[MrPunyapal]

Commit cards help people see at a glance whether a post came from the website, a mobile app, the macOS desktop app, or the CLI. The source is assigned from the authenticated device or submission route, not supplied per commit; other API clients appear as App. Older posts without a stored source remain unlabeled.

Before

After

Summary by CodeRabbit

• New Features
  • Commit cards show where a post came from when source information is available, including the website, iOS, Android, macOS, terminal, or an app with an unrecognized platform.
  • Source information is included in account data exports, including organization commits.
• Privacy
  • Source information is cleared from posts retained as tombstones after account deletion.
  • Older posts and posts scheduled before source tracking may not have a source label.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

Commits and scheduled commits now store source values for web, CLI, and API submissions. API sources are derived from authenticated device IDs. Responses and exports include source values, and commit cards display a label when a source is present. Account deletion clears source values from affected commits.

Changes: Commit Source Attribution

Layer / File(s)	Summary
Source contract and persistence app/Enums/CommitSource.php, database/migrations/*, app/Models/Commit.php, app/Models/ScheduledCommit.php, app/Actions/CreateCommit.php, app/Actions/CreateScheduledCommit.php, app/Queries/CommitBuilder.php, tests/Unit/Models/CommitTest.php	A CommitSource enum defines six source values. Nullable source fields are added to commits and scheduled commits, and the creation actions store the supplied value.
Request attribution and scheduled submission app/Http/Middleware/AuthenticateSignedRequest.php, app/Http/Controllers/Api/*, app/Http/Controllers/Cli/CommitController.php, app/Http/Controllers/CommitController.php, app/Http/Controllers/CommitReplyController.php, app/Http/Controllers/ScheduledCommitController.php, app/Actions/UpdateScheduledCommitSubmittedAt.php, tests/Feature/CommitSourceTest.php, tests/Feature/Controllers/Cli/CommitControllerTest.php	Web and CLI routes assign their source values. API routes derive the source from the authenticated device’s app ID. Scheduled submission passes its source to the created commit.
Commit responses, exports, and cards app/Http/Resources/CommitResource.php, resources/js/types/commit.ts, resources/js/components/commit-card.tsx, app/Actions/CreateExport.php, tests/Feature/Controllers/ExportControllerTest.php, tests/Feature/OrganizationCommitsTest.php, KNOWLEDGE_BASE.md	Commit responses include non-null source values. Exports include source values and use schema version 6. Commit cards show a source label when one is present.
Source clearing during account deletion app/Actions/DeleteUser.php, tests/Unit/Actions/DeleteUserTest.php	Account deletion clears source values from user commits and organization-owned commits attributed to the user.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant APIClient
  participant AuthenticateSignedRequest
  participant ApiCommitController
  participant CreateCommit
  participant CommitResource
  participant CommitCard
  APIClient->>AuthenticateSignedRequest: Submit signed commit request
  AuthenticateSignedRequest->>ApiCommitController: Attach authenticated device
  ApiCommitController->>CreateCommit: Pass source derived from device app_id
  CreateCommit->>CommitResource: Persist commit with source
  CommitResource->>CommitCard: Return source when non-null
  CommitCard->>APIClient: Display source label

Loading

Possibly related issues

• dev-null-sh/dev-null.sh#1258 — The issue requests client source labels such as “via Web,” “via CLI,” and “via iOS”; this change records and displays source labels.

Possibly related PRs

• dev-null-sh/dev-null.sh#1168 — Both changes add source metadata and posting-surface labels, with different source values and assignment rules.
• dev-null-sh/dev-null.sh#1322 — Both changes persist source values for commits and scheduled commits, carry them through exports and submission, and display source labels.
• dev-null-sh/dev-null.sh#1346 — Both changes use the author-versus-poster distinction when handling organization commits during account deletion.

Suggested reviewers: mnapoli, sheraz4196

Merge Risk: Minimal · up to b78c1

The documentation now distinguishes older scheduled posts without labels from new posts labeled “via App.” No merge-blocking issue is identified.

Security architecture risk: Low · up to 06c6c

The change adds coarse posting-source metadata without an identified expansion of access or privileges. Source capture and account-deletion cleanup are consistent across the reviewed flows. Deployment ordering remains unverified because the application now depends on new database columns.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• observed — The added disclosure is a coarse submission category, not the raw device identifier or a credential. CommitResource places it in the common response representation, including unsigned responses for commits available through those endpoints. Export queries retain their existing user-based scope.

Trust Boundaries and Controls

• observed — The middleware exposes the Device as request context only after signature verification and existing banned-user enforcement. API creation consumes that context rather than a body-supplied source. The base-to-head change adds attribution context without changing the authenticated user or route authority; source remains descriptive metadata rather than an authorization input.

Resilience and Maintainability Implications

• observed — Scheduled submission adds source propagation inside the existing transaction. Its conditional submission claim, moderation and organization-membership checks, five-attempt transaction, image attachment, and content cleanup are unchanged. The reviewed change therefore does not introduce a separate source-write step that could escape rollback or duplicate publication on retry.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 69.23% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documenta…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title "feat: record and display where commits were posted" matches the main change. The changeset adds a nullable source field to commits and scheduled commits, sets it from the posting surface, a…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title "feat: record and display where commits were posted" matches the main change. The changeset adds a nullable source field to commits and scheduled commits, sets it from the posting surface, and shows a "via" label on commit cards. The title does not mention the export schema change or the enum, but those are supporting details.

Full details: Docstring Coverage

Explanation

Docstring coverage is 69.23% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 13 functions across 26 files. (1 skipped: 1 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Finishing Touches

Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 5d775192-cd22-4fbc-88d9-b98b2cf6887f

Commits

Reviewing files that changed from the base of the PR and between 06c6ccf and b78c129.

Files selected for processing: 1

• KNOWLEDGE_BASE.md

Files skipped from review as they are similar to previous changes: 1

• KNOWLEDGE_BASE.md

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 5 remain after this review.

[coderabbitai]

• Fix comments: Fix CodeRabbit comments on this PR

[GromNaN]

That's not a meaningful information to display. It can stored for analytics or moderation purposes, but it should not be exposed.