- Notifications
You must be signed in to change notification settings - Fork6
[PROD RELEASE] - Updates & fixes#42
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
base:master
Are you sure you want to change the base?
Uh oh!
There was an error while loading.Please reload this page.
Conversation
…ing or encodingCo-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Potential fix for code scanning alert no. 72: Incomplete string escaping or encoding
PM-2614 - Module updates -> dev
drop yarn -> develop
PS-441 Fix for processing phases in challenge update
Master -> develop sync
Automate migrations
Uh oh!
There was an error while loading.Please reload this page.
| if(suspiciousReason){ | ||
| if(invalidDateBehavior.warn){ | ||
| console.warn(`${fileName}: record${recordIdentifier} has${suspiciousReason.replace('|',' & ')} (${parsedDate.toISOString()}); strategy=${invalidDateBehavior.strategy}`); | ||
| console.warn(`${fileName}: record${recordIdentifier} has${suspiciousReason.replace(/\|/g,' & ')} (${parsedDate.toISOString()}); strategy=${invalidDateBehavior.strategy}`); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
[correctness]
The change fromsuspiciousReason.replace('|', ' & ') tosuspiciousReason.replace(/\|/g, ' & ') is correct as it ensures all occurrences of the pipe character are replaced. However, consider verifying thatsuspiciousReason is always a string to avoid potential runtime errors if it is unexpectedly not a string.
| CMD ["node","/challenge-api/app.js"] | ||
| # Copy entrypoint script and make it executable | ||
| COPY docker/entrypoint.sh /entrypoint.sh |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
[security]
Consider verifying the integrity ofentrypoint.sh after copying it into the image. This can help ensure that the script has not been tampered with and is safe to execute.
| # Use entrypoint to run migrations at startup (not build time) | ||
| # Prisma uses PostgreSQL advisory locks to prevent concurrent migrations | ||
| ENTRYPOINT ["/entrypoint.sh"] |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
[correctness]
Using an entrypoint script to run migrations at startup can be risky if the script fails or if the database is not ready. Consider adding error handling or retry logic withinentrypoint.sh to handle such cases gracefully.
Allow reopening of registration phase and submission start / end date fix
| -- Improve search responsiveness for group-constrained queries | ||
| CREATEINDEXIF NOT EXISTS"challenge_groups_gin_idx" | ||
| ON"challenges"."Challenge" | ||
| USING GIN ("groups"); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
[❗❗correctness]
Ensure that thegroups column is of a suitable data type for a GIN index, such asjsonb orarray. Using GIN on unsupported types may lead to unexpected behavior or performance issues.
| @@index([updatedAt]) | ||
| @@index([typeId]) | ||
| @@index([trackId]) | ||
| @@index([groups],type:Gin,map:"challenge_groups_gin_idx") |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
[performance]
The use of a GIN index on thegroups array field is appropriate for efficient querying of array data types in PostgreSQL. Ensure that the queries taking advantage of this index are optimized to benefit from the GIN index, as not all operations on array fields will automatically leverage it.
master -> dev - Merge pull request#39 from topcoder-platform/PM-2206-2nd-fix
feat(PM-2540): added ai workflow id to default reviewer
| /* | ||
| Warnings: | ||
| - You are about to drop the column `isAIReviewer` on the `DefaultChallengeReviewer` table. All the data in the column will be lost. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
[❗❗correctness]
Dropping theisAIReviewer column will result in data loss. Ensure that this data is either backed up or is no longer needed.
| */ | ||
| -- AlterTable | ||
| ALTERTABLE"DefaultChallengeReviewer" DROP COLUMN"isAIReviewer", | ||
| ADD COLUMN"aiWorkflowId"VARCHAR(14), |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
[maintainability]
Consider specifying a default value for the newaiWorkflowId column to avoid potential issues with null values.
