feat: Configure CODEOWNERS and standard PR Template - #10
Merged
Conversation
jeevanhs06
approved these changes
Aug 27, 2026
There was a problem hiding this comment.
Pull request overview
This PR goes far beyond the stated “CODEOWNERS + PR template” scope and also introduces significant frontend feature/UI changes, a new Gemini-backed chat API route, dependency updates, and tightened Firestore security rules.
Changes:
- Adds CODEOWNERS and a PR template, while also removing the existing GitHub Pages workflow.
- Introduces multiple new dashboard UI modules (mesh chat, FM radio, social sharing, shelter invoice/pass, GIS map updates) and various landing/dashboard UI adjustments.
- Adds/updates backend-facing behaviors (Gemini chat API route, Resend email error handling) and modifies Firestore security rules.
Reviewed changes
Copilot reviewed 27 out of 29 changed files in this pull request and generated 12 comments.
Show a summary per file
| File | Description |
|---|---|
| frontend/src/services/authService.ts | Auth + Firestore service updates (email verification, token storage, broadcast/user stream shaping, OTP/reset email handling). |
| frontend/src/components/landing/Navbar.tsx | Landing navbar styling updates. |
| frontend/src/components/landing/Hero.tsx | Landing hero redesign/styling updates. |
| frontend/src/components/landing/Features.tsx | Landing features styling + feature card behavior tweaks. |
| frontend/src/components/dashboard/SocialPreviewHub.tsx | New social sharing/preview modal (WhatsApp/Telegram/Instagram). |
| frontend/src/components/dashboard/Sidebar.tsx | Adds dashboard routes/items for mesh chat + FM radio. |
| frontend/src/components/dashboard/ShelterInvoiceModal.tsx | New printable shelter “pass/receipt” modal. |
| frontend/src/components/dashboard/ShelterCard.tsx | Shelter booking UX changes + local occupancy persistence + invoice modal integration. |
| frontend/src/components/dashboard/OfflineEmergencyBot.tsx | Switches online chat backend from external Render URL to local /api/chat. |
| frontend/src/components/dashboard/MeshChatView.tsx | New mesh chat view (UI-only). |
| frontend/src/components/dashboard/MapCard.tsx | Adds geolocation-based centering + map UI/controls changes. |
| frontend/src/components/dashboard/FMRadioView.tsx | New FM radio view (UI-only). |
| frontend/src/components/dashboard/EmergencyGuideTab.tsx | Guide header copy/typography updates. |
| frontend/src/components/dashboard/DashboardLayout.tsx | Adds new views + social share trigger into dashboard layout. |
| frontend/src/components/dashboard/AlertCard.tsx | Adds incident “what happened” + exact location sections to alerts UI. |
| frontend/src/components/common/SEOJsonLd.tsx | New JSON-LD injection component. |
| frontend/src/components/auth/RegisterForm.tsx | Strengthens password requirements. |
| frontend/src/components/auth/LoginForm.tsx | Surfaces server error message for OTP send failures. |
| frontend/src/components/auth/ForgotPasswordModal.tsx | Surfaces server error message for reset OTP failures. |
| frontend/src/app/layout.tsx | Expands Next.js metadata + injects JSON-LD. |
| frontend/src/app/api/send-reset-email/route.ts | Makes Resend failures/ENV misconfigurations return explicit errors. |
| frontend/src/app/api/chat/route.ts | New Gemini chat API route with basic in-memory rate limiting. |
| frontend/package.json | Adds @google/genai; sets Next.js to ^15.1.0. |
| frontend/package-lock.json | Locks Next.js 15.1.0 (marked vulnerable/deprecated in lockfile). |
| frontend/next-env.d.ts | Removes routes.d.ts reference. |
| firestore.rules | Replaces permissive rules with auth/role-based rules (but currently allows role escalation). |
| .github/workflows/nextjs.yml | Removed GitHub Pages Next.js deploy workflow. |
| .github/pull_request_template.md | Adds PR template checklist (currently contains incorrect npm commands). |
| .github/CODEOWNERS | Adds global codeowner rule for all PRs. |
Files not reviewed (1)
- frontend/package-lock.json: Generated file
Suppressed comments (4)
frontend/src/services/authService.ts:444
- This stores the Firebase ID token in localStorage. Since ID tokens are bearer credentials, this materially increases exposure in the event of XSS. Rely on Firebase Auth persistence instead of persisting tokens client-side.
// Store session token in localStorage for client-side explicit check (though Firebase persists it automatically)
const token = await user.getIdToken();
if (typeof window !== "undefined") {
localStorage.setItem("rescueai_session_token", token);
}
frontend/src/components/dashboard/SocialPreviewHub.tsx:144
- The em dash here is mojibake ("—"), which will render incorrectly. This is another sign the file has an encoding/BOM issue.
RescueAI — AI Disaster Response & Emergency Grid
</h4>
frontend/src/components/dashboard/SocialPreviewHub.tsx:153
- The checkmarks in this timestamp are mojibake ("✓✓"), so they won't render as intended.
<div className="text-[9px] text-slate-400 text-right mt-1 font-mono">10:42 PM ✓✓</div>
frontend/src/components/dashboard/SocialPreviewHub.tsx:196
- This link label contains mojibake ("🔗"), likely intended to be a link icon. It will render incorrectly for users.
