Add optional BLOCKY_AUTH_HEADER environment variable#272
Add optional BLOCKY_AUTH_HEADER environment variable#272mlhynfield wants to merge 2 commits intoGabeDuarteM:mainfrom
Conversation
🦋 Changeset detectedLatest commit: 1155a66 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
📜 Recent review details🔇 Additional comments (1)
Summary by CodeRabbit
WalkthroughAdds an optional Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 2✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. 📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment Tip CodeRabbit can generate a title for your PR based on the changes with custom instructions.Set the |
|
@mlhynfield is attempting to deploy a commit to the Gabriel Duarte's projects Team on Vercel. A member of the Team first needs to authorize it. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.env.example:
- Around line 22-28: The BLOCKY_AUTH_HEADER example for an API key is
misleading; update the .env.example so the API key example is either removed or
clearly labeled as setting the Authorization header value directly (i.e., make
it explicit that BLOCKY_AUTH_HEADER sets the Authorization header), and if you
want to show a more common pattern also add a separate example or note
recommending a dedicated header/env var (e.g., BLOCKY_API_KEY_HEADER) for API
keys instead of using Authorization; change the example line containing
BLOCKY_AUTH_HEADER accordingly and update the surrounding comment text to
reflect the chosen approach.
In `@src/server/prometheus/client.ts`:
- Around line 33-38: Extract the duplicated header construction
(env.BLOCKY_AUTH_HEADER ? { Authorization: env.BLOCKY_AUTH_HEADER } : undefined)
into a single helper (e.g., const authHeader or function buildAuthHeader()) and
use it in both places where ky requests are made (the calls using ky.get and
ky.head around getPrometheusUrl()); replace the inline ternary with the helper
to remove duplication and keep behavior identical, referencing
env.BLOCKY_AUTH_HEADER, getPrometheusUrl, and the ky calls.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 10abaef0-2a3e-4db5-9b68-07e9afd68bc9
📒 Files selected for processing (7)
.changeset/polite-eyes-search.md.env.exampleAGENTS.mdREADME.mdsrc/env.jssrc/server/api/routers/blocky.tssrc/server/prometheus/client.ts
📜 Review details
🧰 Additional context used
📓 Path-based instructions (5)
**/*.{ts,tsx,js,jsx,css,json}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{ts,tsx,js,jsx,css,json}: Use 2-space indentation throughout the codebase
Use LF (Unix) line endings instead of CRLF
Files:
src/env.jssrc/server/prometheus/client.tssrc/server/api/routers/blocky.ts
src/env.js
📄 CodeRabbit inference engine (AGENTS.md)
Environment variables are validated via
@t3-oss/env-nextjsinsrc/env.js
Files:
src/env.js
**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{ts,tsx}: Use strict TypeScript mode withnoUncheckedIndexedAccessenabled
Use inlinetypeimports in TypeScript:import { type Foo } from "bar"
Prefix unused parameters with underscore:(_unused) => {}
Never useany; preferunknownwhen type is truly unknown
Do not use non-null assertions (!) or type casting to bypass errors
Use the~/path alias for all src imports:import { cn } from "~/lib/utils"
Never import directly fromclsx; usecnfrom~/lib/utils(enforced by ESLint)
Types and interfaces should usePascalCasenaming (e.g.,LogEntry,FilterValue)
Constants should useUPPER_SNAKE_CASEnaming for arrays and enums (e.g.,TIME_RANGES)
Usecn()from~/lib/utilsfor conditional class merging with Tailwind
Use try/catch for async operations that may fail
Usetoastfromsonnerfor user notifications (toast.success(),toast.error())
Always usewhereclause with Drizzledeleteandupdateoperations (enforced by ESLint)
Don't use raw Drizzle queries unless absolutely necessary; prefer using ORM functions
Report unused ESLint disable directives in the codebase
Files:
src/server/prometheus/client.tssrc/server/api/routers/blocky.ts
src/**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
Use Tailwind CSS classes exclusively (v4, CSS-based config in
globals.css)
Files:
src/server/prometheus/client.tssrc/server/api/routers/blocky.ts
src/server/api/routers/**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
src/server/api/routers/**/*.{ts,tsx}: Place routers insrc/server/api/routers/directory
UsepublicProcedurefor tRPC endpoints
Validate tRPC inputs with Zod schemas
Files:
src/server/api/routers/blocky.ts
🧠 Learnings (3)
📚 Learning: 2025-12-31T17:50:59.256Z
Learnt from: GabeDuarteM
Repo: GabeDuarteM/blocky-ui PR: 200
File: .changeset/rich-meteors-divide.md:5-5
Timestamp: 2025-12-31T17:50:59.256Z
Learning: In all changeset files (e.g., .changeset/*.md), do not use H1 or H2 headings for section titles. Use headings at level 4 or lower (#### and below) for section titles, since the generated changelogs assume a ### top-level heading and using H1/H2 can conflict with the structure.
Applied to files:
.changeset/polite-eyes-search.md
📚 Learning: 2026-02-15T18:42:23.821Z
Learnt from: CR
Repo: GabeDuarteM/blocky-ui PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-02-15T18:42:23.821Z
Learning: Applies to src/env.js : Environment variables are validated via `t3-oss/env-nextjs` in `src/env.js`
Applied to files:
AGENTS.md
📚 Learning: 2026-02-15T18:42:23.821Z
Learnt from: CR
Repo: GabeDuarteM/blocky-ui PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-02-15T18:42:23.821Z
Learning: Never commit secrets; use `.env` file for local development environment variables
Applied to files:
AGENTS.md
🪛 LanguageTool
README.md
[style] ~115-~115: To form a complete sentence, be sure to include a subject.
