API: Invite code implementation#326
Conversation
There was a problem hiding this comment.
Hey @nxtcoder19 - I've reviewed your changes and found some issues that need to be addressed.
Blocking issues:
Here's what I looked at during the review
- 🟡 General issues: 1 issue found
- 🔴 Security: 2 blocking issues
- 🟢 Testing: all looks good
- 🟢 Complexity: all looks good
Help me be more useful! Please click 👍 or 👎 on each comment to tell me if it was helpful.
| auth_resendVerificationEmail: Boolean! @isLoggedIn | ||
| auth_changePassword(currentPassword: String!, newPassword: String!): Boolean! @isLoggedInAndVerified | ||
|
|
||
| auth_createInviteCode(name: String!, inviteCode: String!): InviteCode! |
There was a problem hiding this comment.
suggestion: Consider adding a description for the new GraphQL fields.
Adding descriptions to the new GraphQL fields 'auth_createInviteCode', 'auth_deleteInviteCode', and 'auth_verifyInviteCode' would improve the schema documentation.
| auth_createInviteCode(name: String!, inviteCode: String!): InviteCode! | |
| # Creates a new invite code with the specified name and invite code. | |
| auth_createInviteCode(name: String!, inviteCode: String!): InviteCode! |
| auth_resendVerificationEmail: Boolean! @isLoggedIn | ||
| auth_changePassword(currentPassword: String!, newPassword: String!): Boolean! @isLoggedInAndVerified | ||
|
|
||
| auth_createInviteCode(name: String!, inviteCode: String!): InviteCode! |
There was a problem hiding this comment.
🚨 issue (security): Potential hard-coded invite code found.
The inviteCode parameter in the auth_createInviteCode mutation appears to be a hard-coded secret. Consider using a more secure method to handle invite codes, such as generating them dynamically or fetching them from a secure source.
| type InviteCode { | ||
| id: ID! | ||
| name: String! | ||
| inviteCode: String! |
There was a problem hiding this comment.
🚨 issue (security): Potential hard-coded invite code found.
The inviteCode field in the InviteCode type appears to be a hard-coded secret. Consider using a more secure method to handle invite codes, such as generating them dynamically or fetching them from a secure source.
6b1998b to
afce894
Compare
API: Invite code implementation
Resolves kloudlite/kloudlite#221