feat(desktop): add settings toggle to disable UI animations and visual effects (#1853) - #2093
Conversation
|
🚨 Contributor flagged. Click here for more info: Superagent Dashboard |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| if (!video.public && video.ownerId !== user?.id) { | ||
| return Response.json({ error: "Unauthorized" }, { status: 401 }); | ||
| } |
There was a problem hiding this comment.
When a public video is protected by a video or space password or an allowed-email-domain restriction, this owner-only check still returns its AI title, summary, and chapters to an unauthenticated caller. The endpoint needs to apply the same effective viewing policy as the share page. How this was verified: The new check was compared with the share-page policy, which verifies password candidates and other effective access rules even for public videos.
Knowledge Base Used: Web App (apps/web)
Prompt To Fix With AI
This is a comment left during a code review.
Path: apps/web/app/api/video/metadata/route.ts
Line: 60-62
Comment:
**Metadata bypasses video access policy**
When a public video is protected by a video or space password or an allowed-email-domain restriction, this owner-only check still returns its AI title, summary, and chapters to an unauthenticated caller. The endpoint needs to apply the same effective viewing policy as the share page. **How this was verified:** The new check was compared with the share-page policy, which verifies password candidates and other effective access rules even for public videos.
**Knowledge Base Used:** [Web App (apps/web)](https://app.greptile.com/cap/-/custom-context/knowledge-base/capsoftware/cap/-/docs/web-app.md)
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.| return c.json({ | ||
| data: { | ||
| id: video.id, | ||
| transcriptionStatus: video.transcriptionStatus, | ||
| s3Key: video.s3Key, | ||
| }, | ||
| }); |
There was a problem hiding this comment.
When a developer requests a transcript after processing completes, this response returns the raw video's s3Key rather than transcript content or a usable transcript location. Because transcripts are stored under a separate owner-based transcription.vtt path unavailable to the client, the caller cannot retrieve the completed transcript.
Knowledge Base Used: Web App (apps/web)
Prompt To Fix With AI
This is a comment left during a code review.
Path: apps/web/app/api/developer/v1/[...route]/videos.ts
Line: 158-164
Comment:
**Transcript endpoint returns video key**
When a developer requests a transcript after processing completes, this response returns the raw video's `s3Key` rather than transcript content or a usable transcript location. Because transcripts are stored under a separate owner-based `transcription.vtt` path unavailable to the client, the caller cannot retrieve the completed transcript.
**Knowledge Base Used:** [Web App (apps/web)](https://app.greptile.com/cap/-/custom-context/knowledge-base/capsoftware/cap/-/docs/web-app.md)
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.| pub async fn info(url_or_id: String, format: OutputFormat) -> Result<(), String> { | ||
| let video_id = if url_or_id.contains('/') { | ||
| url_or_id | ||
| .rsplit('/') | ||
| .next() | ||
| .unwrap_or(&url_or_id) | ||
| .to_string() | ||
| } else { | ||
| url_or_id |
There was a problem hiding this comment.
When a valid share URL ends with /, rsplit('/').next() returns an empty string, so the metadata request sends an empty videoId and the command fails with a 400 response. Parse the URL and select the final non-empty path segment, as the existing CLI ID parser does.
Knowledge Base Used: Cap CLI (apps/cli)
Prompt To Fix With AI
This is a comment left during a code review.
Path: apps/cli/src/recordings.rs
Line: 110-118
Comment:
**Trailing slash empties video ID**
When a valid share URL ends with `/`, `rsplit('/').next()` returns an empty string, so the metadata request sends an empty `videoId` and the command fails with a 400 response. Parse the URL and select the final non-empty path segment, as the existing CLI ID parser does.
**Knowledge Base Used:** [Cap CLI (`apps/cli`)](https://app.greptile.com/cap/-/custom-context/knowledge-base/capsoftware/cap/-/docs/cli.md)
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.| export async function GET(request: NextRequest) { | ||
| const { searchParams } = new URL(request.url); | ||
| const videoId = searchParams.get("videoId"); | ||
|
|
||
| if (!videoId) { | ||
| return Response.json({ error: "Missing videoId parameter" }, { status: 400 }); | ||
| } | ||
|
|
||
| const query = await db().select().from(videos).where(eq(videos.id, videoId)); | ||
|
|
||
| if (query.length === 0 || !query[0]) { | ||
| return Response.json({ error: "Video not found" }, { status: 404 }); | ||
| } | ||
|
|
||
| const video = query[0]; |
There was a problem hiding this comment.
This new ad-hoc GET handler bypasses the repository's HttpApi endpoint pattern and casts persisted metadata through Record<string, any>. Using the standard typed contract and narrowing metadata from unknown would prevent unchecked shape drift from propagating into the response.
Context Used: AGENTS.md (source)
Prompt To Fix With AI
This is a comment left during a code review.
Path: apps/web/app/api/video/metadata/route.ts
Line: 43-57
Comment:
**Route bypasses typed API conventions**
This new ad-hoc GET handler bypasses the repository's `HttpApi` endpoint pattern and casts persisted metadata through `Record<string, any>`. Using the standard typed contract and narrowing metadata from `unknown` would prevent unchecked shape drift from propagating into the response.
**Context Used:** AGENTS.md ([source](https://github.com/capsoftware/cap/blob/main/AGENTS.md))
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
2 participants
Fixes #1853
Summary
Add user preference setting to toggle visual UI entry and selection animations in Cap Desktop.
Greptile Summary
This PR adds a desktop preference for disabling visual animations while also introducing unrelated CLI recording metadata, developer transcript, tray-hotkey, teleprompter, API rate-limit, and configurable OpenAI endpoint changes.
cap recordings infoand a video metadata GET endpoint.Confidence Score: 1/5
This PR is not safe to merge until the metadata authorization bypass, unusable transcript response, and trailing-slash CLI parsing failure are fixed.
The metadata API discloses protected video-derived content without applying the existing access policy, the developer transcript endpoint cannot deliver completed transcripts, and valid trailing-slash share URLs fail in the new CLI command.
Files Needing Attention: apps/web/app/api/video/metadata/route.ts, apps/web/app/api/developer/v1/[...route]/videos.ts, apps/cli/src/recordings.rs
Security Review
The new video metadata endpoint bypasses existing password and domain access policies for public videos, allowing unauthenticated disclosure of AI-generated titles, summaries, and chapters.
Important Files Changed
Prompt To Fix All With AI
Reviews (1): Last reviewed commit: "feat(desktop): add settings toggle to di..." | Re-trigger Greptile
Context used (6)
apps/cli)