app/realtime.php (4)

705-705: Consider a more descriptive action string.

The action 'realtime' is generic. For better log filtering and clarity, consider using 'realtimeOpen' or 'onOpen' to distinguish connection establishment errors from message handling errors.

♻️ Suggested change

-        logError($th, 'realtime', [], $project, $logUser, $authorization);
+        logError($th, 'realtimeOpen', [], $project, $logUser, $authorization);

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@app/realtime.php` at line 705, The log call uses a generic action string
'realtime' which makes it hard to distinguish connection-open errors from other
realtime events; update the action argument in the logError invocation (the call
to logError) to a more specific value like 'realtimeOpen' or 'onOpen' to
indicate this is the connection establishment path so logs can be filtered and
understood more easily.

---

274-276: Consider using null coalescing for tag values.

The expression $value ?: 'n/a' treats all falsy values (including "0", "", false) as missing. If a tag value of "0" or empty string could be meaningful, consider using $value ?? 'n/a' instead.

♻️ Suggested change

         foreach ($tags as $key => $value) {
-            $log->addTag($key, $value ?: 'n/a');
+            $log->addTag($key, $value ?? 'n/a');
         }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@app/realtime.php` around lines 274 - 276, The loop that adds tags uses the
PHP elvis operator (`$value ?: 'n/a'`) which treats all falsy values (like "0"
or "") as missing; update the tag handling in the foreach over `$tags` so the
default is applied only when the key is null using the null coalescing operator
(`$value ?? 'n/a'`) before calling `$log->addTag($key, $value ?? 'n/a')`,
leaving `$log->addTag` and the surrounding loop intact.

---

740-743: User context is not captured for onMessage error logging.

The error logging at line 869 passes null for the user parameter. However, for authentication-type messages (line 806), the $user is retrieved from the database. Consider capturing this user and passing it to logError for richer error context on authentication failures.

♻️ Suggested change to capture user context

 $server->onMessage(function (int $connection, string $message) use ($server, $register, $realtime, $containerId) {
     $project = null;
     $authorization = null;
+    $logUser = null;

     try {
         // ... existing code ...

         /** `@var` User $user */
         $user = $database->getDocument('users', $store->getProperty('id', ''));
+        $logUser = $user;

         // ... existing code ...
     } catch (Throwable $th) {
-        logError($th, 'realtimeMessage', [], $project, null, $authorization);
+        logError($th, 'realtimeMessage', [], $project, $logUser, $authorization);

Also applies to: 869-869

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@app/realtime.php` around lines 740 - 743, The onMessage closure currently
initializes $user as null only locally when handling authentication, but passes
null into logError for exceptions; declare and capture a $user variable in the
outer scope of the onMessage handler (e.g., initialize $user = null alongside
$project and $authorization at the top of the closure), assign the retrieved
user object to that $user when you fetch from the DB in the authentication
branch, and then pass that $user into logError instead of null so error logs
include the authenticated user context (update the closure variables and the
logError call accordingly).

---

281-281: Be aware: detailedTrace may contain sensitive function arguments.

$error->getTrace() includes function arguments which could contain sensitive data (tokens, passwords, PII) that will be sent to the logging service. This is standard practice for internal error monitoring, but ensure your logging service has appropriate access controls and retention policies.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@app/realtime.php` at line 281, The current call
$log->addExtra('detailedTrace', $error->getTrace()) may leak sensitive function
arguments; replace it with a sanitized trace that strips or omits the "args"
entries before sending to $log->addExtra. Locate the use of $error and
getTrace() and transform the trace (e.g., iterate over $error->getTrace() and
remove the 'args' key or replace values with redacted placeholders) and then
pass that sanitized array to $log->addExtra('detailedTrace', ...).

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro