[ryanbarlow97]

The staff activity feed labels MMOItems and MythicMobs records as vanilla materials/entities. Decode bounded, final-page metadata to show saved item names plus MMOItems type/ID, and MythicMobs internal IDs when captured by the companion CoreProtect change. Distinguish renamed vanilla items and historical mob names from proven custom identities.

Metadata reads stay within the existing read budget; decoding occurs after the database reader closes. Malformed or oversized metadata falls back to the vanilla label and raw metadata never enters the API response. No new dependency or database migration.

Rebased on the merged LuckPerms/Ranks feature (#107) for one combined website release. Validation: 98 combined CoreProtect/LuckPerms tests passed, plus earlier staff API privacy checks and actual Dev CoreProtect rows. Offline Main-sized synthetic-data gate: read p99/max 17.7/23.4 ms, no errors; writer p99/max 99.0/105.9 ms alone versus 97.2/118.8 ms with readers, no failures. An initial run overlapped a large database copy and failed the latency gate; these reported results are from the subsequent controlled run, with both retained locally.

Part of the coordinated Main release; no independent production deployment.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 99c33e86-b7ea-4d16-926a-bb3f1bb3a283

📥 Commits

Reviewing files that changed from the base of the PR and between ecb227e and f2331a9.

📒 Files selected for processing (6)

• backend/src/coreprotect/README.md
• backend/src/coreprotect/activity.py
• backend/src/coreprotect/metadata.py
• backend/src/coreprotect/test_metadata.py
• backend/src/coreprotect/testdata/MetadataFixtures.java
• backend/src/coreprotect/testdata/metadata.json

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 1 remain after this review.

---

📝 Summary

Summary by CodeRabbit

• New Features
  • Activity entries now show saved custom names for renamed items and containers, and identify MMOItems where available.
  • Mob-kill entries show saved names for historical kills and MythicMobs identities for supported new kills.
• Improvements
  • When custom metadata is unavailable or unsupported, activity entries continue to display the standard item or entity label.

Walkthrough

The activity reader now fetches bounded metadata blobs for rows on the final page and uses decoded names and MMOItems or MythicMobs identities in item and mob-kill labels. A bounded Java-serialization and NBT parser handles supported metadata and falls back to vanilla labels for invalid or oversized input.

Changes

Activity labels

Layer / File(s)	Summary
Bounded metadata decoding and labels backend/src/coreprotect/metadata.py, backend/src/coreprotect/test_metadata.py, backend/src/coreprotect/testdata/MetadataFixtures.java, backend/src/coreprotect/testdata/metadata.json	Adds bounded Java-serialization and NBT parsing, name cleaning, and item and mob label extraction. Tests and fixtures cover supported metadata, invalid input and parser limits.
Page metadata retrieval and label integration backend/src/coreprotect/activity.py, backend/src/coreprotect/README.md, backend/src/coreprotect/test_metadata.py	Fetches bounded metadata by row ID for selected page entries and uses decoded values in item and mob-kill targets. Tests and documentation cover the queries, labels and fallbacks.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant Activity.fetch
  participant _fetch_metadata
  participant CoreProtect_reader
  participant Activity._entry
  participant metadata_labels
  Activity.fetch->>_fetch_metadata: selected page rows
  _fetch_metadata->>CoreProtect_reader: bounded row-ID metadata queries
  CoreProtect_reader-->>_fetch_metadata: metadata blobs
  _fetch_metadata-->>Activity.fetch: attach metadata to rows
  Activity.fetch->>Activity._entry: build page entries after reader closes
  Activity._entry->>metadata_labels: decode item or mob metadata for targets

Loading

Merge Risk: ⚪ Minimal · up to f2331

No actionable issue remains in the reviewed activity-label change; it is mergeable after normal checks.

Security Architecture Review

Security architecture risk: 🔵 Low · up to f2331

The change adds metadata parsing but preserves existing staff permissions and read-only database access. Parsing and output are bounded, malformed data falls back to ordinary labels, and raw metadata is not returned. No concrete security regression was established; production validation remains incomplete.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — A parser attack would require influence over stored CoreProtect metadata and a subsequent authorized activity read; request parameters do not directly supply decoder blobs. The added exposure is decoder work in the backend and derived labels shown to existing staff viewers of the configured database, not new database-write authority.

Trust Boundaries and Controls

• observed — The route retains current-user, staff-role, and view_players checks; message visibility remains separately permission-controlled. Derived names are cleaned and length-limited, identifiers follow a bounded allowlist, and the unchanged frontend inserts target values as React text children rather than raw HTML.
• observed — Java streams are capped at 64 KiB and must be fully consumed. Parser traversal is limited to 8,192 nodes and depth 32, arrays and lists are bounded, references are checked, and gzip expansion is capped at 256 KiB. These are static containment controls, not production performance measurements.

Resilience and Maintainability Implications

• observed — Malformed item metadata returns the vanilla label. Mob state and identity blobs fail independently, preserving valid information from the other blob. Source tests cover truncation, oversized input, decompression and depth limits, response privacy, and final-page-only fetching; their execution was not verified in this review.

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}