Implement membership notifications and deep-link handling for Electron desktop app #246

2026-06-09T00:27:52Z

talksik commented

2026-06-09 00:27:52 +00:00

(Migrated from github.com)

Summary by CodeRabbit

New Features
- Deep link support for the desktop app (cold-start and runtime) with renderer integration.
- New-member email notifications sent to prior members when someone joins.
Security
- Hardened desktop app browser settings and window hardening for packaged builds.
Documentation
- Updated desktop README with CORS behavior notes.

## Summary by CodeRabbit * **New Features** * Deep link support for the desktop app (cold-start and runtime) with renderer integration. * New-member email notifications sent to prior members when someone joins. * **Security** * Hardened desktop app browser settings and window hardening for packaged builds. * **Documentation** * Updated desktop README with CORS behavior notes.

coderabbitai[bot] commented

2026-06-09 00:28:05 +00:00

(Migrated from github.com)

📝 Walkthrough

Walkthrough

This PR adds member-join email notifications to the network service and implements OS-level deep-link routing in the Electron desktop app, including mocks, wiring, templates, preload contracts, main-process handlers, and renderer navigation.

Changes

Member Join Email Notifications

Layer / File(s)	Summary
Human service mock generation `go/internal/human/service.go`, `go/internal/human/mocks/service.go`	GoMock generates `MockService` with methods for lookup, creation, listing, and notification-state updates to support tests.
Human lookup interface and service wiring `go/internal/network/service.go`, `go/cmd/orion/main.go`	Introduce local `humanLookup` interface, wire it into `serviceImpl`, update `NewService` signature, and main now passes a Firestore-backed membership publisher.
Accept invitation email notification and templates `go/internal/network/service.go`, `go/internal/network/service_test.go`	`AcceptInvitation` preloads prior member IDs, resolves human records, filters recipients, and sends “new member joined” emails; templates use centralized URL constants and shared desktop footer; tests pass a mocked human service.
Network test updates `go/internal/network/service_test.go`	Tests construct a mock human service, stub `GetByID`, and pass it into `network.NewService` with the new arity.
Build tooling updates `.gitignore`, `go/Taskfile.yml`	Add `.gitignore` entry for `tags` and add `go fmt ./...` format step to Taskfile generate task.

Electron Deep Linking

Layer / File(s)	Summary
Deep-link type contracts and preload API `js/desktop/src/electron.d.ts`, `js/desktop/src/preload.ts`	Global `Window` type extended with `electronDeepLink` and preload exposes `getPending()` and `onNavigate()` to the renderer.
Main process deep-link routing and IPC handlers `js/desktop/src/main.ts`	Add `deepLinkPath`/`tryNavigateToDeepLink`, store pending deep links for cold-starts, route OS `llink://` events, register IPC to deliver pending links, tighten `webPreferences`, and remove prior CORS header injection.
Renderer deep-link navigation listener `js/desktop/src/App.tsx`	`DeepLinkNavigationListener` fetches pending deep-links on mount and subscribes to future navigate events via `electronDeepLink`, navigating with React Router.
Documentation and Windows environment setup `js/desktop/README.md`, `js/desktop/package.json`	README documents CORS differences between dev and packaged modes; Windows packaging scripts now run with `cross-env APP_ENV=prod`.

Sequence Diagrams

sequenceDiagram
  participant Member as Network Member (Existing)
  participant Network as Network Service
  participant HumanLookup as Human Lookup
  participant Aero as Email Service
  Member->>Network: AcceptInvitation(ctx, invitationID)
  Network->>Network: Fetch network & prior member IDs
  Network->>HumanLookup: GetByID(ctx, priorMemberID)
  HumanLookup-->>Network: human.Human{Email}
  Network->>Aero: ShootEmail(newMemberTemplate, priorMember.Email)
  Aero-->>Network: email sent
  Network-->>Member: invitation accepted

