🥅 server: handle no panda user on card create#791
Conversation
🦋 Changeset detectedLatest commit: 5cd6f70 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Summary of ChangesHello @cruzdanilo, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request enhances the server's card creation process by introducing robust error handling for unapproved Panda users. It ensures that when a user attempts to create a card but their associated Panda account lacks approval, the API responds with a precise 403 Forbidden status, providing clearer feedback and preventing unexpected system behavior. The changes also include a refactoring of error code constants for improved maintainability and new tests to cover these specific error conditions. Highlights
Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
WalkthroughThe changes implement error handling for missing or unapproved Panda users during card creation. The Panda utility now catches and normalizes specific API errors (403 user not approved, 404 user not found) into standardized "no user" errors. The Card API maps these to 403 responses with "no panda" code. New tests verify these error scenarios. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Sentry Issue: SERVER-J5 |
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #791 +/- ##
==========================================
- Coverage 68.98% 68.83% -0.16%
==========================================
Files 207 207
Lines 7032 7033 +1
Branches 2222 2223 +1
==========================================
- Hits 4851 4841 -10
- Misses 2000 2010 +10
- Partials 181 182 +1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request correctly handles a specific user not approved error from the Panda API during card creation by returning a 403 status, including specific error parsing and new tests. No specific vulnerabilities or critical issues were found. There are a couple of suggestions to improve code maintainability and clarity.
I am having trouble creating individual review comments. Click here to see my feedback.
server/api/card.ts (48-53)
The BadRequestCodes constant object was removed, and its values are now hardcoded as strings. Using constants for such values is generally better for maintainability as it prevents typos, provides a single source of truth, and makes the code easier to refactor. Since these codes are used in multiple places, I'd recommend re-introducing this constant object.
server/utils/panda.ts (71-93)
The error handling logic in this catch block is a bit complex due to manual string parsing and variable declarations. This can be simplified for better readability and robustness, reducing the chance of bugs if the upstream error format changes slightly.
} catch (error) {
if (error instanceof Error) {
const separator = error.message.indexOf(" ");
if (separator !== -1) {
const status = Number.parseInt(error.message.slice(0, separator), 10);
if (status === 403) {
try {
const payload = JSON.parse(error.message.slice(separator + 1)) as { error?: string; message?: string };
if (payload.error === "ForbiddenError" && payload.message === "User exists, but is not not approved") {
throw new Error("panda user not approved");
}
} catch {
// Not JSON or doesn't match, fall through to rethrow original error
}
}
}
}
throw error;
}
|
Sentry Issue: SERVER-JC |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5cd6f707ad
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
cruzdanilo
changed the title
|
Sentry Issue: SERVER-JE |
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
server/api/card.ts (1)
578-583: 🧹 Nitpick | 🔵 Trivial
buildBaseResponsecreates an open string schema, not a literal constraint.
buildBaseResponseusespipe(string(), metadata(...))which accepts any string value. For response schemas where the code/legacy values are fixed (e.g.,"bad request","no panda","already set"), consider usingliteral()to produce accurate OpenAPI documentation.♻️ Suggested fix
-function buildBaseResponse(example = "string") { +function buildBaseResponse(code: string) { return object({ - code: pipe(string(), metadata({ examples: [example] })), - legacy: pipe(string(), metadata({ examples: [example] })), + code: pipe(literal(code), metadata({ examples: [code] })), + legacy: pipe(string(), metadata({ examples: [code] })), }); }Note:
legacyis kept asstring()since the actual legacy values differ fromcodein some cases (e.g.,"panda id not found"vs"no panda").
| const account = parse(Address, credential.account); | ||
| setUser({ id: account }); | ||
| if (!credential.pandaId) return c.json({ code: BadRequestCodes.NO_PANDA, legacy: BadRequestCodes.NO_PANDA }, 403); | ||
| if (!credential.pandaId) return c.json({ code: "no panda", legacy: "no panda" }, 403); |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
rg -n "panda id not found" --type=ts -g '!server/test/**'Repository: exactly/exa
Length of output: 372
🏁 Script executed:
rg -n '"no panda"' --type=ts -g '!server/test/**'Repository: exactly/exa
Length of output: 783
🏁 Script executed:
cat -n server/api/card.ts | sed -n '235,252p'Repository: exactly/exa
Length of output: 1123
🏁 Script executed:
cat -n server/api/card.ts | sed -n '339,350p'Repository: exactly/exa
Length of output: 662
🏁 Script executed:
cat -n server/api/card.ts | sed -n '413,420p'Repository: exactly/exa
Length of output: 384
Inconsistent legacy field between GET and POST for the same "no panda" code.
GET handlers return legacy: "no panda" (lines 237, 250), while POST handlers return legacy: "panda id not found" (lines 341, 415). Unify these values unless the discrepancy is intentional for backward compatibility with existing clients.
1 participant
Summary by CodeRabbit
Bug Fixes
Tests