Skip to content

Conversation

@kipsang01
Copy link
Collaborator

@kipsang01 kipsang01 commented Jan 10, 2026

User description

What kind of change does this PR introduce?

eg: Bug fix, feature, docs update, ...

Why was this change needed?

Please link to related issues when possible, and explain WHY you changed things, not WHAT you changed.

Other information:

eg: Did you discuss this change with anybody before working on it (not required, but can be a good idea for bigger changes). Any plans for the future, etc?

Checklist:

Put a "X" in the boxes below to indicate you have followed the checklist;

  • I have read the CONTRIBUTING guide.
  • I checked that there were not similar issues or PRs already open for this.
  • This PR fixes just ONE issue (do not include multiple issues or types of change in the same PR) For example, don't try and fix a UI issue and include new dependencies in the same PR.

PR Type

Enhancement


Description

  • Add Olitt app URL configuration for "Back to Olitt" navigation button

  • Update authentication layout to redirect users back to Olitt app

  • Remove logout component from settings and billing interfaces

  • Simplify Docker build workflow by removing multi-arch platform support

  • Add gap styling to logo navigation element


Diagram Walkthrough

flowchart LR
  A["Environment Config<br/>NEXT_PUBLIC_OLITT_APP_URL"] --> B["Layout Providers<br/>Pass olittAppUrl"]
  B --> C["Variable Context<br/>Store olittAppUrl"]
  C --> D["Logo Component<br/>Link to Olitt"]
  C --> E["Auth Layout<br/>Redirect Button"]
  F["Remove Logout<br/>from UI"] --> G["Settings & Billing<br/>Simplified Navigation"]
Loading

File Walkthrough

Relevant files
Configuration changes
2 files
.env.example
Add Olitt app URL environment variable                                     
+3/-0     
build-and-push-dockerhub.yml
Remove multi-architecture platform support                             
+1/-2     
Enhancement
8 files
layout.tsx
Redesign auth layout with Olitt redirect                                 
+18/-17 
page.tsx
Replace login component with Olitt redirect                           
+19/-3   
layout.tsx
Pass Olitt app URL to context provider                                     
+1/-0     
layout.tsx
Pass Olitt app URL to extension layout                                     
+1/-0     
settings.component.tsx
Remove logout component from settings                                       
+0/-8     
billing.after.tsx
Remove logout component from billing view                               
+0/-4     
logo.tsx
Convert logo to Olitt app navigation link                               
+12/-25 
variable.context.tsx
Add olittAppUrl to context interface                                         
+2/-0     

@qodo-code-review
Copy link

PR Compliance Guide 🔍

Below is a summary of compliance checks for this PR:

Security Compliance
Unvalidated redirect link

Description: The new href uses process.env.NEXT_PUBLIC_OLITT_APP_URL directly (href={olittAppUrl})
without validating scheme/host, so a misconfigured or compromised environment value (e.g.,
javascript:... or a phishing domain) could turn the “Back to Olitt” button into an
XSS/phishing vector.
layout.tsx [17-35]

Referred Code
const olittAppUrl = process.env.NEXT_PUBLIC_OLITT_APP_URL || '/';


return (
  <div className="bg-[#0E0E0E] flex justify-center items-center flex-1 p-[12px] gap-[12px] min-h-screen w-screen text-white">
    <ReturnUrlComponent />
        <div className="flex justify-center items-center flex-col gap-4 text-start">
          <h1 className="text-[32px] font-[600]">Continue in Olitt</h1>
          <p className="text-[14px] text-[#cfcfcf] leading-6">
            Please return to Olitt to start your login again.
          </p>
          <div>
            <a
              href={olittAppUrl}
              className="inline-flex items-center  justify-center px-4 py-3 rounded-[10px] bg-white text-black font-[600] hover:opacity-90 transition-opacity"
            >
              Back to Olitt
            </a>
          </div>
Ticket Compliance
🎫 No ticket provided
  • Create ticket/issue
Codebase Duplication Compliance
Codebase context is not defined

Follow the guide to enable codebase context checks.

Custom Compliance
🟢
Generic: Comprehensive Audit Trails

Objective: To create a detailed and reliable record of critical system actions for security analysis
and compliance.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Meaningful Naming and Self-Documenting Code

Objective: Ensure all identifiers clearly express their purpose and intent, making code
self-documenting

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Robust Error Handling and Edge Case Management

Objective: Ensure comprehensive error handling that provides meaningful context and graceful
degradation

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Secure Error Handling

Objective: To prevent the leakage of sensitive system information through error messages while
providing sufficient detail for internal debugging.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Secure Logging Practices

Objective: To ensure logs are useful for debugging and auditing without exposing sensitive
information like PII, PHI, or cardholder data.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

🔴
Generic: Security-First Input Validation and Data Handling

Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent
vulnerabilities

Status:
Unvalidated redirect URL: The PR uses process.env.NEXT_PUBLIC_OLITT_APP_URL directly in an <a href=...>
without validation/allowlisting, enabling potentially unsafe schemes (e.g., javascript:)
or open-redirect style navigation if the environment value is misconfigured or
attacker-controlled.