sequenceDiagram
  participant OS as Operating System
  participant MainProc as Electron Main Process
  participant Renderer as Desktop App Renderer
  participant Router as React Router
  OS->>MainProc: open llink://path (cold-start or second-instance)
  MainProc->>MainProc: deepLinkPath(url) → parse route
  MainProc->>MainProc: tryNavigateToDeepLink(route)
  alt Renderer not ready
    MainProc->>MainProc: store pendingDeepLink
  else Renderer ready
    MainProc->>Renderer: ipc.send('deep-link:navigate', route)
  end
  Renderer->>Renderer: DeepLinkNavigationListener: getPending()
  Renderer-->>MainProc: ipc.invoke('deep-link:get-pending')
  MainProc-->>Renderer: Promise<route | null>
  Renderer->>Router: navigate(route)
  Router-->>Renderer: path matched, component rendered

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Poem

🐰 I sniff the new member's trail, a gentle bell—
Emails flutter out to friends who know them well.
Deep links whisper routes from OS into view,
Renderer hops the path and greets the rendezvous.
Hops and code—celebrate the new and true.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 26.67% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The PR title accurately summarizes the main changes: implementing membership notifications (network service changes, human service mocking) and deep-link handling (Electron preload, main process, App component updates).

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch free-monkey

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[![Review Change Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/flowy-live/llink/pull/246?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)   <details> <summary>📝 Walkthrough</summary> ## Walkthrough This PR adds member-join email notifications to the network service and implements OS-level deep-link routing in the Electron desktop app, including mocks, wiring, templates, preload contracts, main-process handlers, and renderer navigation. ## Changes **Member Join Email Notifications** |Layer / File(s)|Summary| |---|---| |**Human service mock generation** `go/internal/human/service.go`, `go/internal/human/mocks/service.go`|GoMock generates `MockService` with methods for lookup, creation, listing, and notification-state updates to support tests.| |**Human lookup interface and service wiring** `go/internal/network/service.go`, `go/cmd/orion/main.go`|Introduce local `humanLookup` interface, wire it into `serviceImpl`, update `NewService` signature, and main now passes a Firestore-backed membership publisher.| |**Accept invitation email notification and templates** `go/internal/network/service.go`, `go/internal/network/service_test.go`|`AcceptInvitation` preloads prior member IDs, resolves human records, filters recipients, and sends “new member joined” emails; templates use centralized URL constants and shared desktop footer; tests pass a mocked human service.| |**Network test updates** `go/internal/network/service_test.go`|Tests construct a mock human service, stub `GetByID`, and pass it into `network.NewService` with the new arity.| |**Build tooling updates** `.gitignore`, `go/Taskfile.yml`|Add `.gitignore` entry for `tags` and add `go fmt ./...` format step to Taskfile generate task.| **Electron Deep Linking** |Layer / File(s)|Summary| |---|---| |**Deep-link type contracts and preload API** `js/desktop/src/electron.d.ts`, `js/desktop/src/preload.ts`|Global `Window` type extended with `electronDeepLink` and preload exposes `getPending()` and `onNavigate()` to the renderer.| |**Main process deep-link routing and IPC handlers** `js/desktop/src/main.ts`|Add `deepLinkPath`/`tryNavigateToDeepLink`, store pending deep links for cold-starts, route OS `llink://` events, register IPC to deliver pending links, tighten `webPreferences`, and remove prior CORS header injection.| |**Renderer deep-link navigation listener** `js/desktop/src/App.tsx`|`DeepLinkNavigationListener` fetches pending deep-links on mount and subscribes to future navigate events via `electronDeepLink`, navigating with React Router.| |**Documentation and Windows environment setup** `js/desktop/README.md`, `js/desktop/package.json`|README documents CORS differences between dev and packaged modes; Windows packaging scripts now run with `cross-env APP_ENV=prod`.| ## Sequence Diagrams ```mermaid sequenceDiagram participant Member as Network Member (Existing) participant Network as Network Service participant HumanLookup as Human Lookup participant Aero as Email Service Member->>Network: AcceptInvitation(ctx, invitationID) Network->>Network: Fetch network & prior member IDs Network->>HumanLookup: GetByID(ctx, priorMemberID) HumanLookup-->>Network: human.Human{Email} Network->>Aero: ShootEmail(newMemberTemplate, priorMember.Email) Aero-->>Network: email sent Network-->>Member: invitation accepted ``` ```mermaid sequenceDiagram participant OS as Operating System participant MainProc as Electron Main Process participant Renderer as Desktop App Renderer participant Router as React Router OS->>MainProc: open llink://path (cold-start or second-instance) MainProc->>MainProc: deepLinkPath(url) → parse route MainProc->>MainProc: tryNavigateToDeepLink(route) alt Renderer not ready MainProc->>MainProc: store pendingDeepLink else Renderer ready MainProc->>Renderer: ipc.send('deep-link:navigate', route) end Renderer->>Renderer: DeepLinkNavigationListener: getPending() Renderer-->>MainProc: ipc.invoke('deep-link:get-pending') MainProc-->>Renderer: Promise<route | null> Renderer->>Router: navigate(route) Router-->>Renderer: path matched, component rendered ``` ## Estimated code review effort 🎯 4 (Complex) | ⏱️ ~45 minutes ## Poem > 🐰 I sniff the new member's trail, a gentle bell— > Emails flutter out to friends who know them well. > Deep links whisper routes from OS into view, > Renderer hops the path and greets the rendezvous. > Hops and code—celebrate the new and true. </details>   <details> <summary>🚥 Pre-merge checks | ✅ 4 | ❌ 1</summary> ### ❌ Failed checks (1 warning) | Check name | Status | Explanation | Resolution | | :----------------: | :--------- | :------------------------------------------------------------------------------------ | :--------------------------------------------------------------------------------- | | Docstring Coverage | ⚠️ Warning | Docstring coverage is 26.67% which is insufficient. The required threshold is 80.00%. | Write docstrings for the functions missing them to satisfy the coverage threshold. | <details> <summary>✅ Passed checks (4 passed)</summary> | Check name | Status | Explanation | | :------------------------: | :------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Description Check | ✅ Passed | Check skipped - CodeRabbit’s high-level summary is enabled. | | Linked Issues check | ✅ Passed | Check skipped because no linked issues were found for this pull request. | | Out of Scope Changes check | ✅ Passed | Check skipped because no linked issues were found for this pull request. | | Title check | ✅ Passed | The PR title accurately summarizes the main changes: implementing membership notifications (network service changes, human service mocking) and deep-link handling (Electron preload, main process, App component updates). | </details> ✏️ Tip: You can configure your own custom pre-merge checks in the settings. </details>   <details> <summary>✨ Finishing Touches</summary> <details> <summary>📝 Generate docstrings</summary> - [ ]  Create stacked PR - [ ]  Commit on current branch </details> <details> <summary>🧪 Generate unit tests (beta)</summary> - [ ]  Create PR with unit tests - [ ]  Commit unit tests in branch `free-monkey` </details> </details>   --- Comment `@coderabbitai help` to get the list of available commands and usage tips.

coderabbitai[bot] (Migrated from github.com) reviewed 2026-06-09 00:35:01 +00:00

coderabbitai[bot] (Migrated from github.com) left a comment

Actionable comments posted: 3

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
go/internal/network/service_test.go (1)
34-37: 🛠️ Refactor suggestion | 🟠 Major | ⚡ Quick win

Add explicit assertions for member-join notification behavior.

Using AnyTimes() for both ShootEmail and GetByID makes the new notification path in AcceptInvitation effectively untested. Please add a focused expectation in TestNetworkInvitations that validates the join-notification email is sent with the intended recipient set.