Context: ... | Enable query logging. Can be mysql, postgresql, timescale, ...
(MISSING_IT_THERE)
🔇 Additional comments (8)
.changeset/polite-eyes-search.md (1)
1-5: LGTM!The changeset correctly declares a minor version bump for the new feature and follows the proper format without using problematic heading levels.
AGENTS.md (1)
150-150: LGTM!Documentation accurately describes the new environment variable and its purpose, consistent with the implementation in
src/env.js.README.md (2)
43-44: LGTM!The docker-compose example appropriately shows the authentication header as a commented option with a clear placeholder value.
111-119: LGTM!The configuration table accurately documents the new
BLOCKY_AUTH_HEADERvariable with helpful examples showing different authentication schemes (Bearer token, Basic auth).src/env.js (2)
17-17: LGTM!The schema correctly defines
BLOCKY_AUTH_HEADERas an optional string, allowing flexible authentication header formats (Bearer, Basic, API keys, etc.).
44-44: LGTM!The runtime environment mapping correctly sources the value from
process.env.BLOCKY_AUTH_HEADER.src/server/api/routers/blocky.ts (1)
28-34: LGTM!The conditional spread pattern for adding the
Authorizationheader is clean and idiomatic. Setting headers at theky.create()level ensures all API requests consistently include authentication when configured.src/server/prometheus/client.ts (1)
17-24: LGTM!The conditional Authorization header is correctly applied to Prometheus metrics fetching. The implementation properly handles the optional auth header.
| await ky.head(getPrometheusUrl(), { | ||
| timeout: 5000, | ||
| headers: env.BLOCKY_AUTH_HEADER | ||
| ? { Authorization: env.BLOCKY_AUTH_HEADER } | ||
| : undefined, | ||
| }); |
There was a problem hiding this comment.
🧹 Nitpick | 🔵 Trivial
Consider extracting the header construction to reduce duplication.
The same header construction logic appears twice in this file (lines 20-22 and 35-37). While the current implementation is correct, you could extract this to a helper constant or function for consistency.
♻️ Optional refactor
+function getAuthHeaders(): { Authorization: string } | undefined {
+ return env.BLOCKY_AUTH_HEADER
+ ? { Authorization: env.BLOCKY_AUTH_HEADER }
+ : undefined;
+}
+
export async function fetchPrometheusMetrics(): Promise<ParsedMetrics | null> {
try {
const text = await ky
.get(getPrometheusUrl(), {
timeout: 10000,
- headers: env.BLOCKY_AUTH_HEADER
- ? { Authorization: env.BLOCKY_AUTH_HEADER }
- : undefined,
+ headers: getAuthHeaders(),
})
.text();
return parsePrometheusText(text);
} catch {
return null;
}
}
export async function checkPrometheusAvailable(): Promise<boolean> {
try {
await ky.head(getPrometheusUrl(), {
timeout: 5000,
- headers: env.BLOCKY_AUTH_HEADER
- ? { Authorization: env.BLOCKY_AUTH_HEADER }
- : undefined,
+ headers: getAuthHeaders(),
});
return true;
} catch {
return false;
}
}🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@src/server/prometheus/client.ts` around lines 33 - 38, Extract the duplicated
header construction (env.BLOCKY_AUTH_HEADER ? { Authorization:
env.BLOCKY_AUTH_HEADER } : undefined) into a single helper (e.g., const
authHeader or function buildAuthHeader()) and use it in both places where ky
requests are made (the calls using ky.get and ky.head around
getPrometheusUrl()); replace the inline ternary with the helper to remove
duplication and keep behavior identical, referencing env.BLOCKY_AUTH_HEADER,
getPrometheusUrl, and the ky calls.
There was a problem hiding this comment.
I'll leave this up to the human reviewer; if desired I'd be happy to extract it out.
There was a problem hiding this comment.
@mlhynfield Sounds good! The suggestion is purely optional and the current implementation is correct as-is. I'll leave it for the human reviewer to decide. 👍
1 participant
Before Submitting This PR
Please confirm you have done the following:
If this is a feature or change that was previously closed/rejected:
Human Written Description
In cases such as my own where the blocky-ui does not run in the same network space as blocky itself, since the blocky API must be exposed at an endpoint reachable by blocky-ui, I would like to protect it via a reverse-proxy with, for example, basic auth. Currently, blocky-ui does not support custom headers, so if accepted this change will add the option to configure an Authorization header via the
BLOCKY_AUTH_HEADERenvironment variable to authenticate API requests.Related Issues/Discussions
I couldn't find any related issues, discussions, or PRs.
Testing
Since I currently have blocky exposed on my home network at both an authenticated endpoint and a non-authenticated endpoint, I tested this via the
bun devagainst both endpoints. WithBLOCKY_AUTH_HEADERset to the correct value, I could connect blocky-ui to both endpoints, and with it unset or set to an incorrect value I could connect blocky-ui to the unauthenticated endpoint but not the authenticated endpoint.Screenshots/Videos (if applicable)
Before:
After:
AI Assistance
If AI was used: