melhorias - #169
Open
betoarts wants to merge 10 commits into
Open
Conversation
… database persistence
Reviewer's GuideRefines licensing/runtime handling and observability, adds support for GLOBAL_API_KEY license bypass, improves endpoint gating and heartbeat/activation flows, introduces explicit config key constants and RuntimeData naming, wires versioning through VERSION file into binaries and Docker images (including Easypanel deployment support), and adjusts link preview messaging plus GitHub templates/trademark docs. Sequence diagram for runtime initialization and GLOBAL_API_KEY license bypasssequenceDiagram
actor Admin
participant main
participant InitializeRuntime
participant _8ftv
participant _nk7y
participant _2a2d
participant ActivateIntegrity
Admin->>main: start server (GLOBAL_API_KEY set)
main->>InitializeRuntime: InitializeRuntime(tier, version, GLOBAL_API_KEY)
InitializeRuntime->>_8ftv: load saved RuntimeData
alt saved license found
_8ftv-->>InitializeRuntime: RuntimeData(APIKey)
InitializeRuntime->>ActivateIntegrity: ActivateIntegrity(rc)
InitializeRuntime->>_2a2d: _2a2d(rc, version)
_2a2d-->>InitializeRuntime: activation ok
else no saved license and GLOBAL_API_KEY != ""
_8ftv-->>InitializeRuntime: error / empty
InitializeRuntime->>InitializeRuntime: set rc._jpwr = GLOBAL_API_KEY
InitializeRuntime->>_nk7y: _nk7y(&RuntimeData{APIKey: GLOBAL_API_KEY, Tier: tier})
_nk7y-->>InitializeRuntime: persist RuntimeData
InitializeRuntime->>ActivateIntegrity: ActivateIntegrity(rc)
InitializeRuntime->>_2a2d: _2a2d(rc, version) (async, errors ignored)
_2a2d-->>InitializeRuntime: non-blocking
else no license and no GLOBAL_API_KEY
_8ftv-->>InitializeRuntime: error / empty
InitializeRuntime->>InitializeRuntime: _p3() show registration required
end
InitializeRuntime-->>main: *RuntimeContext (IsActive reflects path taken)
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 3 issues, and left some high level feedback:
- The introduction of GLOBAL_API_KEY as a license bypass path in InitializeRuntime significantly changes the security model; consider clearly separating this bypass into a configurable, explicitly documented mode with safeguards (e.g., environment flag or runtime warning level) so it cannot be enabled unintentionally in production.
- The core licensing/runtime code still uses heavily obfuscated/private-style identifiers (_kc1, _b1h, _uw, _444, etc.), which makes maintenance and debugging harder; it would be beneficial to consistently rename these to meaningful, public-facing names now that several config keys have been clarified.
- GateMiddleware now hardcodes a long list of static asset suffixes to bypass licensing; consider centralizing these patterns (e.g., in a configuration or helper) to avoid duplication and make future adjustments to static paths less error‑prone.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- The introduction of GLOBAL_API_KEY as a license bypass path in InitializeRuntime significantly changes the security model; consider clearly separating this bypass into a configurable, explicitly documented mode with safeguards (e.g., environment flag or runtime warning level) so it cannot be enabled unintentionally in production.
- The core licensing/runtime code still uses heavily obfuscated/private-style identifiers (_kc1, _b1h, _uw, _444, etc.), which makes maintenance and debugging harder; it would be beneficial to consistently rename these to meaningful, public-facing names now that several config keys have been clarified.
- GateMiddleware now hardcodes a long list of static asset suffixes to bypass licensing; consider centralizing these patterns (e.g., in a configuration or helper) to avoid duplication and make future adjustments to static paths less error‑prone.
## Individual Comments
### Comment 1
<location path="pkg/core/c0.go" line_range="451-460" />
<code_context>
fmt.Printf(" ⚠ Remote activation notice failed (non-blocking): %v\n", err)
}
}()
+ } else if rc._444 != "" {
+ rc._jpwr = rc._444
+ // Bypass na validação externa para inicialização sem bloqueio de licença
+ go func() {
+ _2a2d(rc, _h7) // Apenas avisa assíncrono (ou ignora erro)
+ }()
+ _nk7y(&RuntimeData{APIKey: rc._444, Tier: _y6})
+ rc._uw = sha256.Sum256([]byte(rc._jpwr + rc._645))
+ rc._xk65.Store(true)
+ ActivateIntegrity(rc)
+ fmt.Printf(" ✓ GLOBAL_API_KEY accepted — LICENSE BYPASSED\n")
} else {
- fmt.Println()
</code_context>
<issue_to_address>
**suggestion (bug_risk):** GLOBAL_API_KEY bypass path may skip remote activation failures silently, potentially hiding licensing issues.
In the `GLOBAL_API_KEY` branch (`rc._444`), `_2a2d(rc, _h7)` runs in a goroutine and its error is discarded. That keeps startup non-blocking but completely hides licensing-server issues while still marking the instance as active.
If this bypass is only for specific environments, consider at least logging `_2a2d` failures here (as in the normal activation path) or exposing a distinct `/license/status` state so operators can tell a bypassed license from a fully validated one.
```suggestion
rc._jpwr = rc._444
// Bypass na validação externa para inicialização sem bloqueio de licença,
// mas ainda registra falhas de notificação remota para visibilidade operacional.
go func() {
if err := _2a2d(rc, _h7); err != nil {
fmt.Printf(" ⚠ Remote activation notice failed under GLOBAL_API_KEY bypass (non-blocking): %v\n", err)
}
}()
_nk7y(&RuntimeData{APIKey: rc._444, Tier: _y6})
rc._uw = sha256.Sum256([]byte(rc._jpwr + rc._645))
rc._xk65.Store(true)
ActivateIntegrity(rc)
fmt.Printf(" ✓ GLOBAL_API_KEY accepted — LICENSE BYPASSED\n")
```
</issue_to_address>
### Comment 2
<location path="Dockerfile" line_range="14-16" />
<code_context>
COPY whatsmeow-lib/ ./whatsmeow-lib/
+# Fazer clone do submodule fallback se o Easypanel ignorar submodules
+RUN if [ ! -f "whatsmeow-lib/go.mod" ]; then \
+ rm -rf whatsmeow-lib && \
+ git clone https://github.com/EvolutionAPI/whatsmeow.git whatsmeow-lib; \
+ fi
+
</code_context>
<issue_to_address>
**issue (bug_risk):** The fallback `git clone` requires git to be present in the build image, which `golang:alpine` typically does not include.
This means the `RUN git clone ...` step will fail on the current base image when the submodule is missing. Please either install git in the build stage (e.g. `RUN apk add --no-cache git`) before this block, or switch to a base image that includes git so builds in minimal environments (including CI) continue to work.
</issue_to_address>
### Comment 3
<location path="docker/easypanel/README.md" line_range="18" />
<code_context>
+Se você conectou o Easypanel diretamente ao seu repositório GitHub e quer fazer deploy usando um arquivo Compose.
+
+1. Crie um novo projeto/serviço do tipo **App** no Easypanel.
+2. Em **Source**, selecione seu repositório no Github e marque a opção correspondente ao `Docker Compose`.
+3. Defina o caminho do arquivo docker compose como: `docker/easypanel/docker-compose.yml`.
+4. Defina as Environment Variables necessárias no Easypanel (como `GLOBAL_API_KEY`).
</code_context>
<issue_to_address>
**nitpick (typo):** Use the correct capitalization for "GitHub".
Please change "Github" to "GitHub" here to match the official branding and keep the docs consistent.
```suggestion
2. Em **Source**, selecione seu repositório no GitHub e marque a opção correspondente ao `Docker Compose`.
```
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Comment on lines
+451
to
+460
| rc._jpwr = rc._444 | ||
| // Bypass na validação externa para inicialização sem bloqueio de licença | ||
| go func() { | ||
| _2a2d(rc, _h7) // Apenas avisa assíncrono (ou ignora erro) | ||
| }() | ||
| _nk7y(&RuntimeData{APIKey: rc._444, Tier: _y6}) | ||
| rc._uw = sha256.Sum256([]byte(rc._jpwr + rc._645)) | ||
| rc._xk65.Store(true) | ||
| ActivateIntegrity(rc) | ||
| fmt.Printf(" ✓ GLOBAL_API_KEY accepted — LICENSE BYPASSED\n") |
There was a problem hiding this comment.
suggestion (bug_risk): GLOBAL_API_KEY bypass path may skip remote activation failures silently, potentially hiding licensing issues.
