Conversation
🔐 Codex Security Review
Review SummaryOverall Risk: MEDIUM Findings[MEDIUM]
|
There was a problem hiding this comment.
Pull request overview
Adds URL-backed, per-tab fleet filtering (Sites/Buildings/Racks/Groups) with shared issue-component + telemetry range filter semantics, and plumbs the new filter fields through proto contracts, server handlers/domain logic, SQL-backed collection queries, and the ProtoFleet UI (chips, saved views).
Changes:
- Extend protobuf contracts to carry issue-component filters and fleet list telemetry range filters across fleet tabs.
- Add a shared server-side
fleetlistfilterparser/matcher, apply it to rollup-backed Sites/Buildings lists, and push rack/group filters (site/building/zone + telemetry) into SQL list/count paths. - Update ProtoFleet UI to persist per-tab filters in URL params (including “unassigned” as
null), add numeric-range filter chips, and include the new filters in saved views.
Reviewed changes
Copilot reviewed 46 out of 57 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| server/sqlc/queries/device_set.sql | Add building label to rack-details batch query for miner snapshots. |
| server/internal/handlers/sites/handler.go | Parse new issue/telemetry filters and pass into domain ListSites. |
| server/internal/handlers/deviceset/handler_test.go | Add handler tests covering site + telemetry filter validation and behavior. |
| server/internal/handlers/deviceset/convert.go | Validate new site_ids cap; parse/validate telemetry ranges into store filter. |
| server/internal/handlers/buildings/handler.go | Parse new issue/telemetry filters and pass into domain ListBuildings. |
| server/internal/domain/stores/sqlstores/collection.go | Populate rack details with building label. |
| server/internal/domain/stores/sqlstores/collection_sort.go | Add site predicates for racks; add telemetry aggregation join + range predicates for list/count queries. |
| server/internal/domain/stores/sqlstores/collection_sort_test.go | Add query-builder tests for site + telemetry filters and arg ordering. |
| server/internal/domain/stores/interfaces/collection.go | Extend DeviceSetFilter (site + telemetry ranges) and rack-details struct (building label). |
| server/internal/domain/sites/service.go | Apply fleetlistfilter matching to authorized list stats for Sites. |
| server/internal/domain/sites/service_stats_test.go | Update Sites stats tests for new ListSites signature. |
| server/internal/domain/fleetmanagement/service.go | Include building_label in miner snapshot population. |
| server/internal/domain/fleetlistfilter/filter.go | New shared parser/matcher for issue-component + telemetry range filters. |
| server/internal/domain/fleetlistfilter/filter_test.go | Unit tests for filter parsing and matching semantics. |
| server/internal/domain/collection/service.go | Validate new site_ids filter ownership and enforce type constraints. |
| server/internal/domain/buildings/service.go | Apply fleetlistfilter matching to authorized list stats for Buildings. |
| server/internal/domain/buildings/service_test.go | Update Buildings service tests for new signature. |
| server/internal/domain/buildings/service_stats_test.go | Update Buildings stats tests for new signature. |
| server/generated/sqlc/device_set.sql.go | Generated — sqlc output for rack-details query updates (building label). |
| server/generated/grpc/common/v1/fleet_list_stats.pb.go | Generated — adds telemetry filter enum/message types. |
| proto/sites/v1/sites.proto | Add issue-component + telemetry range filters to ListSitesRequest. |
| proto/fleetmanagement/v1/fleetmanagement.proto | Add building_label to MinerStateSnapshot. |
| proto/device_set/v1/device_set.proto | Add rack site_ids/include_no_site and telemetry range filters to ListDeviceSetsRequest. |
| proto/common/v1/fleet_list_stats.proto | Add FleetListTelemetryField + FleetListTelemetryRangeFilter. |
| proto/buildings/v1/buildings.proto | Add issue-component + telemetry range filters to ListBuildingsRequest. |
| client/src/shared/components/List/Filters/FilterChipsBar.tsx | Support numeric-range filter categories + modal chips in shared filter bar. |
| client/src/protoFleet/hooks/useDeviceSetListState.ts | Thread additional list filters (site/unassigned/telemetry) into list requests. |
| client/src/protoFleet/features/groupManagement/pages/GroupsPage.tsx | URL-backed issue + telemetry filters for Groups list, wired to shared chips UI. |
| client/src/protoFleet/features/fleetManagement/views/viewSummary.ts | Render null URL sentinel as “Unassigned” in view summaries. |
| client/src/protoFleet/features/fleetManagement/views/savedViews.ts | Include Buildings/Sites tab filter keys (incl. telemetry) in saved views. |
| client/src/protoFleet/features/fleetManagement/views/savedViews.test.ts | Add coverage for Buildings/Sites saved-view key scoping. |
| client/src/protoFleet/features/fleetManagement/utils/telemetryFilterBounds.ts | Add mapping from UI telemetry keys to fleet-list telemetry enum. |
| client/src/protoFleet/features/fleetManagement/utils/filterUrlParams.ts | Add null sentinel handling for unassigned; add telemetry range URL encode/decode helpers. |
| client/src/protoFleet/features/fleetManagement/utils/filterUrlParams.test.ts | Add tests for unassigned placement URL encoding/decoding. |
| client/src/protoFleet/features/fleetManagement/pages/RacksPage.tsx | Move racks filters to URL-backed site/building/unassigned + telemetry; update chips UI. |
| client/src/protoFleet/features/fleetManagement/pages/FleetSitesPage.tsx | Add URL-backed issue + telemetry filters and filtered-list fetching for Sites page. |
| client/src/protoFleet/features/fleetManagement/pages/FleetBuildingsPage.tsx | Add URL-backed site/unassigned + issue + telemetry filters and updated empty states. |
| client/src/protoFleet/features/fleetManagement/components/MinerList/stories/statusMocks.ts | Story data update for new buildingLabel field. |
| client/src/protoFleet/features/fleetManagement/components/MinerList/stories/mocks.ts | Story data update for new buildingLabel field. |
| client/src/protoFleet/features/fleetManagement/components/MinerList/minerTableColumnPreferences.ts | Make site/building/rack columns configurable for miners table. |
| client/src/protoFleet/features/fleetManagement/components/MinerList/minerTableColumnPreferences.test.ts | Update tests for the new configurable miner columns. |
| client/src/protoFleet/features/fleetManagement/components/MinerList/MinerList.tsx | Add site/building/rack dropdown filters and support “Unassigned” sentinel values. |
| client/src/protoFleet/features/fleetManagement/components/MinerList/minerColConfig.tsx | Add renderer for site/building/rack columns. |
| client/src/protoFleet/features/fleetManagement/components/MinerList/constants.ts | Add new miner columns (site/building/rack) and titles. |
| client/src/protoFleet/features/fleetManagement/components/Fleet/Fleet.tsx | Provide available site/building label sources to saved-views context; fetch buildings list for labels. |
| client/src/protoFleet/api/useDeviceSets.ts | Add telemetry + site/unassigned filter fields to listGroups/listRacks calls. |
| client/src/protoFleet/api/sites.ts | Add ListSites request filter inputs (issues + telemetry). |
| client/src/protoFleet/api/generated/sites/v1/sites_pb.ts | Generated — sites contract updates. |
| client/src/protoFleet/api/generated/common/v1/fleet_list_stats_pb.ts | Generated — telemetry filter enum/message types. |
| client/src/protoFleet/api/generated/buildings/v1/buildings_pb.ts | Generated — buildings contract updates. |
| client/src/protoFleet/api/buildings.ts | Add ListBuildings request filter inputs (issues + telemetry). |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0f2ee7f6b6
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
|
🤖 Addressed the security review findings in b934004: active Sites/Buildings stats filters now fail closed to empty rows when no returned rows are stats-authorized, and telemetry range filters now require successful telemetry rollups instead of silently turning telemetry failures into empty filtered results. Unfiltered list stats keep the previous best-effort telemetry behavior. Added focused Sites/Buildings coverage for both cases. Posted by Codex (GPT-5) on behalf of Flesher |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b934004ccc
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 05c268a53e
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5d8142cc19
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: dca96576a9
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0b9407376f
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: df54d42050
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ff328d2835
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 73199f6f07
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ff06a168c7
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3e485e22b1
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
These bounds are shared by the Sites, Buildings, Racks, and Groups filter chips, but hashrate and power are aggregate fields on those pages. NumericRangeModal validates against these maxima, so an operator trying to filter a site/building/rack by a realistic aggregate such as power_min=500 kW or hashrate_min=5000 TH/s cannot apply the filter even though the backend accepts and evaluates those aggregate totals; use separate aggregate bounds or loosen these before reusing the per-miner limits on list-level filters.
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 971539ba9b
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6a3df674dd
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: af0c3ae734
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
When the Miners Building filter is set to Unassigned, the client sends only includeNoBuilding, but this server branch only matches miners with a rack membership whose device_set_rack.building_id is NULL. An unracked miner with device.building_id IS NULL renders blank in the new Building column yet is excluded by that same Unassigned building filter unless the user also selects the Rack Unassigned bucket, so the filter hides rows that appear to belong to the selected bucket. Include the direct device.building_id IS NULL case in this predicate.
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
Reviewable diff: +1982/-372 across 50 files (excludes generated, test, and story files).
Summary
Adds URL-backed, per-tab filtering for Sites, Buildings, Racks, and Groups so the fleet views follow the Miners tab filter order while only exposing filters that apply to each entity type. The request contracts now carry issue-component and fleet-list telemetry range filters, unassigned location selections round-trip through URL params as
null, and list row shapes now expose shared placement refs where parent placement exists: miners include site/building/rack/groups, racks include site/building, buildings include site, and sites keep an empty root placement shape. Non-goals: this does not redesign table layouts, add browser E2E coverage.How It Works
The client keeps filter state in URL params, maps issue and telemetry chips into typed proto request fields, and uses
nullonly as the URL sentinel for unassigned site/building/rack values. Server handlers validate the new fields, reuse a sharedfleetlistfilterparser/matcher for rollup-backed issue and telemetry predicates, and push rack/group site, building, zone, issue, and telemetry filters into the collection SQL path so list and count queries stay aligned. Miner, rack, building, and site read rows now usecommon.v1.PlacementRefsfor parent placement metadata while blank/unassigned UI cells continue rendering from missing refs.Areas Of The Code Involved
proto/*ResourceRef/PlacementRefsmessages on miner/rack/building/site rowsserver/internal/domain/fleetlistfilterserver/internal/domain/{sites,buildings}server/internal/domain/stores/sqlstoresserver/internal/domain/fleetmanagementserver/internal/handlers/{buildings,deviceset}PlacementRefsclient/src/protoFleet/features/*Key Technical Decisions & Trade-Offs
nullFilterChipsBarwith numeric range categoriesTesting & Validation
just lint./node_modules/.bin/tsc --noEmit./node_modules/.bin/vitest filterUrlParams savedViews viewSummary telemetryFilterBounds minerTableColumnPreferences FilterChipsBar Filters NestedDropdownFilter --run./node_modules/.bin/vitest run src/protoFleet/features/fleetManagement/components/MinerActionsMenu/bulkRenamePreview.test.ts src/protoFleet/features/fleetManagement/components/MinerActionsMenu/BulkWorkerNameModal.test.tsxDB_PASSWORD=fleet go test ./internal/domain/fleetlistfilter ./internal/domain/buildings ./internal/domain/sites ./internal/domain/collection ./internal/domain/fleetmanagement ./internal/handlers/buildings ./internal/handlers/sites ./internal/handlers/devicesetDB_PASSWORD=fleet go test ./internal/domain/fleetmanagement ./internal/domain/stores/sqlstoresDB_PASSWORD=fleet go test ./internal/handlers/buildings ./internal/handlers/deviceset ./internal/domain/stores/sqlstoresDB_PASSWORD=fleet go test ./internal/domain/buildings ./internal/domain/collectionDB_PASSWORD=fleet go test ./internal/domain/fleetmanagement ./internal/domain/stores/sqlstores -run 'TestService_ListMinerStateSnapshots_ShouldPopulateGroupRefs|TestService_ListMinerStateSnapshots_ShouldPopulateRackRef|TestCollectionStore_GetGroupRefsForDevices|TestCollectionStore_GetRackDetailsForDevices'go test ./internal/domain/stores/sqlstores -run 'TestBuildCollectionListQuery|TestBuildCollectionCountQuery|TestResolveCollectionSort'buf lintbuf generate;cd server && just gengit diff --checkrustup update stable; literaljust test-contractgets past the Cargo edition blocker but hits the repo's existing macOS Dockerexec format error, so I built the Linux ASIC-rs plugin withjust _asicrs-build-dockerand ran the contract-test body manually, passingTestAntminerStock,TestAntminerVNish, andTestWhatsMinerStock.