Also applies to: 46-55
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go/internal/network/service_test.go` around lines 34 - 37, In
TestNetworkInvitations, replace the broad AnyTimes() Aero expectations with a
focused EXPECT for mockAero.ShootEmail that asserts the join-notification is
sent to the intended recipient: add an EXPECT call in the test that matches
gomock.AssignableToTypeOf or a custom gomock matcher on the request parameter
and checks the recipient/email field equals the expected member email, and keep
other general expectations (e.g., GetByID) restricted or separate so the
AcceptInvitation path actually exercises and verifies the join-notification
behavior for mockAero.ShootEmail.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@go/internal/network/service.go`:
- Around line 270-296: When building emailRecipients in the block that iterates
prevMembersHumanIds (using s.humanLookup.GetByID and appending to
emailRecipients), only append human.Email if it is non-empty and the human has
EmailNotificationsEnabled == true (or equivalent opt-in flag); after the loop,
skip calling s.aeroSvc.ShootEmail (and avoid calling buildNewMemberHTML) if
emailRecipients is empty to prevent sending with no recipients, and update the
warning log in the error branch to include network/name and recipient count for
context.

In `@js/desktop/README.md`:
- Line 3: Fix the possessive pronoun in the README sentence that reads "In dev:
each renderer process has it's own localhost port." — change "it's" to the
possessive "its" so the sentence becomes "In dev: each renderer process has its
own localhost port." Update the string in the README where that exact sentence
appears.

In `@js/desktop/src/App.tsx`:
- Line 84: DeepLinkNavigationListener is currently only mounted inside the
authenticated UI and so unmounts on sign-out, causing the main process to send
live deep-link events that get lost; fix by either moving the
DeepLinkNavigationListener to a non-auth-gated root so it stays mounted across
auth transitions (mount it in App.tsx outside the auth conditional) or implement
an explicit IPC lifecycle: add renderer-side messages (e.g. 'deep-link-ready'
and 'deep-link-unready') emitted by DeepLinkNavigationListener on mount/unmount
and update the main process to queue deep-link events until it receives a
'deep-link-ready' signal (or stop sending live events while unready). Ensure the
chosen approach updates the main process handler and the
DeepLinkNavigationListener mount/unmount hooks accordingly so no deep-link
events are lost.

---

Outside diff comments:
In `@go/internal/network/service_test.go`:
- Around line 34-37: In TestNetworkInvitations, replace the broad AnyTimes()
Aero expectations with a focused EXPECT for mockAero.ShootEmail that asserts the
join-notification is sent to the intended recipient: add an EXPECT call in the
test that matches gomock.AssignableToTypeOf or a custom gomock matcher on the
request parameter and checks the recipient/email field equals the expected
member email, and keep other general expectations (e.g., GetByID) restricted or
separate so the AcceptInvitation path actually exercises and verifies the
join-notification behavior for mockAero.ShootEmail.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 09d6616b-68c6-4a27-ab02-d79b6565c946

📥 Commits

Reviewing files that changed from the base of the PR and between 9184d002d3 and e3bd3b7aa6.

📒 Files selected for processing (13)

.gitignore
go/Taskfile.yml
go/cmd/orion/main.go
go/internal/human/mocks/service.go
go/internal/human/service.go
go/internal/network/service.go
go/internal/network/service_test.go
js/desktop/README.md
js/desktop/package.json
js/desktop/src/App.tsx
js/desktop/src/electron.d.ts
js/desktop/src/main.ts
js/desktop/src/preload.ts

**Actionable comments posted: 3** > [!CAUTION] > Some comments are outside the diff and can’t be posted inline due to platform limitations. > > > > <details> > <summary>⚠️ Outside diff range comments (1)</summary><blockquote> > > <details> > <summary>go/internal/network/service_test.go (1)</summary><blockquote> > > `34-37`: _🛠️ Refactor suggestion_ | _🟠 Major_ | _⚡ Quick win_ > > **Add explicit assertions for member-join notification behavior.** > > Using `AnyTimes()` for both `ShootEmail` and `GetByID` makes the new notification path in `AcceptInvitation` effectively untested. Please add a focused expectation in `TestNetworkInvitations` that validates the join-notification email is sent with the intended recipient set. > > > > Also applies to: 46-55 > > <details> > <summary>🤖 Prompt for AI Agents</summary> > > ``` > Verify each finding against current code. Fix only still-valid issues, skip the > rest with a brief reason, keep changes minimal, and validate. > > In `@go/internal/network/service_test.go` around lines 34 - 37, In > TestNetworkInvitations, replace the broad AnyTimes() Aero expectations with a > focused EXPECT for mockAero.ShootEmail that asserts the join-notification is > sent to the intended recipient: add an EXPECT call in the test that matches > gomock.AssignableToTypeOf or a custom gomock matcher on the request parameter > and checks the recipient/email field equals the expected member email, and keep > other general expectations (e.g., GetByID) restricted or separate so the > AcceptInvitation path actually exercises and verifies the join-notification > behavior for mockAero.ShootEmail. > ``` > > </details> > >  > > </blockquote></details> > > </blockquote></details> <details> <summary>🤖 Prompt for all review comments with AI agents</summary> ``` Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. Inline comments: In `@go/internal/network/service.go`: - Around line 270-296: When building emailRecipients in the block that iterates prevMembersHumanIds (using s.humanLookup.GetByID and appending to emailRecipients), only append human.Email if it is non-empty and the human has EmailNotificationsEnabled == true (or equivalent opt-in flag); after the loop, skip calling s.aeroSvc.ShootEmail (and avoid calling buildNewMemberHTML) if emailRecipients is empty to prevent sending with no recipients, and update the warning log in the error branch to include network/name and recipient count for context. In `@js/desktop/README.md`: - Line 3: Fix the possessive pronoun in the README sentence that reads "In dev: each renderer process has it's own localhost port." — change "it's" to the possessive "its" so the sentence becomes "In dev: each renderer process has its own localhost port." Update the string in the README where that exact sentence appears. In `@js/desktop/src/App.tsx`: - Line 84: DeepLinkNavigationListener is currently only mounted inside the authenticated UI and so unmounts on sign-out, causing the main process to send live deep-link events that get lost; fix by either moving the DeepLinkNavigationListener to a non-auth-gated root so it stays mounted across auth transitions (mount it in App.tsx outside the auth conditional) or implement an explicit IPC lifecycle: add renderer-side messages (e.g. 'deep-link-ready' and 'deep-link-unready') emitted by DeepLinkNavigationListener on mount/unmount and update the main process to queue deep-link events until it receives a 'deep-link-ready' signal (or stop sending live events while unready). Ensure the chosen approach updates the main process handler and the DeepLinkNavigationListener mount/unmount hooks accordingly so no deep-link events are lost. --- Outside diff comments: In `@go/internal/network/service_test.go`: - Around line 34-37: In TestNetworkInvitations, replace the broad AnyTimes() Aero expectations with a focused EXPECT for mockAero.ShootEmail that asserts the join-notification is sent to the intended recipient: add an EXPECT call in the test that matches gomock.AssignableToTypeOf or a custom gomock matcher on the request parameter and checks the recipient/email field equals the expected member email, and keep other general expectations (e.g., GetByID) restricted or separate so the AcceptInvitation path actually exercises and verifies the join-notification behavior for mockAero.ShootEmail. ``` </details> <details> <summary>🪄 Autofix (Beta)</summary> Fix all unresolved CodeRabbit comments on this PR: - [ ]  Push a commit to this branch (recommended) - [ ]  Create a new PR with the fixes </details> --- <details> <summary>ℹ️ Review info</summary> <details> <summary>⚙️ Run configuration</summary> **Configuration used**: defaults **Review profile**: CHILL **Plan**: Pro Plus **Run ID**: `09d6616b-68c6-4a27-ab02-d79b6565c946` </details> <details> <summary>📥 Commits</summary> Reviewing files that changed from the base of the PR and between 9184d002d319b2f67f4d5821af19a482810f719e and e3bd3b7aa657b8aa7bc4319fe0a94d570cb3688f. </details> <details> <summary>📒 Files selected for processing (13)</summary> * `.gitignore` * `go/Taskfile.yml` * `go/cmd/orion/main.go` * `go/internal/human/mocks/service.go` * `go/internal/human/service.go` * `go/internal/network/service.go` * `go/internal/network/service_test.go` * `js/desktop/README.md` * `js/desktop/package.json` * `js/desktop/src/App.tsx` * `js/desktop/src/electron.d.ts` * `js/desktop/src/main.ts` * `js/desktop/src/preload.ts` </details> </details>

go/internal/network/service.go

						
				@@ -289,0 +378,4 @@

				        <table role="presentation" width="100%%" cellspacing="0" cellpadding="0" border="0" style="max-width:480px;background-color:#ffffff;border-radius:12px;padding:40px;">

				          <tr>

				            <td style="font-size:22px;font-weight:600;color:#111111;padding-bottom:16px;">

				              A new member joined %s

coderabbitai[bot] (Migrated from github.com) commented

2026-06-09 00:34:59 +00:00

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Honor notification preferences before sending join emails.

Line 280 appends every resolved member email without checking EmailNotificationsEnabled (and without guarding blank emails). That can notify opted-out users and trigger ShootEmail with no valid recipients.

[sraise_placeholder]

Proposed fix

 	if membersErr == nil && len(prevMembersHumanIds) > 0 {
 		emailRecipients := make([]string, 0, len(prevMembersHumanIds))
 		for _, memberHumanId := range prevMembersHumanIds {
 			if memberHumanId != "" {
 				human, err := s.humanLookup.GetByID(ctx, memberHumanId)
 				if err != nil {
 					flog.Warn("unable to find human", "error", err, "humanId", memberHumanId)
 					continue
 				}
-
-				emailRecipients = append(emailRecipients, human.Email)
+				if !human.EmailNotificationsEnabled || strings.TrimSpace(human.Email) == "" {
+					continue
+				}
+				emailRecipients = append(emailRecipients, human.Email)
 			}
 		}
 
-		newMemberEmailPrefix := strings.Split(normalized, "@")[0]
-		_, err = s.aeroSvc.ShootEmail(ctx, &pbaero.ShootEmailRequest{
-			ToEmails: emailRecipients,
-			Subject:  fmt.Sprintf("A new member has joined %s", network.Name),
-			TemplateData: &pbaero.ShootEmailRequest_SimpleHtmlData{
-				SimpleHtmlData: &pbaero.SimpleHtmlData{
-					Html: buildNewMemberHTML(network.Name, newMemberEmailPrefix),
-				},
-			},
-		})
-		if err != nil {
-			flog.Warn("unable to send email notification", "email", email, "network", network.Name)
+		if len(emailRecipients) > 0 {
+			newMemberEmailPrefix := strings.Split(normalized, "@")[0]
+			_, err = s.aeroSvc.ShootEmail(ctx, &pbaero.ShootEmailRequest{
+				ToEmails: emailRecipients,
+				Subject:  fmt.Sprintf("A new member has joined %s", network.Name),
+				TemplateData: &pbaero.ShootEmailRequest_SimpleHtmlData{
+					SimpleHtmlData: &pbaero.SimpleHtmlData{
+						Html: buildNewMemberHTML(network.Name, newMemberEmailPrefix),
+					},
+				},
+			})
+			if err != nil {
+				flog.Warn("unable to send email notification", "email", email, "network", network.Name)
+			}
 		}
 	}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go/internal/network/service.go` around lines 270 - 296, When building
emailRecipients in the block that iterates prevMembersHumanIds (using
s.humanLookup.GetByID and appending to emailRecipients), only append human.Email
if it is non-empty and the human has EmailNotificationsEnabled == true (or
equivalent opt-in flag); after the loop, skip calling s.aeroSvc.ShootEmail (and
avoid calling buildNewMemberHTML) if emailRecipients is empty to prevent sending
with no recipients, and update the warning log in the error branch to include
network/name and recipient count for context.

✅ Addressed in commit 60b1c3e

_⚠️ Potential issue_ | _🟠 Major_ | _⚡ Quick win_ **Honor notification preferences before sending join emails.** Line 280 appends every resolved member email without checking `EmailNotificationsEnabled` (and without guarding blank emails). That can notify opted-out users and trigger `ShootEmail` with no valid recipients. [sraise_placeholder] <details> <summary>Proposed fix</summary> ```diff if membersErr == nil && len(prevMembersHumanIds) > 0 { emailRecipients := make([]string, 0, len(prevMembersHumanIds)) for _, memberHumanId := range prevMembersHumanIds { if memberHumanId != "" { human, err := s.humanLookup.GetByID(ctx, memberHumanId) if err != nil { flog.Warn("unable to find human", "error", err, "humanId", memberHumanId) continue } - - emailRecipients = append(emailRecipients, human.Email) + if !human.EmailNotificationsEnabled || strings.TrimSpace(human.Email) == "" { + continue + } + emailRecipients = append(emailRecipients, human.Email) } } - newMemberEmailPrefix := strings.Split(normalized, "@")[0] - _, err = s.aeroSvc.ShootEmail(ctx, &pbaero.ShootEmailRequest{ - ToEmails: emailRecipients, - Subject: fmt.Sprintf("A new member has joined %s", network.Name), - TemplateData: &pbaero.ShootEmailRequest_SimpleHtmlData{ - SimpleHtmlData: &pbaero.SimpleHtmlData{ - Html: buildNewMemberHTML(network.Name, newMemberEmailPrefix), - }, - }, - }) - if err != nil { - flog.Warn("unable to send email notification", "email", email, "network", network.Name) + if len(emailRecipients) > 0 { + newMemberEmailPrefix := strings.Split(normalized, "@")[0] + _, err = s.aeroSvc.ShootEmail(ctx, &pbaero.ShootEmailRequest{ + ToEmails: emailRecipients, + Subject: fmt.Sprintf("A new member has joined %s", network.Name), + TemplateData: &pbaero.ShootEmailRequest_SimpleHtmlData{ + SimpleHtmlData: &pbaero.SimpleHtmlData{ + Html: buildNewMemberHTML(network.Name, newMemberEmailPrefix), + }, + }, + }) + if err != nil { + flog.Warn("unable to send email notification", "email", email, "network", network.Name) + } } } ``` </details> <details> <summary>🤖 Prompt for AI Agents</summary> ``` Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@go/internal/network/service.go` around lines 270 - 296, When building emailRecipients in the block that iterates prevMembersHumanIds (using s.humanLookup.GetByID and appending to emailRecipients), only append human.Email if it is non-empty and the human has EmailNotificationsEnabled == true (or equivalent opt-in flag); after the loop, skip calling s.aeroSvc.ShootEmail (and avoid calling buildNewMemberHTML) if emailRecipients is empty to prevent sending with no recipients, and update the warning log in the error branch to include network/name and recipient count for context. ``` </details>    ✅ Addressed in commit 60b1c3e

js/desktop/README.md

						
				@@ -0,0 +1,5 @@

				# Notes

				## CORS for desktop app

				In dev: each renderer process has it's own localhost port. The renderer process passes this in the `Origin` header for requests, and expects appropriate ACAO headers in the response.

coderabbitai[bot] (Migrated from github.com) commented

2026-06-09 00:34:59 +00:00

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Fix possessive pronoun.

Change "it's own" to "its own" (possessive, not contraction).

📝 Proposed fix

-In dev: each renderer process has it's own localhost port. The renderer process passes this in the `Origin` header for requests, and expects appropriate ACAO headers in the response.
+In dev: each renderer process has its own localhost port. The renderer process passes this in the `Origin` header for requests, and expects appropriate ACAO headers in the response.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

In dev: each renderer process has its own localhost port. The renderer process passes this in the `Origin` header for requests, and expects appropriate ACAO headers in the response.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@js/desktop/README.md` at line 3, Fix the possessive pronoun in the README
sentence that reads "In dev: each renderer process has it's own localhost port."
— change "it's" to the possessive "its" so the sentence becomes "In dev: each
renderer process has its own localhost port." Update the string in the README
where that exact sentence appears.