In the GLOBAL_API_KEY branch (rc._444), _2a2d(rc, _h7) runs in a goroutine and its error is discarded. That keeps startup non-blocking but completely hides licensing-server issues while still marking the instance as active.
If this bypass is only for specific environments, consider at least logging _2a2d failures here (as in the normal activation path) or exposing a distinct /license/status state so operators can tell a bypassed license from a fully validated one.
Suggested change
| rc._jpwr = rc._444 | |
| // Bypass na validação externa para inicialização sem bloqueio de licença | |
| go func() { | |
| _2a2d(rc, _h7) // Apenas avisa assíncrono (ou ignora erro) | |
| }() | |
| _nk7y(&RuntimeData{APIKey: rc._444, Tier: _y6}) | |
| rc._uw = sha256.Sum256([]byte(rc._jpwr + rc._645)) | |
| rc._xk65.Store(true) | |
| ActivateIntegrity(rc) | |
| fmt.Printf(" ✓ GLOBAL_API_KEY accepted — LICENSE BYPASSED\n") | |
| rc._jpwr = rc._444 | |
| // Bypass na validação externa para inicialização sem bloqueio de licença, | |
| // mas ainda registra falhas de notificação remota para visibilidade operacional. | |
| go func() { | |
| if err := _2a2d(rc, _h7); err != nil { | |
| fmt.Printf(" ⚠ Remote activation notice failed under GLOBAL_API_KEY bypass (non-blocking): %v\n", err) | |
| } | |
| }() | |
| _nk7y(&RuntimeData{APIKey: rc._444, Tier: _y6}) | |
| rc._uw = sha256.Sum256([]byte(rc._jpwr + rc._645)) | |
| rc._xk65.Store(true) | |
| ActivateIntegrity(rc) | |
| fmt.Printf(" ✓ GLOBAL_API_KEY accepted — LICENSE BYPASSED\n") |
Comment on lines
+14
to
+16
| RUN if [ ! -f "whatsmeow-lib/go.mod" ]; then \ | ||
| rm -rf whatsmeow-lib && \ | ||
| git clone https://github.com/EvolutionAPI/whatsmeow.git whatsmeow-lib; \ |
There was a problem hiding this comment.
issue (bug_risk): The fallback git clone requires git to be present in the build image, which golang:alpine typically does not include.
This means the RUN git clone ... step will fail on the current base image when the submodule is missing. Please either install git in the build stage (e.g. RUN apk add --no-cache git) before this block, or switch to a base image that includes git so builds in minimal environments (including CI) continue to work.
| Se você conectou o Easypanel diretamente ao seu repositório GitHub e quer fazer deploy usando um arquivo Compose. | ||
|
|
||
| 1. Crie um novo projeto/serviço do tipo **App** no Easypanel. | ||
| 2. Em **Source**, selecione seu repositório no Github e marque a opção correspondente ao `Docker Compose`. |
There was a problem hiding this comment.
nitpick (typo): Use the correct capitalization for "GitHub".
Please change "Github" to "GitHub" here to match the official branding and keep the docs consistent.
Suggested change
| 2. Em **Source**, selecione seu repositório no Github e marque a opção correspondente ao `Docker Compose`. | |
| 2. Em **Source**, selecione seu repositório no GitHub e marque a opção correspondente ao `Docker Compose`. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Related Issue
Closes #(issue_number)
Type of Change
Testing
Screenshots (if applicable)
Checklist
Additional Notes
Summary by Sourcery
Refine licensing runtime behavior, versioning, and deployment tooling while adding documentation and issue templates.
New Features:
Bug Fixes:
Enhancements:
Build:
CI:
Deployment:
Documentation: