visitors with blank or inaccessible content. These issues should be corrected before merge. 🚥 Pre-merge checks | ✅ 6 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (6 passed)
Full details: Docstring CoverageExplanation Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 48 functions across 10 files. (7 skipped: 7 unsupported.) Full details: Validated Env AccessExplanation
✨ Finishing Touches🧪 Generate unit tests (beta)
Warning Some tools did not complete. Review the errors below. 🔧 ESLint
apps/blade/package.jsonESLint skipped: missing config or dependency (missing-dependency). The ESLint configuration references a package that is not available in the sandbox. apps/blade/scripts/generate-tech-knight-model.mjsESLint skipped: the matched ESLint configuration already failed (missing-dependency). apps/blade/src/app/_components/applications/saicharan-portfolio-gate.tsxESLint skipped: the matched ESLint configuration already failed (missing-dependency).
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
Note
Quiet mode is enabled, so only the most important comments were posted inline. Other review comments are grouped below.
🟡 Other comments (3)
apps/blade/src/app/_components/applications/tech-knight-arrival-shaders.ts-54-54 (1)
54-54: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winUse an increasing edge order for
smoothstep.
smoothstep(0.96, 0.24, discRadius)has undefined results in GLSL ES. Replace it with(1.0 - smoothstep(0.24, 0.96, discRadius)).apps/blade/scripts/generate-tech-knight-model.py-94-96 (1)
94-96: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winReverse the
prism_xzside-face winding.For counter-clockwise x-z points such as
Faceplate,(index, following, following + count, index + count)produces inward-facing side normals. Use the outward-facing order:🐛 Proposed fix for the side winding
for index in range(count): following = (index + 1) % count - faces.append((index, following, following + count, index + count)) + faces.append((index, index + count, following + count, following)).forge/features/saicharan-blade-portfolio/test-cases.md-7-7 (1)
7-7: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winKeep the server bridge in the test scope.
test-cases.mdis the behavioral source for implementation and test-generation workflows. TC-005 exercisesGET /saicharan-ramineni/site, so the exclusion of backend behavior can omit or reject these bridge checks. Exclude authentication and unrelated backend behavior instead, or remove the bridge checks from TC-005.
🧹 Nitpick comments (1)
apps/blade/src/app/_components/applications/tech-knight-journey.module.css (1)
11-11: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winMap the scene palette to design-system tokens.
This module introduces a new palette of raw hex and
rgb()literals (#010207,#7fe9ff,rgb(185 207 218 / 72%)). The Blade guidelines require usingapps/blade/DESIGN_SYSTEM.mdtokens before adding new design decisions. Define the scene-specific values as local custom properties derived from existing tokens, or document the exception.Source: Coding guidelines
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: QUIET
Plan: Advanced
Run ID: 8b11021c-51c3-46b4-9057-bd03d8baeda7
⛔ Files ignored due to path filters (4)
.forge/features/saicharan-blade-portfolio/portfolio-handoff.jpgis excluded by!**/*.jpg.forge/features/saicharan-blade-portfolio/tech-knight-extraction.jpgis excluded by!**/*.jpg.forge/features/saicharan-blade-portfolio/tech-knight-preview.jpgis excluded by!**/*.jpgpnpm-lock.yamlis excluded by!**/pnpm-lock.yaml,!pnpm-lock.yaml
📒 Files selected for processing (18)
.forge/features/saicharan-blade-portfolio/spec.md.forge/features/saicharan-blade-portfolio/srd.md.forge/features/saicharan-blade-portfolio/status.md.forge/features/saicharan-blade-portfolio/test-cases.mdapps/blade/package.jsonapps/blade/public/saicharan/tech-knight.glbapps/blade/scripts/generate-tech-knight-model.mjsapps/blade/scripts/generate-tech-knight-model.pyapps/blade/src/app/_components/applications/saicharan-portfolio-gate.tsxapps/blade/src/app/_components/applications/saicharan-portfolio.module.cssapps/blade/src/app/_components/applications/tech-knight-arrival-shaders.tsapps/blade/src/app/_components/applications/tech-knight-black-hole-effects.tsapps/blade/src/app/_components/applications/tech-knight-journey-markup.tsxapps/blade/src/app/_components/applications/tech-knight-journey.module.cssapps/blade/src/app/_components/applications/tech-knight-journey.tsxapps/blade/src/app/_components/applications/tech-knight-model-materials.tsapps/blade/src/app/saicharan-ramineni/page.tsxapps/blade/src/app/saicharan-ramineni/site/route.ts
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.
|
|
||
| The App Router page renders a Blade-local client gate. Its cinematic component initializes Three.js, loads and normalizes the Blender-authored `.glb` Tech Knight, and begins with the real model fully visible at a viewport-filling scale. A time-based sequence holds that hero composition, forms a shader-driven accretion disc and event horizon behind the model, bends stars and particle trails toward the core, then moves, stretches, rotates, dims, and shrinks the live GLB into the singularity. Dynamic rim lights, spatial rings, lensing geometry, a terminal energy flash, and Unreal bloom support the departure without a raster placeholder. | ||
|
|
||
| The full-viewport sandboxed iframe begins loading behind the cinematic layer. Once the model reaches the event horizon and the iframe is ready, the gate expands a circular clip from the singularity's screen position until the personal site occupies the viewport; the Three.js layer fades only after the reveal is established. `GET /saicharan-ramineni/site` fetches only the fixed personal-site origin, injects a base URL for remote assets, omits the upstream `X-Frame-Options: DENY` header, and returns cached HTML. Because Cloudflare Rocket Loader rewrites the portfolio's scripts to request-scoped inert MIME types, the bridge restores those scripts to `text/javascript`, removes their loader metadata, and omits the redundant Rocket Loader script. A narrow history guard retries cross-origin `pushState` and `replaceState` calls without a URL, preventing Next.js from resolving the local bridge path against the remote base URL. This lets the original portfolio hydrate and run its Gargantua WebGL renderer unchanged. Hash navigation stays inside the frame; route links open on the personal-site origin. The fixed-source frame grants scripts and same-origin access so its runtime can use the browser APIs it requires. |
There was a problem hiding this comment.
🔒 Security & Privacy | 🛡️ Analyzed with Security Review | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
sed -n '1,140p' apps/blade/src/app/_components/applications/saicharan-portfolio-gate.tsx
printf '\n--- route ---\n'
sed -n '1,120p' apps/blade/src/app/saicharan-ramineni/site/route.tsRepository: KnightHacks/forge
Length of output: 5797
🤖 get_repo_knowledge executed:
get_repo_knowledge KnightHacks/forge /tmp/coderabbit-repo-knowledge/knighthacks-forge-24c72cfe
Length of output: 3924
🏁 Script executed:
sed -n '1,140p' apps/blade/src/app/_components/applications/saicharan-portfolio-gate.tsx
sed -n '1,120p' apps/blade/src/app/saicharan-ramineni/site/route.tsRepository: KnightHacks/forge
Length of output: 5782
Security Misconfiguration
Reachability: External
Exploitability: Moderate
CWE: CWE-829 — Inclusion of Functionality from Untrusted Control Sphere
Serve the bridged portfolio from a separate origin.
allow-scripts with allow-same-origin lets a compromised portfolio script access same-origin Blade state through window.parent.
| const revealPortfolio = revealRequested && portfolioReady; | ||
|
|
||
| useEffect(() => { | ||
| const timeout = window.setTimeout(() => setPortfolioReady(true), 3000); |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Do not mark the portfolio ready before it loads.
apps/blade/src/app/_components/applications/saicharan-portfolio-gate.tsx#L17-L17: SetportfolioReadyonly fromiframe.onLoad. Use the deadline for a visible failure state, not readiness.apps/blade/src/app/saicharan-ramineni/site/route.ts#L68-L68: Apply a fetch deadline and returnunavailableResponse()when the upstream does not respond.
📍 Affects 2 files
apps/blade/src/app/_components/applications/saicharan-portfolio-gate.tsx#L17-L17(this comment)apps/blade/src/app/saicharan-ramineni/site/route.ts#L68-L68
| .journey[data-model-ready="true"] { | ||
| opacity: 1; | ||
| } |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Reveal the journey on the failure paths.
.journey stays at opacity: 0 unless data-model-ready="true" is set. tech-knight-journey.tsx never sets that attribute when the model fails to load (it sets data-model-error) or when createRenderer returns undefined. In both cases the section stays invisible while it remains mounted, so the h1, the identity text, and the focusable header links are hidden but still reachable by keyboard.
♻️ Proposed change
.journey[data-model-ready="true"] {
opacity: 1;
}
+
+.journey[data-model-error="true"],
+.journey[data-webgl-error="true"] {
+ opacity: 1;
+}In tech-knight-journey.tsx, set the matching flag in the WebGL failure branch:
const renderer = createRenderer(canvas);
if (!renderer) {
+ journey.dataset.webglError = "true";
options.onFailure();
return;
}Source: Path instructions
| }); | ||
| if (!response.ok) return unavailableResponse(); | ||
| const document = injectFrameBridge(await response.text()); | ||
| return new Response(document, { |
There was a problem hiding this comment.
🔒 Security & Privacy | 🛡️ Analyzed with Security Review | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- route.ts ---'
sed -n '1,130p' apps/blade/src/app/saicharan-ramineni/site/route.ts
printf '%s\n' '--- saicharan-portfolio-gate.tsx ---'
sed -n '1,100p' apps/blade/src/app/_components/applications/saicharan-portfolio-gate.tsxRepository: KnightHacks/forge
Length of output: 5836
🤖 get_repo_knowledge executed:
get_repo_knowledge KnightHacks/forge /tmp/coderabbit-repo-knowledge/knighthacks-forge-24c72cfe/learnings /tmp/coderabbit-repo-knowledge/knighthacks-forge-24c72cfe/conventions
Length of output: 19543
XSS
Reachability: External
Exploitability: Difficult
CWE: CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Isolate the proxied document from the Blade origin.
The route serves external HTML at the Blade origin, and the iframe enables both allow-scripts and allow-same-origin. Remove allow-same-origin, or serve the document from a separate origin before allowing scripts.
📍 Affects 2 files
apps/blade/src/app/saicharan-ramineni/site/route.ts#L74-L74(this comment)apps/blade/src/app/_components/applications/saicharan-portfolio-gate.tsx#L46-L46
1 participant
Why
Submit Saicharan Ramineni's developer application as a public Blade route.
What
Closes: #553
/saicharan-ramineni: a custom 3D Tech Knight is pulled into a black hole, revealing the live portfolio.Test Plan
pnpm formatNODE_OPTIONS=--max-old-space-size=8192 pnpm lintNODE_OPTIONS=--max-old-space-size=8192 pnpm typecheckpnpm analyze:react:changedpnpm --filter=@forge/blade buildChecklist
pnpm db:generateand committed the generated files inpackages/db/drizzle/