Referred Code
const olittAppUrl = process.env.NEXT_PUBLIC_OLITT_APP_URL || '/';


return (
  <div className="bg-[#0E0E0E] flex justify-center items-center flex-1 p-[12px] gap-[12px] min-h-screen w-screen text-white">
    <ReturnUrlComponent />
        <div className="flex justify-center items-center flex-col gap-4 text-start">
          <h1 className="text-[32px] font-[600]">Continue in Olitt</h1>
          <p className="text-[14px] text-[#cfcfcf] leading-6">
            Please return to Olitt to start your login again.
          </p>
          <div>
            <a
              href={olittAppUrl}
              className="inline-flex items-center  justify-center px-4 py-3 rounded-[10px] bg-white text-black font-[600] hover:opacity-90 transition-opacity"
            >
              Back to Olitt
            </a>
          </div>

Learn more about managing compliance generic rules or creating your own custom rules

Compliance status legend 🟢 - Fully Compliant
🟡 - Partial Compliant
🔴 - Not Compliant
⚪ - Requires Further Human Verification
🏷️ - Compliance label

@qodo-code-review
Copy link

PR Code Suggestions ✨

Explore these optional code suggestions:

CategorySuggestion                                                                                                                                    Impact
High-level
Docker build removes ARM64 support

The Docker build process was modified to remove multi-arch support, specifically
for linux/arm64. This is a significant regression that could break local
development for users on ARM-based systems like Apple Silicon and limit future
deployment options.

Examples:

.github/workflows/build-and-push-dockerhub.yml [66-71]
      - name: Build and push image
        uses: docker/build-push-action@v4
        with:
          context: .
          file: Dockerfile.dev
          push: true

Solution Walkthrough:

Before:

# .github/workflows/build-and-push-dockerhub.yml
- name: Build and push multi-arch image
  uses: docker/build-push-action@v4
  with:
    context: .
    file: Dockerfile.dev
    platforms: linux/amd64,linux/arm64
    push: true
    ...

After:

# .github/workflows/build-and-push-dockerhub.yml
- name: Build and push image
  uses: docker/build-push-action@v4
  with:
    context: .
    file: Dockerfile.dev
    # The 'platforms' key is removed, defaulting to only linux/amd64
    push: true
    ...
Suggestion importance[1-10]: 9

__

Why: This suggestion correctly identifies a critical regression in the Docker build process, as removing ARM64 support significantly impacts developers on ARM-based machines and limits deployment flexibility.

High
Possible issue
Avoid empty string for URL fallback

In apps/frontend/src/app/(extension)/layout.tsx, change the fallback for
olittAppUrl from an empty string to 'https://app.olitt.com/app/websites' to
prevent incorrect link behavior.

apps/frontend/src/app/(extension)/layout.tsx [39]

-olittAppUrl={process.env.NEXT_PUBLIC_OLITT_APP_URL || ''}
+olittAppUrl={process.env.NEXT_PUBLIC_OLITT_APP_URL || 'https://app.olitt.com/app/websites'}
  • Apply / Chat
Suggestion importance[1-10]: 7

__

Why: The suggestion correctly identifies an inconsistent fallback value for olittAppUrl that could lead to confusing user navigation, and proposes a fix that aligns with other parts of the codebase.

Medium
General
Use a consistent external fallback URL

In apps/frontend/src/app/(app)/auth/layout.tsx and login/page.tsx, change the
fallback URL for olittAppUrl from '/' to 'https://app.olitt.com/app/websites'
for consistency.

apps/frontend/src/app/(app)/auth/layout.tsx [17]

-const olittAppUrl = process.env.NEXT_PUBLIC_OLITT_APP_URL || '/';
+const olittAppUrl =
+    process.env.NEXT_PUBLIC_OLITT_APP_URL || 'https://app.olitt.com/app/websites';
  • Apply / Chat
Suggestion importance[1-10]: 7

__

Why: This suggestion correctly points out an inconsistent fallback URL and proposes using a more explicit and consistent default, which improves maintainability and predictability.

Medium
  • More

@kipsang01 kipsang01 merged commit 4a39444 into main Jan 10, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants