-
Notifications
You must be signed in to change notification settings - Fork 0
Update from task 365db7f7-e8f3-4597-a1d4-4638f39f923e #4
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -1,42 +1,52 @@ | ||||||||||||
| ``` | ||||||||||||
| # Dependencies | ||||||||||||
| node_modules | ||||||||||||
| .pnp | ||||||||||||
| .pnp.js | ||||||||||||
| node_modules/ | ||||||||||||
|
|
||||||||||||
| # Testing | ||||||||||||
| coverage | ||||||||||||
| *.log | ||||||||||||
| # Environment | ||||||||||||
| .env | ||||||||||||
| .env.local | ||||||||||||
| .env.* | ||||||||||||
|
|
||||||||||||
| # Editor | ||||||||||||
| .vscode/ | ||||||||||||
| .idea/ | ||||||||||||
|
|
||||||||||||
| # Next.js | ||||||||||||
| .next/ | ||||||||||||
| out/ | ||||||||||||
| build | ||||||||||||
| dist | ||||||||||||
| # Logs | ||||||||||||
| *.log | ||||||||||||
|
|
||||||||||||
| # Production | ||||||||||||
| .vercel | ||||||||||||
| .env*.local | ||||||||||||
| # Python | ||||||||||||
| __pycache__/ | ||||||||||||
| *.pyc | ||||||||||||
| *.pyo | ||||||||||||
| *.pyd | ||||||||||||
|
|
||||||||||||
| # Environment files | ||||||||||||
| .env | ||||||||||||
| .env.production | ||||||||||||
| # Build outputs | ||||||||||||
| dist/ | ||||||||||||
| build/ | ||||||||||||
|
Comment on lines
+24
to
+25
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. This section is missing an entry for the Additionally, there are a few duplicate entries in this file ( |
||||||||||||
| *.js | ||||||||||||
| *.ts | ||||||||||||
|
Comment on lines
+26
to
+27
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛑 Critical Error: Ignoring
Suggested change
Comment on lines
+26
to
+27
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. The patterns
Comment on lines
+23
to
+27
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
Useful? React with 👍 / 👎.
Comment on lines
+26
to
+27
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. P2 | Confidence: High The addition of Code Suggestion: |
||||||||||||
|
|
||||||||||||
| # Debug | ||||||||||||
| npm-debug.log* | ||||||||||||
| yarn-debug.log* | ||||||||||||
| yarn-error.log* | ||||||||||||
| # Temp files | ||||||||||||
| *.tmp | ||||||||||||
| *.swp | ||||||||||||
| *.swo | ||||||||||||
|
|
||||||||||||
| # OS | ||||||||||||
| .DS_Store | ||||||||||||
| Thumbs.db | ||||||||||||
|
|
||||||||||||
| # IDE | ||||||||||||
| .vscode/ | ||||||||||||
| .idea/ | ||||||||||||
| *.swp | ||||||||||||
| *.swo | ||||||||||||
| *~ | ||||||||||||
| # Coverage | ||||||||||||
| coverage/ | ||||||||||||
| htmlcov/ | ||||||||||||
| .coverage | ||||||||||||
|
|
||||||||||||
| # Cache | ||||||||||||
| .mypy_cache/ | ||||||||||||
| .pytest_cache/ | ||||||||||||
| .nyc_output/ | ||||||||||||
| coverage/ | ||||||||||||
|
|
||||||||||||
| # Misc | ||||||||||||
| .turbo | ||||||||||||
| .cache | ||||||||||||
| # System | ||||||||||||
| .DS_Store | ||||||||||||
| Thumbs.db | ||||||||||||
| ``` | ||||||||||||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛑 Syntax Error: The .gitignore file ends with markdown code block syntax which is invalid. Remove the closing backticks. |
||||||||||||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -25,6 +25,26 @@ export class ApiError extends Error { | |
| } | ||
| } | ||
|
|
||
| /** | ||
| * Get authentication token for API requests | ||
| * This function attempts to get the token from the NextAuth session | ||
| */ | ||
| async function getAuthToken(): Promise<string | null> { | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. P1 | Confidence: High The implementation of Code Suggestion: import { getSession } from 'next-auth/react';
import { getServerSession } from 'next-auth/next';
import { authOptions } from './authOptions';
async function getAuthToken(): Promise<string | null> {
if (typeof window !== 'undefined') {
// Client-side: get session from next-auth/react
const session = await getSession();
return session?.accessToken || session?.user?.id || null;
} else {
// Server-side: get session from next-auth/next
const session = await getServerSession(authOptions);
return session?.accessToken || session?.user?.id || null;
}
} |
||
| // In client-side, we can use the getSession function | ||
| if (typeof window !== 'undefined') { | ||
| try { | ||
| // For client-side, we'll rely on NextAuth's automatic cookie handling | ||
| return null; // NextAuth handles authentication via cookies automatically | ||
| } catch (error) { | ||
| console.error('Error getting auth token:', error); | ||
| return null; | ||
| } | ||
|
Comment on lines
+35
to
+41
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. The // For client-side, we'll rely on NextAuth's automatic cookie handling
return null; // NextAuth handles authentication via cookies automatically |
||
| } | ||
|
|
||
| // In server-side, we might need to extract token differently | ||
| return null; | ||
| } | ||
|
Comment on lines
+32
to
+46
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Logic/Security Issue: Authentication token is never retrievedThe Recommended Solution:
Comment on lines
+32
to
+46
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. The
Comment on lines
+32
to
+46
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. The |
||
|
|
||
| /** | ||
| * Base fetch function with error handling | ||
| */ | ||
|
|
@@ -33,12 +53,25 @@ async function fetchApi<T>( | |
| options: RequestInit = {} | ||
| ): Promise<ApiResponse<T>> { | ||
| try { | ||
| // For client-side requests, relative URLs work fine | ||
| // For server-side requests in Next.js, the fetch is handled internally | ||
|
|
||
| // Get auth token if available | ||
| const token = await getAuthToken(); | ||
|
|
||
| const headers: HeadersInit = { | ||
| 'Content-Type': 'application/json', | ||
| ...options.headers, | ||
| }; | ||
|
|
||
| // Add authorization header if token is available | ||
| if (token) { | ||
| headers['Authorization'] = `Bearer ${token}`; | ||
| } | ||
|
|
||
| const response = await fetch(url, { | ||
| ...options, | ||
| headers: { | ||
| 'Content-Type': 'application/json', | ||
| ...options.headers, | ||
| }, | ||
| headers, | ||
| }); | ||
|
|
||
| const data = await response.json(); | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -94,4 +94,7 @@ export const authOptions: NextAuthOptions = { | |
| error: '/auth/error', | ||
| }, | ||
| debug: process.env.NODE_ENV === 'development', | ||
| // Ensure proper domain configuration for production | ||
| secret: process.env.NEXTAUTH_SECRET, | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Missing Secret ValidationThe Recommended solution: if (!process.env.NEXTAUTH_SECRET && process.env.NODE_ENV === 'production') {
throw new Error('NEXTAUTH_SECRET must be set in production');
} |
||
| trustHost: true, | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. trustHost Security RiskSetting Recommended solution: trustHost: process.env.NODE_ENV === 'production' ? false : true,Or ensure your infrastructure is configured to mitigate host header attacks before enabling this in production. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛑 Security Risk: Setting
Comment on lines
+98
to
+99
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. P0 | Confidence: High Setting Code Suggestion: secret: process.env.NEXTAUTH_SECRET,
// Only trust host in Vercel-like environments or when explicitly configured
trustHost: process.env.VERCEL === '1' || process.env.NEXTAUTH_URL !== undefined,Evidence: path:src/app/api/auth/[...nextauth]/route.ts |
||
| }; | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The
.gitignorefile starts with a markdown code block fence (```). This is not valid syntax for a.gitignorefile and should be removed. The corresponding closing fence on line 52 should also be removed.