Skip to content

docs: rewrite quickstart for the user/account model - #1

Merged
aaronbrethorst merged 3 commits into
mainfrom
quickstart
May 9, 2026
Merged

aaronbrethorst merged 3 commits into
mainfrom
quickstart

Conversation

@aaronbrethorst

@aaronbrethorst aaronbrethorst commented May 9, 2026

Copy link
Copy Markdown
Member

Summary

  • Rewrites docs/quickstart.md to match the current CLI surface — pre-dated the user/account model (signup invites, hooksctl login, user-owned me sub push subscriptions).
  • Documents the bootstrap signup URL printed by hooks init (with --server-url / HOOKS_PUBLIC_URL for a usable link), the device-pairing login flow, and the account-only default scope on approval.
  • Switches the long-lived consumer step from admin-scoped hooksctl push add to user-owned hooksctl me sub add, and notes the secret-only-in-memory restart caveat with me sub rotate-secret.
  • Adds a "Where to next" pointer block to accounts.md, security.md, sources.md, operations.md.

Test plan

  • hooks init --server-url https://webhooks.example.com in a tempdir — output and generated hooks.yaml match the doc verbatim (modulo the cosmetic 24h vs 24h0m0s difference on the TTL line).
  • Cross-checked every CLI command and flag against cmd/hooks/main.go and cmd/hooksctl/{login,forward,me,push,whoami}.go.
  • Cross-checked claims about the bootstrap signup URL, signing format, push secret-after-restart behavior, /healthz vs /readyz, and the password policy against internal/{push,users,server,devicepair} and CLAUDE.md.
  • Verified all referenced sibling docs exist and the #power-user-long-lived-listener-token anchor resolves.
  • make build is green.

Review notes

Comment-analyzer + code-reviewer found two issues, both fixed in this PR:

  • Step 6 originally said hooksctl login opens the /device URL in your browser; it doesn't — the CLI prints a Visit: URL and a Code: line. Updated.
  • Step 4 originally said the password "must not contain your email's local-part"; the actual policy (internal/users/policy.go) also rejects passwords containing the full email. Tightened to "your email or its local-part."

Out of scope, but worth a follow-up: README.md and docs/accounts.md make the same incorrect "opens in your browser" claim about hooksctl login. Worth a one-line fix in each.

Summary by CodeRabbit

  • Documentation
    • Revamped quickstart for a developer-environment onboarding flow with clearer step-by-step commands.
    • Documented bootstrap signup URL behavior, admin onboarding, invite flow, and token persistence rules.
    • Clarified relay startup commands, health endpoints, webhook configuration, CLI login (device-pairing) and token storage, ephemeral listener token behavior, subscription setup, signing-secret handling, and browsing/audit guidance.
  • Tests
    • Made a concurrency test more tolerant by increasing timeouts to reduce CI flakiness.

Review Change Stack

The previous version pre-dated signup invites, hooksctl login, and
user-owned `me sub` push subscriptions. Updated to reflect the current
CLI surface, including the bootstrap signup URL, password policy, and
the device-pairing flow (CLI prints `Visit:`/`Code:` rather than
auto-opening a browser).
@coderabbitai

coderabbitai Bot commented May 9, 2026

Copy link
Copy Markdown

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 682efcfa-f635-4f2b-bcbb-33f068f73c85

📥 Commits

Reviewing files that changed from the base of the PR and between 20bb3ef and b42a711.

📒 Files selected for processing (2)
  • docs/quickstart.md
  • internal/subscribe/handler_test.go

📝 Walkthrough

Walkthrough

Updated docs/quickstart.md to document a developer-environment onboarding flow. The guide now covers initialization with hooks init --server-url, server startup with health checks, admin bootstrap signup, webhook registration, device-paired CLI login, listener token operation, event subscription via hooksctl me sub add, and UI access with email/password authentication.