_⚠️ Potential issue_ | _🟡 Minor_ | _⚡ Quick win_ **Fix possessive pronoun.** Change "it's own" to "its own" (possessive, not contraction). <details> <summary>📝 Proposed fix</summary> ```diff -In dev: each renderer process has it's own localhost port. The renderer process passes this in the `Origin` header for requests, and expects appropriate ACAO headers in the response. +In dev: each renderer process has its own localhost port. The renderer process passes this in the `Origin` header for requests, and expects appropriate ACAO headers in the response. ``` </details>  <details> <summary>📝 Committable suggestion</summary> > ‼️ **IMPORTANT** > Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements. ```suggestion In dev: each renderer process has its own localhost port. The renderer process passes this in the `Origin` header for requests, and expects appropriate ACAO headers in the response. ``` </details>  <details> <summary>🤖 Prompt for AI Agents</summary> ``` Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@js/desktop/README.md` at line 3, Fix the possessive pronoun in the README sentence that reads "In dev: each renderer process has it's own localhost port." — change "it's" to the possessive "its" so the sentence becomes "In dev: each renderer process has its own localhost port." Update the string in the README where that exact sentence appears. ``` </details>

js/desktop/src/App.tsx

coderabbitai[bot] (Migrated from github.com) commented

2026-06-09 00:34:59 +00:00

⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

Deep-link listener is auth-gated and can drop OS deep links

DeepLinkNavigationListener only mounts in authenticated UI (Line 84). When auth flips away from authenticated, it unmounts, but the main process remains in “ready” mode and sends live deep-link events instead of queueing them; those events are lost before re-authentication.

Keep deep-link subscription active across auth states, or add explicit ready/unready IPC lifecycle so main only live-sends when a listener is actually mounted.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@js/desktop/src/App.tsx` at line 84, DeepLinkNavigationListener is currently
only mounted inside the authenticated UI and so unmounts on sign-out, causing
the main process to send live deep-link events that get lost; fix by either
moving the DeepLinkNavigationListener to a non-auth-gated root so it stays
mounted across auth transitions (mount it in App.tsx outside the auth
conditional) or implement an explicit IPC lifecycle: add renderer-side messages
(e.g. 'deep-link-ready' and 'deep-link-unready') emitted by
DeepLinkNavigationListener on mount/unmount and update the main process to queue
deep-link events until it receives a 'deep-link-ready' signal (or stop sending
live events while unready). Ensure the chosen approach updates the main process
handler and the DeepLinkNavigationListener mount/unmount hooks accordingly so no
deep-link events are lost.

_⚠️ Potential issue_ | _🟠 Major_ | _🏗️ Heavy lift_ **Deep-link listener is auth-gated and can drop OS deep links** `DeepLinkNavigationListener` only mounts in authenticated UI (Line 84). When auth flips away from authenticated, it unmounts, but the main process remains in “ready” mode and sends live deep-link events instead of queueing them; those events are lost before re-authentication. Keep deep-link subscription active across auth states, or add explicit ready/unready IPC lifecycle so main only live-sends when a listener is actually mounted. <details> <summary>🤖 Prompt for AI Agents</summary> ``` Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@js/desktop/src/App.tsx` at line 84, DeepLinkNavigationListener is currently only mounted inside the authenticated UI and so unmounts on sign-out, causing the main process to send live deep-link events that get lost; fix by either moving the DeepLinkNavigationListener to a non-auth-gated root so it stays mounted across auth transitions (mount it in App.tsx outside the auth conditional) or implement an explicit IPC lifecycle: add renderer-side messages (e.g. 'deep-link-ready' and 'deep-link-unready') emitted by DeepLinkNavigationListener on mount/unmount and update the main process to queue deep-link events until it receives a 'deep-link-ready' signal (or stop sending live events while unready). Ensure the chosen approach updates the main process handler and the DeepLinkNavigationListener mount/unmount hooks accordingly so no deep-link events are lost. ``` </details>

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: FlowyLabs/llink#246