[PROD RELEASE] - Q2 #823

kkartunov · 2025-06-17T06:13:58Z

QA bug fixes
Copilot Portal

fix(PM-1077): permission issue to delete copilot invite

PM-589 add migration for fixing copilot request model

github-actions · 2025-06-17T06:16:33Z

src/routes/projectMemberInvites/update.js

@@ -19,6 +21,8 @@ const updateMemberValidations = {
      status: Joi.any()
        .valid(_.values(INVITE_STATUS))
        .required(),
+      source: Joi.string()


Consider validating the source field to ensure it only accepts specific values, similar to how status is validated. This can help prevent invalid data from being accepted.

github-actions · 2025-06-17T06:16:35Z

src/routes/projectMemberInvites/update.js

@@ -29,6 +33,7 @@ module.exports = [
  permissions('projectMemberInvite.edit'),
  (req, res, next) => {
    const newStatus = req.body.status;
+    const source = req.body.source;


Consider validating the source field to ensure it contains expected values before using it further in the code. This can help prevent potential issues from unexpected input.

github-actions · 2025-06-17T06:16:38Z

src/routes/projectMemberInvites/update.js

@@ -81,7 +86,7 @@ module.exports = [
          .update({
            status: newStatus,
          })
-          .then((updatedInvite) => {
+          .then(async (updatedInvite) => {


The use of async in the .then function suggests that there might be an await operation inside the function. Please ensure that any asynchronous operations within this function are properly handled with await. If there are no asynchronous operations, consider removing async for clarity.

github-actions · 2025-06-17T06:16:41Z

src/routes/projectMemberInvites/update.js

@@ -94,7 +99,7 @@ module.exports = [
            if (updatedInvite.status === INVITE_STATUS.ACCEPTED ||
              updatedInvite.status === INVITE_STATUS.REQUEST_APPROVED) {
              return models.ProjectMember.getActiveProjectMembers(projectId)
-                .then((members) => {
+                .then(async (members) => {


Using async in a .then() method can be confusing and is generally not recommended. Consider using await within an async function instead of chaining .then(). This can improve readability and maintainability of the code.

github-actions · 2025-06-17T06:16:45Z

src/routes/projectMemberInvites/update.js

-                    .addUserToProject(req, member)
-                    .then(() => res.json(util.postProcessInvites('$.email', updatedInvite, req)))
-                    .catch(err => next(err));
+                  const t = await models.sequelize.transaction();


Consider adding error handling for the transaction initialization. If models.sequelize.transaction() fails, it could lead to unhandled exceptions.

github-actions · 2025-06-17T06:16:45Z

src/routes/projectMemberInvites/update.js

+                        transaction: t,
+                      });
+
+                      await application.update({ status: nextApplicationStatus }, {


Ensure that application is not null before calling update on it. If findOne does not find a record, application will be null, leading to a runtime error.

github-actions · 2025-06-17T06:16:45Z

src/routes/projectMemberInvites/update.js

+                        transaction: t
+                      });
+
+                      const opportunity = await models.CopilotOpportunity.findOne({


Ensure that opportunity is not null before calling update on it. If findOne does not find a record, opportunity will be null, leading to a runtime error.

github-actions · 2025-06-17T06:16:45Z

src/routes/projectMemberInvites/update.js

+                        transaction: t,
+                      });
+
+                      const request = await models.CopilotRequest.findOne({


Ensure that request is not null before calling update on it. If findOne does not find a record, request will be null, leading to a runtime error.

github-actions · 2025-06-17T06:16:45Z

src/routes/projectMemberInvites/update.js

+              // update the application if the invite
+              // originated from copilot opportunity
+              if (updatedInvite.applicationId) {
+                const allPendingInvitesForApplication = await models.ProjectMemberInvite.getPendingInvitesForApplication(invite.applicationId);


Consider adding error handling for getPendingInvitesForApplication. If it fails, it could lead to unhandled exceptions.

github-actions · 2025-06-17T06:16:48Z

src/util.js

@@ -225,6 +225,23 @@ const projectServiceUtils = {
    return _.intersection(roles, ADMIN_ROLES.map(r => r.toLowerCase())).length > 0;
  },

+  /**
+   * Helper funtion to verify if user has project manager role


Typo in the comment: 'funtion' should be corrected to 'function'.

github-actions · 2025-06-17T06:16:48Z

src/util.js

+    const isMachineToken = _.get(req, 'authUser.isMachine', false);
+    const tokenScopes = _.get(req, 'authUser.scopes', []);
+    if (isMachineToken) {
+      if (_.indexOf(tokenScopes, M2M_SCOPES.CONNECT_PROJECT_ADMIN) >= 0) return true;


Consider simplifying the condition by directly returning the result of the comparison: return _.indexOf(tokenScopes, M2M_SCOPES.CONNECT_PROJECT_ADMIN) >= 0;.

github-actions · 2025-06-17T06:16:51Z

src/util.js

+        return _.get(res, 'data.result.content', []);
+      });
+    } catch (err) {
+      logger.debug(err, "error on getting role info");


Consider using logger.error instead of logger.debug for logging errors to ensure they are appropriately flagged in the logs.

github-actions · 2025-06-17T06:16:51Z

src/util.js

+          .map(r => r.id);
+      });
+    } catch (err) {
+      return Promise.reject(err);


Consider adding error logging similar to the getRoleInfo method to capture and debug errors effectively.

fix(PM-1273): Send canApplyAsCopilot to check if the user can apply for the opportunity

github-actions · 2025-06-19T07:38:17Z

src/models/projectMember.js

@@ -34,6 +34,10 @@ module.exports = function defineProjectMember(sequelize, DataTypes) {
    ],
  });

+  ProjectMember.associate = (models) => {


Consider adding error handling or validation to ensure that the association with models.Project is correctly established. This can help prevent runtime errors if models.Project is undefined or if there are issues with the foreign key.

github-actions · 2025-06-19T07:38:21Z

src/routes/copilotOpportunity/get.js

        },
      ],
    })
      .then((copilotOpportunity) => {
        const plainOpportunity = copilotOpportunity.get({ plain: true });
-        const formattedOpportunity = Object.assign({}, plainOpportunity,
+        req.log.info("authUser", req.authUser);


The log statement req.log.info("authUser", req.authUser); may expose sensitive information about the authenticated user. Consider logging only non-sensitive information or ensuring that sensitive data is adequately protected.

github-actions · 2025-06-19T07:38:21Z

src/routes/copilotOpportunity/get.js

+        const memberIds = plainOpportunity.project.members && plainOpportunity.project.members.map((member) => member.userId);
+        let canApplyAsCopilot = false;
+        if (req.authUser) {
+          canApplyAsCopilot = !memberIds.includes(req.authUser.userId)


The logic canApplyAsCopilot = !memberIds.includes(req.authUser.userId) assumes memberIds is always defined. Consider adding a check to ensure memberIds is not undefined before calling includes to avoid potential runtime errors.

github-actions · 2025-06-19T07:38:21Z

src/routes/copilotOpportunity/get.js

+        if (req.authUser) {
+          canApplyAsCopilot = !memberIds.includes(req.authUser.userId)
+        }
+        // This shouldn't be exposed to the clientside


The comment // This shouldn't be exposed to the clientside suggests that plainOpportunity.project.members should not be sent to the client. Ensure that the deletion of plainOpportunity.project.members is correctly implemented and tested to prevent accidental exposure.

github-actions · 2025-06-19T07:38:24Z

src/routes/index.js

      return next();
    }
+    req.log.info("token available", token);


Logging sensitive information such as tokens can lead to security vulnerabilities. Consider removing or masking the token in the log statement.

feat(PM-1379): cancel copilot opportunity

github-actions · 2025-06-19T18:40:24Z

src/routes/copilotOpportunity/delete.js

+        details: JSON.stringify({ message: 'You do not have permission to cancel copilot opportunity' }),
+        status: 403,
+      });
+      return Promise.reject(err);


Using Promise.reject(err) here is unnecessary because the function is already async. You can simply throw err to achieve the same effect.

github-actions · 2025-06-19T18:40:24Z

src/routes/copilotOpportunity/delete.js

+      return Promise.reject(err);
+    }
+    // default values
+    const opportunityId = _.parseInt(req.params.id);


Consider validating opportunityId after parsing to ensure it is a valid integer and not NaN. This will prevent potential issues if the input is not a valid number.

github-actions · 2025-06-19T18:40:24Z

src/routes/copilotOpportunity/delete.js

+        transaction,
+      });
+
+      if (!opportunity) {


The error message here could be more descriptive by including the opportunity ID in the log message for easier debugging.