| -- AlterTable | ||
| ALTERTABLE"DefaultChallengeReviewer" DROP COLUMN"isAIReviewer", | ||
| ADD COLUMN"aiWorkflowId"VARCHAR(14), | ||
| ALTER COLUMN"scorecardId" DROPNOT NULL; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
[❗❗correctness]
Dropping the NOT NULL constraint onscorecardId may lead to null values being inserted, which could affect application logic. Verify that the application can handle nullscorecardId values.
| timelineTemplateIdString? | ||
| // Reviewer configuration (mirrors ChallengeReviewer) | ||
| scorecardIdString | ||
| scorecardIdString? |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
[❗❗correctness]
ChangingscorecardId fromString toString? (nullable) could impact logic that assumes this field is always present. Ensure that any code relying onscorecardId being non-null is updated to handle null values appropriately.
| incrementalCoefficientFloat? | ||
| opportunityTypeReviewOpportunityTypeEnum? | ||
| isAIReviewerBoolean | ||
| aiWorkflowIdString?@db.VarChar(14) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
[❗❗correctness]
The change fromisAIReviewer toaiWorkflowId introduces a new field with a specific length constraint (@db.VarChar(14)). Ensure that any existing data migration scripts or database constraints are updated to accommodate this change, and verify that the application logic correctly handles the new field.
| @@index([timelineTemplateId]) | ||
| @@index([timelineTemplateId,phaseId]) | ||
| } | ||
| } |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
[💡style]
The absence of a newline at the end of the file may cause issues with some tools that expect a newline. Consider adding a newline to maintain consistency and avoid potential issues.
| trackId:Joi.id().required(), | ||
| timelineTemplateId:Joi.optionalId().allow(null), | ||
| scorecardId:Joi.string().required(), | ||
| scorecardId:Joi.string().optional(), |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
[❗❗correctness]
ChangingscorecardId fromrequired tooptional could lead to potential issues if the system relies on this field being present. Ensure that the rest of the codebase can handlescorecardId beingundefined ornull.
| trackId:Joi.id().required(), | ||
| timelineTemplateId:Joi.optionalId().allow(null), | ||
| scorecardId:Joi.string().required(), | ||
| scorecardId:Joi.string().optional(), |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
[❗❗correctness]
ChangingscorecardId fromrequired tooptional could lead to potential issues if the system relies on this field being present. Ensure that the rest of the codebase can handlescorecardId beingundefined ornull.
| .insensitive() | ||
| .allow(null), | ||
| isAIReviewer:Joi.boolean(), | ||
| aiWorkflowId:Joi.string(), |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
[maintainability]
TheaiWorkflowId is now a simple string without any conditional requirements. Consider whether this field should have validation similar to the other schemas to ensure consistency and prevent potential errors.
Security fixes and debug logging
| }; | ||
| constauthMw=authenticator(_.pick(config,["AUTH_SECRET","VALID_ISSUERS"])); | ||
| letfinished=false; | ||
| constbailoutTimer=setTimeout(()=>{ |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
[design]
The use of a hardcoded timeout value (8000ms) for the bailoutTimer could lead to unexpected behavior if the authentication process takes longer than expected. Consider making this configurable or ensuring it aligns with expected response times.
| logger.info(`[${getSignature(req)}] Invoking${def.controller}.${def.method}`); | ||
| try{ | ||
| constresultPromise=method(req,res,next); | ||
| if(resultPromise&&typeofresultPromise.then==="function"){ |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
[💡maintainability]
The method invocation is wrapped in a try-catch block, but the error handling only logs the error and rethrows it. Consider providing more context or handling specific error types to improve error traceability and recovery.
| constapp=express(); | ||
| // Use extended query parsing so bracket syntax like types[]=F2F is handled as arrays | ||
| app.set("query parser","extended"); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
[❗❗security]
Using the 'extended' query parser can introduce security risks if not handled properly, as it allows for more complex query string parsing. Ensure that input validation and sanitization are robust to prevent potential injection attacks.
Additional checks for reviewer setup before allowing activation (PM-3…
| RESOURCE_ROLES_API_URL: | ||
| process.env.RESOURCE_ROLES_API_URL||"http://api.topcoder-dev.com/v5/resource-roles", | ||
| GROUPS_API_URL:process.env.GROUPS_API_URL||"http://localhost:4000/v5/groups", | ||
| GROUPS_API_URL:process.env.GROUPS_API_URL||"http://localhost:4000/v6/groups", |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
[❗❗correctness]
The version change in theGROUPS_API_URL from/v5/groups to/v6/groups should be verified to ensure compatibility with the new API version. Ensure that the application logic is updated accordingly to handle any changes in the API response or behavior.
| describe('update challenge tests',()=>{ | ||
| constensureSkipTimelineTemplate=async()=>{ | ||
| consttemplateId=config.SKIP_PROJECT_ID_BY_TIMLINE_TEMPLATE_ID |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
[correctness]
The variabletemplateId is assigned fromconfig.SKIP_PROJECT_ID_BY_TIMLINE_TEMPLATE_ID. Ensure that this configuration value is correctly set and validated before use to avoid potential runtime errors.
| }) | ||
| constexistingPhaseIds=newSet(existingPhases.map(p=>p.phaseId)) | ||
| constphaseRows=[] | ||
| if(!existingPhaseIds.has(data.phase.id)){ |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
[❗❗correctness]
The variabledata.phase.id is used without being defined within the function scope. Ensure thatdata is properly initialized and accessible in this context to avoid potential reference errors.
| updatedBy:'activation-test' | ||
| }) | ||
| } | ||
| if(!existingPhaseIds.has(data.phase2.id)){ |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
[❗❗correctness]
The variabledata.phase2.id is used without being defined within the function scope. Ensure thatdata is properly initialized and accessible in this context to avoid potential reference errors.
| id:uuid(), | ||
| name:`Activation coverage${Date.now()}`, | ||
| description:'Activation coverage test', | ||
| typeId:data.challenge.typeId, |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
[❗❗correctness]
ThetypeId andtrackId are set usingdata.challenge.typeId anddata.challenge.trackId. Ensure thatdata.challenge is properly initialized and accessible in this context to avoid potential reference errors.
| } | ||
| constcreateActivationChallenge=async(status=ChallengeStatusEnum.NEW)=>{ | ||
| consttimelineTemplateId=awaitensureSkipTimelineTemplate() |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
[💡design]
Thestatus parameter defaults toChallengeStatusEnum.NEW. Ensure that this default value is appropriate for all use cases ofcreateActivationChallenge.
| status:ChallengeStatusEnum.ACTIVE | ||
| }) | ||
| }catch(e){ | ||
| should.equal(e.message.indexOf('reviewer configured')>=0,true) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
[maintainability]
The error message checke.message.indexOf('reviewer configured') >= 0 is a bit fragile. Consider using a more robust error handling mechanism or error codes to ensure the correct error is caught.
| } | ||
| ) | ||
| }catch(e){ | ||
| should.equal(e.message.indexOf('missing reviewers for phase(s): Review')>=0,true) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
[maintainability]
The error message checke.message.indexOf('missing reviewers for phase(s): Review') >= 0 is a bit fragile. Consider using a more robust error handling mechanism or error codes to ensure the correct error is caught.
Add scorecard and phase ID checks to the reviewer checks
| should.equal(e.message.indexOf('reviewers are missing required fields')>=0,true) | ||
| return | ||
| }finally{ | ||
| awaitprisma.challenge.delete({where:{id:activationChallenge.id}}) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
[correctness]
Thefinally block deletes the challenge regardless of whether an error occurred. If the deletion fails, it could mask the original error. Consider moving the deletion to a separatetry-catch block after handling the error to ensure the original error is not lost.
https://topcoder.atlassian.net/browse/PM-2614