Update Vapi SDK and implement new way to handle Workflows #27
Conversation
|
@m-gie is attempting to deploy a commit to the JS Mastery Pro Team on Vercel. A member of the Team first needs to authorize it. |
WalkthroughA new workflow constant named Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant AgentComponent
participant vapi
participant GeneratorWorkflow
participant API
User->>AgentComponent: Initiate "generate" action
AgentComponent->>vapi: start(undefined, {clientMessages, serverMessages, variableValues}, generator)
vapi->>GeneratorWorkflow: Begin workflow
GeneratorWorkflow->>User: Greet and extract interview variables
GeneratorWorkflow->>API: POST /api/vapi/generate with variables
API-->>GeneratorWorkflow: Respond with interview data
GeneratorWorkflow->>User: Inform about generation and confirm
GeneratorWorkflow->>User: Thank you and end conversation
Poem
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 ESLint
npm warn config production Use Note ⚡️ AI Code Reviews for VS Code, Cursor, WindsurfCodeRabbit now has a plugin for VS Code, Cursor and Windsurf. This brings AI code reviews directly in the code editor. Each commit is reviewed immediately, finding bugs before the PR is raised. Seamless context handoff to your AI code agent ensures that you can easily incorporate review feedback. Note ⚡️ Faster reviews with cachingCodeRabbit now supports caching for code and dependencies, helping speed up reviews. This means quicker feedback, reduced wait times, and a smoother review experience overall. Cached data is encrypted and stored securely. This feature will be automatically enabled for all accounts on May 16th. To opt out, configure ✨ Finishing Touches
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge Base: Disabled due to data retention organization setting
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (3)
components/Agent.tsx(3 hunks)constants/index.ts(2 hunks)package.json(1 hunks)
🧰 Additional context used
🧬 Code Graph Analysis (1)
components/Agent.tsx (2)
lib/vapi.sdk.ts (1)
vapi(3-3)constants/index.ts (1)
generator(100-292)
🔇 Additional comments (5)
package.json (1)
16-16: Package dependency upgrade looks good.The
@vapi-ai/webpackage has been updated from version^2.2.4to^2.3.0. This update is aligned with the implementation of the new workflow system and explicit message arrays inAgent.tsx.components/Agent.tsx (3)
9-9: Import statement updated correctly to include the new workflow.The import statement now correctly includes both the new
generatorworkflow constant alongside the existinginterviewerconstant.
121-133: Implementation of the new workflow system for interview generation.The code now uses the declarative workflow approach instead of relying on an external workflow ID. This improves code maintainability by keeping the workflow definition within the codebase.
The explicit
clientMessagesandserverMessagesarrays follow best practices for the updated Vapi SDK.
146-147: Consistent message handling for both workflow types.The non-generate case now also uses explicit message arrays, maintaining consistency across different workflow types and aligning with the SDK's best practices.
constants/index.ts (1)
100-292: Well-structured workflow for interview generation.The new
generatorworkflow is well-designed with:
- Clear conversation nodes for user interaction
- Proper variable extraction for interview setup
- An API request to generate the interview content
- Appropriate transitions between nodes using AI-driven conditions
- Clean completion with user notification and hangup
The workflow design follows a logical conversation flow and properly handles all required user inputs.
| userid: { | ||
| type: "string", | ||
| description: "", | ||
| value: "{{ userid }}", | ||
| }, |
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
Verify user ID handling in the API request.
The workflow passes userid to the API, but make sure the backend API at /api/vapi/generate correctly handles and validates this user identifier to prevent potential security issues.
🏁 Script executed:
#!/bin/bash
# Check how the API validates user IDs
fd "api/vapi/generate" --type f | xargs rg -A 10 -B 5 "userid"Length of output: 3671
Add proper validation and authentication for userid in the generate route
The handler in app/api/vapi/generate/route.ts currently does:
const { type, role, level, techstack, amount, userid } = await request.json();
// …
const interview = {
// …
userId: userid,
// …
};
await db.collection("interviews").add(interview);There’s no check that userid is well-formed or that it matches an authenticated user. To prevent spoofing or injection:
- Enforce authentication (e.g. via session or JWT) and derive
userIdfrom the auth context rather than client payload. - If you must accept it in the body, validate its format (UUID, Firebase UID, etc.) and verify the user exists.
- Sanitize or whitelist allowed characters/lengths to guard against injection attacks.
Files to update:
- app/api/vapi/generate/route.ts – around the JSON destructuring and before writing to Firestore.
Please implement these checks before persisting any interview data.
🤖 Prompt for AI Agents
In app/api/vapi/generate/route.ts around the lines where the request JSON is
destructured, the userid from the client payload is used directly without
validation or authentication. To fix this, enforce authentication by extracting
the userId from the authenticated session or JWT token instead of the request
body. If accepting userid from the body is unavoidable, validate its format
strictly (e.g., UUID or Firebase UID), check that the user exists in the
database, and sanitize the input to prevent injection. Implement these checks
before creating and saving the interview data to ensure userid integrity and
security.
| }, | ||
| }, | ||
| method: "POST", | ||
| url: `${process.env.NEXT_PUBLIC_BASE_URL}/api/vapi/generate`, |
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
Ensure environment variable is properly defined.
The API URL uses ${process.env.NEXT_PUBLIC_BASE_URL} - make sure this environment variable is properly defined in all environments where this code will run.
🏁 Script executed:
#!/bin/bash
# Check for environment variable definition or usage
rg "NEXT_PUBLIC_BASE_URL" --type ts --type jsLength of output: 132
Define and Configure NEXT_PUBLIC_BASE_URL in All Environments
We’ve only located the usage at constants/index.ts:167 and no committed definitions for NEXT_PUBLIC_BASE_URL. To prevent runtime errors:
- Add
NEXT_PUBLIC_BASE_URLto your environment files (e.g.,
•.env.development
•.env.production
•.env.exampleNEXT_PUBLIC_BASE_URL=https://your-domain.com
- Ensure it’s set in your hosting/CI environment (Vercel, Netlify, Docker, etc.).
- Optionally, guard against undefined values in code:
// constants/index.ts (line 167) const baseUrl = process.env.NEXT_PUBLIC_BASE_URL ?? ""; export const API_URL = `${baseUrl}/api/vapi/generate`;
Please update your .env files and deployment settings accordingly.
🤖 Prompt for AI Agents
In constants/index.ts at line 167, the environment variable NEXT_PUBLIC_BASE_URL
is used but not defined in any environment files. To fix this, add
NEXT_PUBLIC_BASE_URL with the appropriate URL value to all your environment
files such as .env.development, .env.production, and .env.example. Also, ensure
this variable is set in your deployment environment settings like Vercel or
Netlify. Optionally, update the code to safely handle undefined values by
assigning a default empty string before constructing the API URL.
6 participants
Summary by CodeRabbit
New Features
Improvements
Chores