Changes

Developer Environment Quickstart

Layer / File(s) Summary
Quickstart Framing
docs/quickstart.md
Updated scope to target developer-environment setup; expanded timeframe and referenced README for fully-local demo.
Initialization & Environment Setup
docs/quickstart.md
Documents hooks init --server-url flow, generated artifacts (hooks.yaml, hooks.db), one-time admin token, bootstrap signup URL with 24h TTL and single-use disabling, plus required RENDER_WEBHOOK_SECRET environment variable.
Server Startup & Health Checks
docs/quickstart.md
Added explicit relay start commands (hooks for production, hooks --dev for local inspector) and health check endpoint semantics (/readyz for SQLite ping, /healthz for liveness).
Admin Onboarding via Bootstrap
docs/quickstart.md
Detailed instructions for claiming first admin through one-time bootstrap signup URL, including link expiry handling and automatic path closure once any user exists.
Webhook Integration
docs/quickstart.md
Reiterates Render ingest URL and specifies matching RENDER_WEBHOOK_SECRET requirement for webhook authorization.
CLI Login & Device Pairing
docs/quickstart.md
Replaced token-pasting with hooksctl login device-pairing flow (Visit/Code); documents token storage location, file permissions, default scope (account only), and scope/admin override options.
Listener & Forward Workflow
docs/quickstart.md
Updated forward step to logged-in CLI workflow; added details on ephemeral listener token minting/revocation, cursor replay, tailing, byte/header preservation, and link to long-lived listener guidance.
Event Subscription via CLI
docs/quickstart.md
Replaced HTTP push command with hooksctl me sub add; documented "signing secret printed once" requirement, signature header scheme, and restart behavior (delivery pauses until rotation via rotate-secret).
UI Browsing & Authentication
docs/quickstart.md
Updated to sign in with email/password from Step 4 bootstrap; added mention of audit log route.
Clarifications & Limitations
docs/quickstart.md
Revised "what hooks init does NOT do" bullets to match new step numbering and persistence rules for admin token and bootstrap signup URL.

Test Timeout Tuning

Layer / File(s) Summary
Test Timeout & Deadline Adjustments
internal/subscribe/handler_test.go
TestConcurrentSubscribers increases the shared HTTP client timeout, per-subscriber request context timeouts, and extends the wait deadline for subscriber registration to be more tolerant of slow CI.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The pull request title accurately reflects the primary change: rewriting docs/quickstart.md to align with the current user/account model, which is the main objective documented in the PR summary.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch quickstart

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/quickstart.md`:
- Around line 77-79: The fenced code block containing the webhook URL
`https://webhooks.example.com/ingest/render` in the quickstart example is
missing a language specifier; update the triple-backtick fence to include a
language (e.g., change ``` to ```text) so the block is annotated as plain text
and renders correctly.
- Around line 30-34: The fenced code block showing the hooks init output is
missing a language specifier; update the triple-backtick fence around the block
that contains "admin token (shown ONCE): <long base64 string>" and the "signup:
https://webhooks.example.com/signup?code=ABCDEFGH..." line to use a language
specifier such as ```text so the markdown linter renders it correctly.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0cb2dcc5-e7ee-4bbb-b10e-bcf83a34c667

📥 Commits

Reviewing files that changed from the base of the PR and between c0b1c3f and 20bb3ef.

📒 Files selected for processing (1)
  • docs/quickstart.md

Comment thread docs/quickstart.md Outdated
Comment thread docs/quickstart.md Outdated
The 2s registration deadline (and 3s per-request context, 5s client
timeout) is too tight for 25 goroutines under -race on slow CI runners.
Local runs pass 10/10; CI hit `only 12/25 subscribers registered`
because the runner couldn't schedule all goroutines within 2s.

Bump deadline to 15s and per-request timeouts to 20s/30s so they
outlive the registration wait. Doesn't change what the test asserts.
Per CodeRabbit, two unmarked fenced blocks (the `hooks init` example
output and the Render ingest URL) are pure plain text. Tagging them as
`text` so markdown renderers/linters annotate them correctly.
@aaronbrethorst
aaronbrethorst merged commit 4b0b748 into main May 9, 2026
5 checks passed
@aaronbrethorst
aaronbrethorst deleted the quickstart branch May 9, 2026 20:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant