[imjlk]

Summary

• enforce permission, effective IAP, product catalog, and internal endpoint consistency in Devvit target artifact verification
• fail closed when Devvit commerce is installed after target availability, preserving configured IAP gating
• reject calendar-impossible UTC timestamps in platform fulfillment and refund orders

Follow-up to the actionable review findings on #73.

Validation

• pnpm test:target-artifacts
• pnpm --filter @mpgd/adapter-devvit test
• pnpm --filter @mpgd/adapter-devvit check
• pnpm --filter @mpgd/game-services test
• pnpm --filter @mpgd/game-services check
• pnpm check
• Sampo release dry-run (adapter-devvit and game-services 0.8.1; dependency propagation to cli and create-game 0.10.1)

Summary by CodeRabbit

• Bug Fixes

  • Improved payment setup safeguards so commerce cannot be enabled before target availability is applied.
  • Prevented acceptance of impossible UTC timestamps in platform fulfillment and refund flows; affected orders are refunded.
  • Strengthened validation of payment configuration, enabled products, and internal payment endpoints.

• Tests

  • Added coverage for invalid and valid order timestamps, payment readiness scenarios, endpoint validation, and target artifact verification.

[coderabbitai]

Warning

Review limit reached

@imjlk, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 36 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 6f0d8cec-9341-4515-9699-4a149328b67a

📥 Commits

Reviewing files that changed from the base of the PR and between 381f58f and 087d33c.

📒 Files selected for processing (2)

• tools/smoke/verify-target-artifacts.test.ts
• tools/smoke/verify-target-artifacts.ts

📝 Walkthrough

Walkthrough

Devvit commerce installation now fails closed after target availability is applied. Target-artifact smoke checks validate payment permissions, products, and internal endpoints. Platform order timestamp validation now rejects impossible UTC dates and accepts valid whole-second UTC timestamps.

Changes

Devvit validation

Layer / File(s)	Summary
Commerce installation gating adapters/devvit/src/payments.ts, adapters/devvit/src/payments.test.ts, .sampo/changesets/devvit-payment-review-fixes.md	The commerce adapter rejects gateways with target availability already applied, with a regression test and patch changeset.
Target-artifact payment validation tools/smoke/verify-target-artifacts.ts, tools/smoke/verify-target-artifacts.test.ts, package.json	Payment readiness derives enabled product SKUs, validates configuration consistency and internal endpoints, and runs through the prepared test sequence.

Platform order validation

Layer / File(s)	Summary
UTC timestamp validation packages/game-services/src/platform-order.ts, packages/game-services/src/platform-order.test.ts, .sampo/changesets/devvit-platform-order-date-validation.md	Timestamp validation now compares parsed dates with canonical ISO output, with tests for impossible dates, invalid refund timestamps, and valid whole-second timestamps.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant verifyDevvitWebManifest
  participant assertDevvitPaymentsReadiness
  participant verifyEnabledDevvitPayments
  verifyDevvitWebManifest->>assertDevvitPaymentsReadiness: validate effective config and payment permission
  assertDevvitPaymentsReadiness-->>verifyDevvitWebManifest: return enabled product SKUs
  verifyDevvitWebManifest->>verifyEnabledDevvitPayments: validate products and internal endpoints
  verifyEnabledDevvitPayments-->>verifyDevvitWebManifest: complete manifest checks

Loading

Possibly related PRs

• imjlk/mpgd-kit#24: Modifies the same Devvit web manifest payment and endpoint validation.
• imjlk/mpgd-kit#40: Touches the test:prepared script plumbing.

Poem

A bunny checked the target gate,
And found no bypass at the plate.
Dates now hop in proper line,
Internal paths stay well-defined.
Tests thump softly: all is bright!

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title is concise and accurately reflects the main change: hardening Devvit payment readiness contracts.
Description check	✅ Passed	The description follows the required Summary and Validation sections and is detailed enough; the optional Notes section is missing.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/devvit-payment-review-fixes

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 381f58fcf0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Allow non-payment Devvit targets to smoke

When smoking the repository's default reddit target, apps/target-devvit/devvit.json still has permissions.payments set to false while packages/target-config/targets.json keeps reddit.features.iap and reddit.monetization.iap set to true. This new equality check makes verifyTargetArtifacts reject that default no-payments Devvit manifest before it considers whether any effective products are enabled, so pnpm build:devvit && pnpm smoke:target reddit and generated games that have not enabled Devvit payments will fail. Either align the default config/manifest or only require the payments permission when enabled effective SKUs are exposed.

Useful? React with 👍 / 👎.