<span>🔗 rescueai.org/sos</span>
</div>
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+23
to
+28
| // Allow users to create their own profile, but they CANNOT self-assign admin roles securely here. | ||
| // Firebase Cloud Functions should ideally set admin roles. For this client-side architecture, | ||
| // they can create, but only admins can update roles. | ||
| allow create: if isOwner(userId); | ||
| allow update: if isOwner(userId) || isAnyAdmin(); | ||
| allow delete: if hasRole('global_admin'); |
Comment on lines
+388
to
+392
| // Store session token in localStorage for client-side explicit check (though Firebase persists it automatically) | ||
| const token = await user.getIdToken(); | ||
| if (typeof window !== "undefined") { | ||
| localStorage.setItem("rescueai_session_token", token); | ||
| } |
Comment on lines
+47
to
+56
| navigator.geolocation.getCurrentPosition( | ||
| (pos) => { | ||
| setDeviceCoords({ | ||
| lat: pos.coords.latitude, | ||
| lng: pos.coords.longitude, | ||
| }); | ||
| }, | ||
| null, | ||
| { enableHighAccuracy: true } | ||
| ); |
| import React, { useState, useEffect } from "react"; | ||
| import { motion } from "framer-motion"; | ||
| import { Plus, Minus, Compass, Radio } from "lucide-react"; | ||
| import { Plus, Minus, Compass, Radio, MapPin, Locate } from "lucide-react"; |
Comment on lines
+5
to
+18
| import { | ||
| Share2, | ||
| Copy, | ||
| Check, | ||
| Send, | ||
| MessageCircle, | ||
| Radio, | ||
| ExternalLink, | ||
| ShieldAlert, | ||
| Sparkles, | ||
| Download, | ||
| X, | ||
| Camera, | ||
| } from "lucide-react"; |
Comment on lines
+5
to
+18
| import { | ||
| Building, | ||
| MapPin, | ||
| CheckCircle2, | ||
| Printer, | ||
| Download, | ||
| X, | ||
| ShieldCheck, | ||
| User, | ||
| Mail, | ||
| Users, | ||
| AlertCircle, | ||
| QrCode, | ||
| } from "lucide-react"; |
Comment on lines
+15
to
+21
| ### ?? Testing & Verification | ||
| <!-- How did you test these changes? Did you verify them in offline mode? --> | ||
| - [ ] Tested locally via | ||
| pm run dev | ||
| - [ ] Passed production build check | ||
| pm run build | ||
| - [ ] Verified Firebase Rules / Access Controls |
Comment on lines
6050
to
+6054
| "node_modules/next": { | ||
| "version": "15.5.23", | ||
| "resolved": "https://registry.npmjs.org/next/-/next-15.5.23.tgz", | ||
| "integrity": "sha512-Gvd2WKgvxIXCGotxcI1im/Uf3rS3J3oZGw0g/uskg6AVBZhyE3aAbujkYWzS3xLmEPEtTLfkaVQUKK0KMTSIkA==", | ||
| "license": "MIT", | ||
| "version": "15.1.0", | ||
| "resolved": "https://registry.npmjs.org/next/-/next-15.1.0.tgz", | ||
| "integrity": "sha512-QKhzt6Y8rgLNlj30izdMbxAwjHMFANnLwDwZ+WQh5sMhyt4lEBqDK9QpvWHtIM4rINKPoJ8aiRZKg5ULSybVHw==", | ||
| "deprecated": "This version has a security vulnerability. Please upgrade to a patched version. See https://nextjs.org/blog/CVE-2025-66478 for more details.", |
Comment on lines
+1
to
+5
| # RescueAI Code Owners | ||
| # The last matching rule takes precedence, so we combine all required reviewers onto a single global rule. | ||
|
|
||
| # All PRs will automatically request reviews from both the Approvers and the Code Reviewers groups. | ||
| * @developeradhi @jeevanhso6 @suhashoskere @theakashr @theakshath @developerakashp |
Comment on lines
+16
to
+35
| const rateLimitMap = new Map<string, { count: number, resetTime: number }>(); | ||
|
|
||
| export async function POST(req: Request) { | ||
| const ip = req.headers.get("x-forwarded-for") || "unknown"; | ||
| const now = Date.now(); | ||
| const windowMs = 60 * 1000; // 1 minute | ||
| const limit = 5; // 5 requests per minute | ||
|
|
||
| const currentRate = rateLimitMap.get(ip) || { count: 0, resetTime: now + windowMs }; | ||
| if (now > currentRate.resetTime) { | ||
| currentRate.count = 1; | ||
| currentRate.resetTime = now + windowMs; | ||
| } else { | ||
| currentRate.count++; | ||
| } | ||
| rateLimitMap.set(ip, currentRate); | ||
|
|
||
| if (currentRate.count > limit) { | ||
| return NextResponse.json({ reply: "?? Rate limit exceeded. Please wait a moment before sending another message." }, { status: 429 }); | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This Pull Request is officially submitted by @developeradhi.
It adds the required CODEOWNERS rules to ensure all 6 team members are correctly tagged for reviews, and standardizes PR descriptions with a custom checklist template.