Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

[PROD RELEASE] - Updates & fixes#42

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Open
kkartunov wants to merge52 commits intomaster
base:master
Choose a base branch
Loading
fromdevelop
Open

[PROD RELEASE] - Updates & fixes#42

kkartunov wants to merge52 commits intomasterfromdevelop

Conversation

@kkartunov
Copy link
Contributor

kkartunovand others added25 commitsNovember 4, 2025 10:04
…ing or encodingCo-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Potential fix for code scanning alert no. 72: Incomplete string escaping or encoding
PS-441 Fix for processing phases in challenge update
if(suspiciousReason){
if(invalidDateBehavior.warn){
console.warn(`${fileName}: record${recordIdentifier} has${suspiciousReason.replace('|',' & ')} (${parsedDate.toISOString()}); strategy=${invalidDateBehavior.strategy}`);
console.warn(`${fileName}: record${recordIdentifier} has${suspiciousReason.replace(/\|/g,' & ')} (${parsedDate.toISOString()}); strategy=${invalidDateBehavior.strategy}`);

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

[⚠️correctness]
The change fromsuspiciousReason.replace('|', ' & ') tosuspiciousReason.replace(/\|/g, ' & ') is correct as it ensures all occurrences of the pipe character are replaced. However, consider verifying thatsuspiciousReason is always a string to avoid potential runtime errors if it is unexpectedly not a string.


CMD ["node","/challenge-api/app.js"]
# Copy entrypoint script and make it executable
COPY docker/entrypoint.sh /entrypoint.sh

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

[⚠️security]
Consider verifying the integrity ofentrypoint.sh after copying it into the image. This can help ensure that the script has not been tampered with and is safe to execute.


# Use entrypoint to run migrations at startup (not build time)
# Prisma uses PostgreSQL advisory locks to prevent concurrent migrations
ENTRYPOINT ["/entrypoint.sh"]

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

[⚠️correctness]
Using an entrypoint script to run migrations at startup can be risky if the script fails or if the database is not ready. Consider adding error handling or retry logic withinentrypoint.sh to handle such cases gracefully.

Allow reopening of registration phase and submission start / end date fix
-- Improve search responsiveness for group-constrained queries
CREATEINDEXIF NOT EXISTS"challenge_groups_gin_idx"
ON"challenges"."Challenge"
USING GIN ("groups");

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

[❗❗correctness]
Ensure that thegroups column is of a suitable data type for a GIN index, such asjsonb orarray. Using GIN on unsupported types may lead to unexpected behavior or performance issues.

@@index([updatedAt])
@@index([typeId])
@@index([trackId])
@@index([groups],type:Gin,map:"challenge_groups_gin_idx")

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

[⚠️performance]
The use of a GIN index on thegroups array field is appropriate for efficient querying of array data types in PostgreSQL. Ensure that the queries taking advantage of this index are optimized to benefit from the GIN index, as not all operations on array fields will automatically leverage it.

/*
Warnings:
- You are about to drop the column `isAIReviewer` on the `DefaultChallengeReviewer` table. All the data in the column will be lost.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

[❗❗correctness]
Dropping theisAIReviewer column will result in data loss. Ensure that this data is either backed up or is no longer needed.

*/
-- AlterTable
ALTERTABLE"DefaultChallengeReviewer" DROP COLUMN"isAIReviewer",
ADD COLUMN"aiWorkflowId"VARCHAR(14),

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

[⚠️maintainability]
Consider specifying a default value for the newaiWorkflowId column to avoid potential issues with null values.

-- AlterTable
ALTERTABLE"DefaultChallengeReviewer" DROP COLUMN"isAIReviewer",
ADD COLUMN"aiWorkflowId"VARCHAR(14),
ALTER COLUMN"scorecardId" DROPNOT NULL;

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

[❗❗correctness]
Dropping the NOT NULL constraint onscorecardId may lead to null values being inserted, which could affect application logic. Verify that the application can handle nullscorecardId values.

timelineTemplateIdString?
// Reviewer configuration (mirrors ChallengeReviewer)
scorecardIdString
scorecardIdString?

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

[❗❗correctness]
ChangingscorecardId fromString toString? (nullable) could impact logic that assumes this field is always present. Ensure that any code relying onscorecardId being non-null is updated to handle null values appropriately.

incrementalCoefficientFloat?
opportunityTypeReviewOpportunityTypeEnum?
isAIReviewerBoolean
aiWorkflowIdString?@db.VarChar(14)

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

[❗❗correctness]
The change fromisAIReviewer toaiWorkflowId introduces a new field with a specific length constraint (@db.VarChar(14)). Ensure that any existing data migration scripts or database constraints are updated to accommodate this change, and verify that the application logic correctly handles the new field.

@@index([timelineTemplateId])
@@index([timelineTemplateId,phaseId])
}
}

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

[💡style]
The absence of a newline at the end of the file may cause issues with some tools that expect a newline. Consider adding a newline to maintain consistency and avoid potential issues.

trackId:Joi.id().required(),
timelineTemplateId:Joi.optionalId().allow(null),
scorecardId:Joi.string().required(),
scorecardId:Joi.string().optional(),

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

[❗❗correctness]
ChangingscorecardId fromrequired tooptional could lead to potential issues if the system relies on this field being present. Ensure that the rest of the codebase can handlescorecardId beingundefined ornull.

trackId:Joi.id().required(),
timelineTemplateId:Joi.optionalId().allow(null),
scorecardId:Joi.string().required(),
scorecardId:Joi.string().optional(),

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

[❗❗correctness]
ChangingscorecardId fromrequired tooptional could lead to potential issues if the system relies on this field being present. Ensure that the rest of the codebase can handlescorecardId beingundefined ornull.

.insensitive()
.allow(null),
isAIReviewer:Joi.boolean(),
aiWorkflowId:Joi.string(),

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

[⚠️maintainability]
TheaiWorkflowId is now a simple string without any conditional requirements. Consider whether this field should have validation similar to the other schemas to ensure consistency and prevent potential errors.

};
constauthMw=authenticator(_.pick(config,["AUTH_SECRET","VALID_ISSUERS"]));
letfinished=false;
constbailoutTimer=setTimeout(()=>{

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

[⚠️design]
The use of a hardcoded timeout value (8000ms) for the bailoutTimer could lead to unexpected behavior if the authentication process takes longer than expected. Consider making this configurable or ensuring it aligns with expected response times.

logger.info(`[${getSignature(req)}] Invoking${def.controller}.${def.method}`);
try{
constresultPromise=method(req,res,next);
if(resultPromise&&typeofresultPromise.then==="function"){

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

[💡maintainability]
The method invocation is wrapped in a try-catch block, but the error handling only logs the error and rethrows it. Consider providing more context or handling specific error types to improve error traceability and recovery.

constapp=express();

// Use extended query parsing so bracket syntax like types[]=F2F is handled as arrays
app.set("query parser","extended");

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

[❗❗security]
Using the 'extended' query parser can introduce security risks if not handled properly, as it allows for more complex query string parsing. Ensure that input validation and sanitization are robust to prevent potential injection attacks.

RESOURCE_ROLES_API_URL:
process.env.RESOURCE_ROLES_API_URL||"http://api.topcoder-dev.com/v5/resource-roles",
GROUPS_API_URL:process.env.GROUPS_API_URL||"http://localhost:4000/v5/groups",
GROUPS_API_URL:process.env.GROUPS_API_URL||"http://localhost:4000/v6/groups",

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

[❗❗correctness]
The version change in theGROUPS_API_URL from/v5/groups to/v6/groups should be verified to ensure compatibility with the new API version. Ensure that the application logic is updated accordingly to handle any changes in the API response or behavior.


describe('update challenge tests',()=>{
constensureSkipTimelineTemplate=async()=>{
consttemplateId=config.SKIP_PROJECT_ID_BY_TIMLINE_TEMPLATE_ID

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

[⚠️correctness]
The variabletemplateId is assigned fromconfig.SKIP_PROJECT_ID_BY_TIMLINE_TEMPLATE_ID. Ensure that this configuration value is correctly set and validated before use to avoid potential runtime errors.

})
constexistingPhaseIds=newSet(existingPhases.map(p=>p.phaseId))
constphaseRows=[]
if(!existingPhaseIds.has(data.phase.id)){

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

[❗❗correctness]
The variabledata.phase.id is used without being defined within the function scope. Ensure thatdata is properly initialized and accessible in this context to avoid potential reference errors.

updatedBy:'activation-test'
})
}
if(!existingPhaseIds.has(data.phase2.id)){

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

[❗❗correctness]
The variabledata.phase2.id is used without being defined within the function scope. Ensure thatdata is properly initialized and accessible in this context to avoid potential reference errors.

id:uuid(),
name:`Activation coverage${Date.now()}`,
description:'Activation coverage test',
typeId:data.challenge.typeId,

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

[❗❗correctness]
ThetypeId andtrackId are set usingdata.challenge.typeId anddata.challenge.trackId. Ensure thatdata.challenge is properly initialized and accessible in this context to avoid potential reference errors.

}

constcreateActivationChallenge=async(status=ChallengeStatusEnum.NEW)=>{
consttimelineTemplateId=awaitensureSkipTimelineTemplate()

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

[💡design]
Thestatus parameter defaults toChallengeStatusEnum.NEW. Ensure that this default value is appropriate for all use cases ofcreateActivationChallenge.

status:ChallengeStatusEnum.ACTIVE
})
}catch(e){
should.equal(e.message.indexOf('reviewer configured')>=0,true)

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

[⚠️maintainability]
The error message checke.message.indexOf('reviewer configured') >= 0 is a bit fragile. Consider using a more robust error handling mechanism or error codes to ensure the correct error is caught.

}
)
}catch(e){
should.equal(e.message.indexOf('missing reviewers for phase(s): Review')>=0,true)

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

[⚠️maintainability]
The error message checke.message.indexOf('missing reviewers for phase(s): Review') >= 0 is a bit fragile. Consider using a more robust error handling mechanism or error codes to ensure the correct error is caught.

should.equal(e.message.indexOf('reviewers are missing required fields')>=0,true)
return
}finally{
awaitprisma.challenge.delete({where:{id:activationChallenge.id}})

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

[⚠️correctness]
Thefinally block deletes the challenge regardless of whether an error occurred. If the deletion fails, it could mask the original error. Consider moving the deletion to a separatetry-catch block after handling the error to ensure the original error is not lost.

Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment

Reviewers

@github-actionsgithub-actions[bot]github-actions[bot] left review comments

@jmgasperjmgasperjmgasper approved these changes

@vas3avas3aAwaiting requested review from vas3a

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@kkartunov@jmgasper@hentrymartin

[8]ページ先頭

©2009-2025 Movatter.jp