feat(convex): add Convex plugin with Management API operations - #569
Open
Mayank-saraswal wants to merge 9 commits into
Open
feat(convex): add Convex plugin with Management API operations#569Mayank-saraswal wants to merge 9 commits into
Mayank-saraswal wants to merge 9 commits into
Conversation
Contributor
|
@Mayank-saraswal is attempting to deploy a commit to the corsair Team on Vercel. A member of the Team first needs to authorize it. |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds the ChangesConvex integration
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant Corsair
participant ConvexPlugin
participant EndpointHandler
participant ConvexRequestClient
participant ConvexAPI
participant Database
Corsair->>ConvexPlugin: invoke Convex endpoint
ConvexPlugin->>EndpointHandler: bind credentials and context
EndpointHandler->>ConvexRequestClient: construct typed API request
ConvexRequestClient->>ConvexAPI: send authenticated request
ConvexAPI-->>EndpointHandler: return Convex response
EndpointHandler->>Database: upsert or delete cached resource
EndpointHandler-->>Corsair: return endpoint result
Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 2 | ❌ 3❌ Failed checks (3 warnings)
✅ Passed checks (2 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Comment |
Mayank-saraswal
marked this pull request as ready for review
August 2, 2026 20:23
Contributor
Greptile SummaryThe follow-up changes complete the Convex plugin’s credential separation, authenticated-host validation, secret-safe event logging, and best-effort cache handling.
Confidence Score: 5/5The PR appears safe to merge. No blocking failure remains. Important Files Changed
Flowchart%%{init: {'theme': 'neutral'}}%%
flowchart TD
C[Convex connection] --> K{Operation family}
K -->|Management API| M[Resolve API key or OAuth access token]
M --> B[Authorization: Bearer token]
B --> API[api.convex.dev/v1]
K -->|Deployment scoped| D[Resolve per-call or stored deploy key]
D --> S[Validate deployment DNS label]
S --> H[Authorization: Convex deploy key]
H --> CLOUD[deployment.convex.cloud/api]
Reviews (6): Last reviewed commit: "fix(convex): support deploy-key-only con..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Plugin PR scorecard —
|
| Check | Status | Notes |
|---|---|---|
| R1 — Scope: plugin files only | ✅ | |
| R2 — Tests with assertions | ✅ | |
| R3 — Description complete | ✅ | |
| R3 — Linked issue / claim | ✅ | |
| R4 — Demo video / recording | ✅ |
Rules: PLUGIN_PR_RULES.md · re-runs on every push
|
Hey @Mayank-saraswal, thanks for the contribution! 🏴☠️ Before a maintainer reviews, please fix the items below — the review re-runs automatically on your next push. Must fix
How this was verified: The nonempty-string input flows directly into the base URL, and the shared request client sends the configured authorization header to that resolved URL.
Rule Used: Verify the implementation matches the PR descripti... (source) Knowledge Base Used: The provider-plugin package pattern
Knowledge Base Used: The provider-plugin package pattern If anything remains after your next push, a bot commit will clean it up; a maintainer always does the final review and merge. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🧹 Nitpick comments (2)
packages/convex/endpoints/deployment-scoped.ts (1)
15-19: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueUse
ConvexAPIErrorfor consistency.The missing-subdomain guard throws a plain
Error(Lines 16-18), while every other failure path in this plugin surfaces aConvexAPIError. ThrowingConvexAPIErrorhere keeps error shape consistent for any downstream code that inspectserror.nameorerror instanceof ConvexAPIError.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/convex/endpoints/deployment-scoped.ts` around lines 15 - 19, Update the missing-subdomain guard in the deployment-scoped endpoint to throw ConvexAPIError instead of a plain Error, preserving the existing message and ensuring downstream error checks remain consistent with the other failure paths.packages/convex/error-handlers.ts (1)
5-83: 🩺 Stability & Availability | 🔵 Trivial | 💤 Low valueConsider tightening the message-based fallback matching.
Each handler falls back to substring checks on
error.message(for example Lines 12-17, 38-43, 64-65) when the error isn'tApiError/ConvexAPIError. A message that incidentally contains "404" or "403" for unrelated reasons would be misclassified into the wrong retry policy.This only matters for errors that aren't already
ApiErrororConvexAPIError, so the risk is bounded. If broader coverage is intentional (e.g., wrapped errors from other library layers), consider narrowing the substring checks or documenting why message-based matching is necessary here.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/convex/error-handlers.ts` around lines 5 - 83, Tighten the message-based fallback checks in the match functions for RATE_LIMIT_ERROR, AUTH_ERROR, PERMISSION_ERROR, and NOT_FOUND_ERROR so incidental status-code text cannot classify unrelated errors; use more specific, intentional patterns while preserving matching for wrapped errors if required.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/convex/endpoints/deploy-keys.ts`:
- Around line 23-36: Update the create flow around the deployKeys upsert to
avoid using input.deployment_name as the entity ID, since list uses each deploy
key’s durable deployKey.id and multiple keys can share a deployment. Prefer
skipping this pre-list cache write and relying on list to populate records; if
caching is required, use a deployment-scoped composite ID that cannot collide
with other keys and guard the write against retries consistently with
projects.ts and deployments.ts.
In `@packages/convex/endpoints/deployments.ts`:
- Around line 88-113: After the successful PATCH in update, fetch the refreshed
deployment record with GET using input.deployment_name and ctx.key, then pass
that record to ctx.db.deployments.upsertByEntityId before logging completion and
returning. Preserve the existing update request and response behavior.
In `@packages/convex/endpoints/projects.ts`:
- Around line 118-120: Update the project deletion handler around
ctx.db.projects.deleteByEntityId to also remove or invalidate all cached
deployments belonging to input.project_id; update the deployment deletion
handler around ctx.db.deployments.deleteByEntityId to also remove or invalidate
cached deploy keys belonging to input.deployment_name. Apply the corresponding
cleanup in packages/convex/endpoints/projects.ts lines 118-120 and
packages/convex/endpoints/deployments.ts lines 125-127.
- Around line 90-99: Isolate post-create cache failures so successful
non-idempotent API calls are not reported as failed. In
packages/convex/endpoints/projects.ts lines 90-99, wrap the projects upsert in
try/catch; apply the same change to deployments.upsertByEntityId in
packages/convex/endpoints/deployments.ts lines 68-77 and
deployKeys.upsertByEntityId in packages/convex/endpoints/deploy-keys.ts lines
23-36, preserving the successful create response even when caching fails.
In `@packages/convex/plugin-docs.yaml`:
- Around line 8-10: Update the authentication documentation in the plugin
configuration around the existing Bearer-token and deployment-key text to
include the supported oauth_2 token flow. Document OAuth bearer authentication
for the Management API and explicitly state the authorization scheme used for
each API scope, while preserving the existing personal/team token and deploy-key
guidance.
---
Nitpick comments:
In `@packages/convex/endpoints/deployment-scoped.ts`:
- Around line 15-19: Update the missing-subdomain guard in the deployment-scoped
endpoint to throw ConvexAPIError instead of a plain Error, preserving the
existing message and ensuring downstream error checks remain consistent with the
other failure paths.
In `@packages/convex/error-handlers.ts`:
- Around line 5-83: Tighten the message-based fallback checks in the match
functions for RATE_LIMIT_ERROR, AUTH_ERROR, PERMISSION_ERROR, and
NOT_FOUND_ERROR so incidental status-code text cannot classify unrelated errors;
use more specific, intentional patterns while preserving matching for wrapped
errors if required.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: ca7276bf-322a-4e34-ac0c-59c549d5247d
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (21)
packages/convex/api.test.tspackages/convex/client.tspackages/convex/endpoints/custom-domains.tspackages/convex/endpoints/deploy-keys.tspackages/convex/endpoints/deployment-scoped.tspackages/convex/endpoints/deployments.tspackages/convex/endpoints/index.tspackages/convex/endpoints/platform.tspackages/convex/endpoints/projects.tspackages/convex/endpoints/types.tspackages/convex/error-handlers.tspackages/convex/index.tspackages/convex/jest.config.cjspackages/convex/package.jsonpackages/convex/plugin-docs.yamlpackages/convex/schema.test.tspackages/convex/schema/database.tspackages/convex/schema/index.tspackages/convex/tsconfig.jsonpackages/convex/tsup.config.tspackages/corsair/core/constants.ts
Contributor
Author
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
packages/convex/client.ts (1)
38-56: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick winKeep
tryCacheWritecallbacks limited to cache operations.
tryCacheWritecatches every error from its callback. Inpackages/convex/endpoints/deployments.ts, the deployment update callback also callsmakeConvexRequestto refresh the cache at Lines 99-143. A rate-limit or network error from that provider request is discarded as a cache-write failure. The endpoint can leave the deployment cache stale without diagnostics.Keep only
deployments.upsertByEntityIdinside this helper. Catch refresh failures separately and record a structured diagnostic without changing the successfulPATCHresult.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/convex/client.ts` around lines 38 - 56, Restrict the callback passed to tryCacheWrite in the deployment update flow to only deployments.upsertByEntityId. Move the makeConvexRequest refresh out of that swallowed-error callback, catch its failures separately, and record a structured diagnostic while preserving the successful PATCH result.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/convex/index.ts`:
- Around line 30-38: Update resolveDeployKey to remove the ctx.key fallback and
require an explicit deployment deployKey for both api_key and oauth_2
connections, or use a distinct deploy-key credential when available. Preserve
the existing deployment authorization behavior and update affected tests to
verify missing deployKey is rejected.
---
Nitpick comments:
In `@packages/convex/client.ts`:
- Around line 38-56: Restrict the callback passed to tryCacheWrite in the
deployment update flow to only deployments.upsertByEntityId. Move the
makeConvexRequest refresh out of that swallowed-error callback, catch its
failures separately, and record a structured diagnostic while preserving the
successful PATCH result.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: a4586e61-d597-467a-be54-f220bd46ff4d
📒 Files selected for processing (10)
packages/convex/api.test.tspackages/convex/client.tspackages/convex/endpoints/deploy-keys.tspackages/convex/endpoints/deployment-scoped.tspackages/convex/endpoints/deployments.tspackages/convex/endpoints/projects.tspackages/convex/endpoints/types.tspackages/convex/error-handlers.tspackages/convex/index.tspackages/convex/plugin-docs.yaml
🚧 Files skipped from review as they are similar to previous changes (3)
- packages/convex/plugin-docs.yaml
- packages/convex/error-handlers.ts
- packages/convex/endpoints/types.ts
|
Remaining findings are being fixed by a bot commit — it will be re-reviewed automatically. |
Contributor
Author
Maintainer review neededAutomated rounds are exhausted. Remaining findings:
How this was verified: Both handlers pass the secret-bearing input to the shared event logger, which inserts the payload into |
github-actions
Bot
added
the
needs-maintainer
Contributor
Author
Contributor
Author
Contributor
Author
6 tasks
This was referenced Aug 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Adds the Convex plugin to Corsair, implementing all 19 operations claimed on the OSS dashboard:
Convex Management API (Bearer token,
https://api.convex.dev/v1):Convex deployment-scoped REST API (
https://<deployment>.convex.cloud/api,Authorization: Convex <deploy-key>):Auth is configurable per plugin:
api_key(deploy key) oroauth_2(access token), with asubdomainaccount field used to resolve the deployment URL for deployment-scoped operations. Schema entities (projects,deployments,deployKeys) are cached on successful reads/writes, and destructive endpoints remove cached entities.Fixes #568
Checklist
pnpm lintand all checks passpnpm typecheckand there are no TypeScript errorspnpm buildand all packages build successfullypnpm testand all tests passScreenshots / Demos (if applicable)
🎥 Demo video: Loom recording — running the full Convex plugin test suite (21/21 tests passing) and exercising the endpoints against a live Convex deployment.
Additional Notes
pnpm generate:plugin, footprint matches R1 (plugin package +packages/corsair/core/constants.tsregistration + lockfile).pnpm run validate:pluginsfails only on pre-existingepicgames/kagglepackages (missingpackage.json), unrelated to this PR; Convex passes validation.Summary by CodeRabbit
New Features
Reliability
Tests
Documentation