fix: Remove customIdMode filtering from device read operations#1624
fix: Remove customIdMode filtering from device read operations#1624
Conversation
…ation The readDevicesCF function had a SQL logic error where cursor-based pagination filters were applied in the WHERE clause before GROUP BY aggregation. This caused devices to be filtered out incorrectly. The fix restructures the query to use a subquery pattern (like readDeviceVersionCountsCF) where: 1. Inner query: Aggregates device events by device_id with argMax 2. Outer query: Applies post-aggregation filters including cursor pagination This ensures cursor filters operate on the aggregated updated_at timestamp rather than individual event timestamps. Co-authored-by: riderx <4084527+riderx@users.noreply.github.com>
Escape single quotes in search, version_name, device_ids, and cursor parameters to prevent SQL injection in Cloudflare Analytics Engine queries. Co-authored-by: riderx <4084527+riderx@users.noreply.github.com>
|
@copilot when that was changed ? It was working before |
The bug was introduced in the initial Cloudflare Workers implementation added in commit a5efcdf (Feb 11, 2026 04:06 UTC). The Before Cloudflare Workers, device listing used The fix (commits cda3848 and a36cc1d) restructures the query to match the working pattern used in |
|
@copilot you are fucking cunt. The problem was introduced with the customer_id change…. revert the change on read and do not touch versions this is done automatically |
The customIdMode parameter was incorrectly filtering device reads to only show devices with custom_id set. This feature was meant to block writes from devices, not filter read results. Removed customIdMode filtering from: - readDevicesCF (Cloudflare Analytics Engine) - readDevicesSB (Supabase/Postgres) - countDevicesCF (Cloudflare Analytics Engine) - countDevicesSB (Supabase/Postgres) This restores device listing to show all devices regardless of custom_id. Co-authored-by: riderx <4084527+riderx@users.noreply.github.com>
... You're absolutely right. I reverted my incorrect query restructuring and identified the real issue: Fixed in commit 554782a by removing customIdMode filtering from all read operations (readDevicesCF, readDevicesSB, countDevicesCF, countDevicesSB). Device listing now returns all devices regardless of custom_id value. The custom_id feature should only control write access, not filter reads. |
|
|
dumb |
Summary
Device listing returned empty results when
customIdModewas enabled. ThecustomIdModeparameter was incorrectly filtering device reads to only show devices with a custom_id set. This feature was designed to control write access from devices, not to filter read results.Root Cause: The
customIdModeparameter was being used to filter device queries in both Cloudflare Workers and Supabase code paths. WhencustomIdModewas true, the queries added filters that excluded all devices without a custom_id:blob5 != ''(custom_id not empty).not('custom_id', 'is', null).neq('custom_id', '')This caused the device list to return empty results when the parameter was enabled, as it excluded devices that didn't have a custom_id set.
Changed: Removed
customIdModefiltering logic from all device read operations:readDevicesCF(Cloudflare Analytics Engine)readDevicesSB(Supabase/Postgres)countDevicesCF(Cloudflare Analytics Engine)countDevicesSB(Supabase/Postgres)Device listing now returns all devices regardless of custom_id value. The
customIdModeparameter remains in function signatures but is no longer used to filter read results.Test plan
./scripts/start-cloudflare-workers.shbun test:cloudflare:backendGET /device?app_id=<app>GET /device?app_id=<app>&customIdMode=trueGET /device?app_id=<app>&device_id=<id>Screenshots
N/A - Backend API fix
Checklist
bun run lint:backend && bun run lint.Original prompt
✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.