fix(native): honour telemetry-safe segments only in the sub-view position by innolope-dev · Pull Request #2993 · peanutprotocol/peanut-ui

innolope-dev · 2026-09-05T00:13:58Z

Follow-up to #2990, which merged at f4d2b02e6 a few minutes before this commit was pushed to its branch — so the fix never reached dev. Cherry-pick of d9a4ca9e6, unchanged.

What

redactNativePath kept the telemetry-safe sub-view tokens (success, bank, manteca, crypto, us) at every path position. The API allows usernames like bank, and /<username> is a profile link, so https://peanut.me/bank survived redaction and sent the username in native_link_received.raw. Raised by Chip (MINOR) and CodeRabbit (MAJOR, CWE-200) on the since-closed #2991.

A safe token is now honoured only two segments after a route root — /qr/<code>/success, /add-money/<country>/bank — and is an identifier anywhere else. Collision tests: /bank, /profile/crypto, /manteca/success all redact; the two legitimate sub-view shapes keep their token.

Verification

native-routes.test: green on this branch (useNativeAppLinks.test unchanged and green on fix: review follow-ups — ds-lint font-(--x) weight, SupportDrawer hardware back, landing Log in link, claim receipt cancelledAt #2990's head).
src/content gitlink is dev's (f5990317) — no submodule drift.

…tion The allowlist applied at every path position, so a username that collides with a token — /bank is a valid profile link — survived redaction. A safe token is now kept only two segments after a route root (/qr/<code>/success, /add-money/<country>/bank); anywhere else it is an identifier. (cherry picked from commit d9a4ca9)

vercel · 2026-09-05T00:13:59Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
peanut-wallet	Ready	Preview	Sep 5, 2026 12:19am UTC

coderabbitai · 2026-09-05T00:14:07Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: fad7b99f-5119-4553-8f3d-82052bf414c8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-09-05T00:15:23Z

Code-analysis diff

Painscore total: 7167.8 → 7167.98 (+0.18)
Findings: 0 net (+3 new, -3 resolved)

🆕 New findings (3)

critical complexity — src/utils/native-routes.ts — CC 111, MI 54.62, SLOC 298
medium method-complexity — src/utils/native-routes.ts:408 — rewriteMethodPath CC 20 SLOC 34
low high-mdd — src/utils/native-routes.ts:408 — rewriteMethodPath: MDD 13.2 (uses across many lines from declarations)

✅ Resolved (3)

src/utils/native-routes.ts — CC 109, MI 54.93, SLOC 293
src/utils/native-routes.ts:401 — rewriteMethodPath CC 20 SLOC 34
src/utils/native-routes.ts:401 — rewriteMethodPath: MDD 13.2 (uses across many lines from declarations)

github-actions · 2026-09-05T00:16:52Z

🧪 UI test report — ✅ all green

Suites

✅ unit: 5898 ran, 0 failed, 0 skipped, 1.8m

📊 Coverage (unit)

metric	%
statements	74.7%
branches	60.1%
functions	68.5%
lines	75.6%

⏱ 10 slowest test cases

time	test
🐢 9.0s	`src/app/(mobile-ui)/qr-pay/__tests__/qr-pay-states.test.tsx` › Network failure keeps loading while retries remain, then shows the generic error
4.0s	`src/app/(mobile-ui)/qr-pay/__tests__/qr-pay-states.test.tsx` › MANTECA_SOURCE_OVER_MONTHLY_CAP fails fast with copy that names the real cause
4.0s	`src/app/(mobile-ui)/qr-pay/__tests__/qr-pay-states.test.tsx` › MANTECA_MERCHANT_RECENT_REFUND fails fast with copy that names the real cause
4.0s	`src/app/(mobile-ui)/qr-pay/__tests__/qr-pay-states.test.tsx` › User KYC not approved fails fast with copy that names the real cause
4.0s	`src/app/(mobile-ui)/qr-pay/__tests__/qr-pay-states.test.tsx` › MANTECA_USER_NOT_PROVISIONED fails fast with copy that names the real cause
4.0s	`src/app/(mobile-ui)/qr-pay/__tests__/qr-pay-states.test.tsx` › a refused idempotency key tells the user to scan again, not to contact support
4.0s	`src/app/(mobile-ui)/qr-pay/__tests__/qr-pay-states.test.tsx` › routes the KYC rejection on its wire code, and does not retry it
4.0s	`src/app/(mobile-ui)/qr-pay/__tests__/qr-pay-states.test.tsx` › MANTECA_MERCHANT_VOLUME_NEAR_CAP fails fast with copy that names the real cause
3.0s	`src/app/(mobile-ui)/qr-pay/__tests__/qr-pay-states.test.tsx` › Going offline blames the connection, and reconnecting clears it for the recovered scan
3.0s	`src/app/(mobile-ui)/qr-pay/__tests__/qr-pay-states.test.tsx` › Scan that recovers on the retry lands on the payment screen, not an error

_{📍 Inline annotations are in the **Unit test report** check above. Coverage artifact: `coverage-unit`. Generated by `.github/workflows/tests.yml`.}

chip-peanut-bot

Chip review — no blocking findings — this is not an approval

Clean: telemetry-safe tokens are now retained only as sub-views under a declared route root, while claimable username collisions are redacted; exact-head functional CI passed.

Checked clean

Verified the detached worktree HEAD, merge base, trusted author, dev base ref, and exact base/head SHAs against the supplied values.
Reviewed the positional redaction logic, its telemetry caller, prefixed paths, bare profile links, nested profile identifiers, declared route roots, static sub-views, query/fragment stripping, and authority handling.
Compared the collision cases with the paired API username validator: bank, crypto, and manteca are valid claimable usernames, while frontend route roots used as literals are server-reserved or invalid username shapes.
Exact-head unit, native-export, typecheck, eslint, format, design-system lint, analyze, backend-baseline, provenance, aggregate CI, and review checks passed; screenshots and preview deployment were still in progress.
The detached worktree has no installed Jest binary, so a duplicate local focused run was unavailable; git diff whitespace validation passed.
No prior findings were supplied, and no issue comments or review comments were fetched or read.

Security review by moonshotai/kimi-k3: 0 finding(s), marked with the model name. It reads the diff only and answers only security, privacy and money, so treat its findings as advice.

Third opinion by claude-opus: 0 finding(s), marked with the model name. It answers only product truth, missing tests and the cross-repo contract, so treat its findings as advice.

Exact head: 13bdcbcdbcc3 · Context: repo, paired-api, ci · Took 6m

github-actions · 2026-09-05T00:20:27Z

🖼 Visual diff — 5 screens moved

7 of 66 shots changed · 59 identical · baseline f613add → head 13bdcbc

worst %	screen	widths
3.86%	`avatar-picker`	320, 430
0.07%	`badges`	320, 430
0.07%	`home`	320
0.07%	`withdraw`	320
0.01%	`empty-accounts`	320

job summary · before/after/diff images — artifact

_{Fixture screenshots, no backend. Advisory — this check never blocks a merge. Posted from the default branch by ds-shots-comment.yml; the report it renders is untrusted data.}

innolope-dev requested review from 0xkkonrad, Hugo0, abalinda, jjramirezn and kushagrasarathe as code owners September 5, 2026 00:13

innolope-dev self-assigned this Sep 5, 2026

innolope-dev mentioned this pull request Sep 5, 2026

fix(native): redact QR codes and other identifiers from deep-link telemetry (port to main, TASK-22039) #2991

Closed

vercel Bot deployed to Preview September 5, 2026 00:19 View deployment

chip-peanut-bot Bot reviewed Sep 5, 2026

View reviewed changes

innolope-dev merged commit 3aaff0b into dev Sep 5, 2026
23 of 24 checks passed

Navigation Menu

Uh oh!

fix(native): honour telemetry-safe segments only in the sub-view position - #2993

fix(native): honour telemetry-safe segments only in the sub-view position#2993
innolope-dev merged 1 commit into
devfrom
fix/telemetry-safe-segments-positional

innolope-dev commented Sep 5, 2026

Uh oh!

vercel Bot commented Sep 5, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Sep 5, 2026

Review skipped

Uh oh!

github-actions Bot commented Sep 5, 2026

Uh oh!

github-actions Bot commented Sep 5, 2026

Uh oh!

chip-peanut-bot Bot left a comment

Uh oh!

github-actions Bot commented Sep 5, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

innolope-dev commented Sep 5, 2026

What

Verification

Uh oh!

vercel Bot commented Sep 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Sep 5, 2026

Review skipped

Uh oh!

github-actions Bot commented Sep 5, 2026

Code-analysis diff

🆕 New findings (3)

✅ Resolved (3)

Uh oh!

github-actions Bot commented Sep 5, 2026

🧪 UI test report — ✅ all green

Suites

📊 Coverage (unit)

Uh oh!

chip-peanut-bot Bot left a comment

Choose a reason for hiding this comment

Chip review — no blocking findings — this is not an approval

Checked clean

Uh oh!

github-actions Bot commented Sep 5, 2026

🖼 Visual diff — 5 screens moved

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented Sep 5, 2026 •

edited

Loading