github-actions · 2025-06-19T18:40:24Z

src/routes/copilotOpportunity/delete.js

+        transaction,
+      });
+
+      const applications = await models.CopilotApplication.findAll({


Consider checking if applications is empty before proceeding with the update to avoid unnecessary operations.

github-actions · 2025-06-19T18:40:25Z

src/routes/copilotOpportunity/delete.js

+        transaction,
+      });
+
+      res.status(200).send({ id: opportunity.id });


Consider sending a more detailed response, such as including a message indicating that the opportunity was successfully canceled, for better client-side handling.

github-actions · 2025-06-19T18:40:28Z

src/routes/index.js

+
+// Cancel Copilot opportunity
+router.route('/v5/projects/copilots/opportunity/:id(\\d+)/cancel')
+.delete(require('./copilotOpportunity/delete'));


The indentation for the .delete(require('./copilotOpportunity/delete')); line is inconsistent with the rest of the code. It should be indented to align with the .post(require('./copilotOpportunity/assign')); line above it.

hentrymartin and others added 30 commits April 14, 2025 22:48

feat: apply for copilot opportunity

6163394

deploy pr branch to develo[

0372f83

add migration

06280ae

deploy to dev

561906e

Fix migration script

5ac2a16

fix: permission issue to delete copilot invite

99a5053

fix: permission issue to delete copilot invite

0b40100

fix: removed circle ci config

fef6473

Merge pull request #800 from topcoder-platform/pm-1077

0afeeac

fix(PM-1077): permission issue to delete copilot invite

Make copilot opportunity details route public

5907e42

removed circle config

4adf1e9

Merge pull request #799 from topcoder-platform/PM-589-add-migration

4b7990b

PM-589 add migration for fixing copilot request model

Merge branch 'develop' into PM-577

c608346

updated swagger doc

cffc8c0

fix: removed validation

bf83bcb

fix: reference error

dc39219

fix: model

22cc474

fix: model

472acdf

fix: model

5a0b44f

fix: model

7c63711

fix: model

f0d083f

fix: model

aa60669

fix: model

47664c8

fix: validations

1978a22

removed unnecessary file

3cac325

enable AI Review buddy

9ba39a3

fix: added notes column

7ad57ec

fix: added notes from request

8dfcdf0

updated swagger file

4a13b50

debug logs

350d155

github-actions bot reviewed Jun 17, 2025

View reviewed changes

hentrymartin and others added 11 commits June 18, 2025 14:47

fix: send members as part of opportunity

f8a6786

fix: send members as part of opportunity

596d9b1

fix: send members as part of opportunity

9d70104

fix: send members as part of opportunity

2eb2d21

fix: send members as part of opportunity

f6138fe

fix: send members as part of opportunity

8612e02

fix: send members as part of opportunity

81effa6

debug auth user

25b4d80

debug auth user

6080e8e

debug auth user

6557460

Merge pull request #824 from topcoder-platform/pm-1273

8e30d1b

fix(PM-1273): Send canApplyAsCopilot to check if the user can apply for the opportunity

github-actions bot reviewed Jun 19, 2025

View reviewed changes

hentrymartin added 7 commits June 19, 2025 19:33

feat: cancel copilot opportunity

8d2840c

fix: undefined

70422b7

fix: lint

c3390fc

fix: cancel endpoint

66a6ffa

fix: cancel endpoint

a09a791

fix: cancel endpoint

852c89a

Merge pull request #825 from topcoder-platform/pm-1378

69fe32b

feat(PM-1379): cancel copilot opportunity

github-actions bot reviewed Jun 19, 2025

View reviewed changes

[PROD RELEASE] - Q2 #823

Are you sure you want to change the base?

[PROD RELEASE] - Q2 #823

Uh oh!

Conversation

kkartunov commented Jun 17, 2025

Uh oh!

github-actions bot Jun 17, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jun 17, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jun 17, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jun 17, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jun 17, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jun 17, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jun 17, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jun 17, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jun 17, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jun 17, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jun 17, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jun 17, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jun 17, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jun 19, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jun 19, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jun 19, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jun 19, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jun 19, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jun 19, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jun 19, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jun 19, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jun 19, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jun 19, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jun 19, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!