feat: validate 1fichier premium accounts - #3
Conversation
📝 WalkthroughWalkthroughThe plugin now validates premium credentials through ChangesPremium validation flow
Estimated code review effort: 3 (Moderate) | ~25 minutes Possibly related PRs
Sequence Diagram(s)sequenceDiagram
participant Host
participant validate_account
participant http_request
participant AccountAPI
Host->>validate_account: invoke with configured credential
validate_account->>http_request: build and send user/info.cgi request
http_request->>AccountAPI: POST with Bearer authorization
AccountAPI-->>http_request: account status and offer
http_request-->>validate_account: HTTP response
validate_account-->>Host: {"valid": true} or typed error code
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Comment |
Qodo reviews are paused for this user.Troubleshooting steps vary by plan Learn more → On a Teams plan? Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center? |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
tests/wasm_smoke.rs (1)
224-228: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winCover every typed HTTP account-status mapping.
Add
402 → ACCOUNT_EXPIREDand509 → ACCOUNT_QUOTA_EXCEEDEDto this matrix so the host-visible contracts cannot regress independently of body-based tests.for (status, expected_code) in [ (401, "ACCOUNT_INVALID_CREDENTIALS"), (403, "ACCOUNT_INVALID_CREDENTIALS"), + (402, "ACCOUNT_EXPIRED"), (429, "ACCOUNT_COOLDOWN"), + (509, "ACCOUNT_QUOTA_EXCEEDED"), ] {🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/wasm_smoke.rs` around lines 224 - 228, Add the missing typed HTTP account-status cases to the matrix in the smoke test: include 402 expecting ACCOUNT_EXPIRED and 509 expecting ACCOUNT_QUOTA_EXCEEDED alongside the existing entries. Keep the current loop and assertions unchanged so every host-visible mapping is covered.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/premium_mode.rs`:
- Around line 131-135: Update the validation logic around parsed.status and
parsed.offer so only an explicit, case-insensitive status of "OK" can reach the
successful offer match; missing or empty status must return an error even when
offer is 1–3. Add a regression test covering an offer of 1 with absent or empty
status and assert that validation fails.
---
Nitpick comments:
In `@tests/wasm_smoke.rs`:
- Around line 224-228: Add the missing typed HTTP account-status cases to the
matrix in the smoke test: include 402 expecting ACCOUNT_EXPIRED and 509
expecting ACCOUNT_QUOTA_EXCEEDED alongside the existing entries. Keep the
current loop and assertions unchanged so every host-visible mapping is covered.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 4f68bc3b-af65-4cd9-88cb-e2940f7979d2
⛔ Files ignored due to path filters (1)
Cargo.lockis excluded by!**/*.lock
📒 Files selected for processing (8)
Cargo.tomlREADME.mdplugin.tomlsrc/error.rssrc/lib.rssrc/plugin_api.rssrc/premium_mode.rstests/wasm_smoke.rs
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
cubic analysis
All reported issues were addressed across 9 files
Linked issue analysis
Linked issue: MAT-132: [Lot 2] Brancher les comptes premium de bout en bout
| Status | Acceptance criteria | Notes |
|---|---|---|
| R-01 — L’ajout ou la modification d’un compte déclenche une validation réelle via le port applicatif prévu. | The plugin now exposes a validate_account export and implements the account-validation request/response (src/plugin_api.rs, src/premium_mode.rs) and there is a WASM test calling validate_account. However the PR does not show the host/app wiring that calls this export on add/update (the application-side trigger is not present in this repo), so the end-to-end trigger is not fully proven in the diff. | |
| ✅ | R-02 — Un secret de compte n’est jamais persisté en clair dans SQLite, les logs ou les events frontend. | Plugin code reads credentials only via the host get_credential function and does not persist secrets in the plugin; README and code changes document/implement host-only credential access. |
| R-03 — Un téléchargement premium sélectionne uniquement un compte activé, valide et compatible avec le hoster. | The plugin enforces compatibility/validity with the hoster (accepts paid offers 1–3) and no longer silently falls back on credential failures (it returns typed errors). But the plugin does not assert or read an application-level "enabled/activated" flag — that is an app-side concern and not shown wired here. | |
| ✅ | R-04 — Le plugin reçoit le credential attendu via la fonction hôte dédiée, sans connaître le keyring. | The plugin reads the API key only via get_credential (host function) and tests verify the host-credential flow in WASM smoke tests. |
| ✅ | R-05 — Les erreurs d’authentification, de quota et de cooldown produisent des états typés et observables dans l’UI. | Typed account error variants and stable machine codes were added (PluginError::code), classification logic maps HTTP/messages to ACCOUNT_* codes, and error messages are prefixed with the code so the host can observe and update UI/state. Tests assert presence of these codes. |
| R-06 — Des tests d’intégration couvrent succès, credential absent, compte expiré et rotation vers un second compte. | The PR adds many integration-style WASM tests covering success, invalid credential, exhausted quota and HTTP account failures. It does not include an explicit test for the host-side rotation to a second account or an explicit credential-absent end-to-end host integration (rotation is an application-level behavior), so the full set of scenarios in the acceptance row is not fully covered here. |
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
|
Review fixes pushed in 82d87d2: explicit status OK validation with regression coverage, missing-credential WASM coverage, and typed HTTP mappings for 402 and 509. Rotation remains tested at the host/application boundary in mpiton/vortex#171. |
Qodo reviews are paused for this user.Troubleshooting steps vary by plan Learn more → On a Teams plan? Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center? |
2 similar comments
Qodo reviews are paused for this user.Troubleshooting steps vary by plan Learn more → On a Teams plan? Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center? |
Qodo reviews are paused for this user.Troubleshooting steps vary by plan Learn more → On a Teams plan? Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center? |
1 participant
Summary
Verification
Release artifact checksums from this HEAD:
Delivery ordering
After merge, publish immutable v1.1.0 assets before updating Vortex's registry. The app PR intentionally keeps the registry on the currently published v1.0.0 entry.
Linear: https://linear.app/mpiton/issue/MAT-132/lot-2-brancher-les-comptes-premium-de-bout-en-bout
Summary by cubic
Adds strict premium account validation and typed account errors to
vortex-mod-1fichier. Premium mode now fails closed on auth/expiry/cooldown/quota; free mode is used only when no credential is selected, meeting MAT-132.New Features
validate_accountexport: callsuser/info.cgiwith Bearer auth, accepts paid offers (1–3), rejects free/expired; classifies HTTP 401/403/402/429/509; returns{"valid": true}.traffic_used >= traffic_totalor KO messages) and surfacesQuotaExceededwith codeACCOUNT_QUOTA_EXCEEDED.ACCOUNT_INVALID_CREDENTIALS,ACCOUNT_EXPIRED,ACCOUNT_COOLDOWN,ACCOUNT_QUOTA_EXCEEDED); no silent fallback. Free metadata is returned only when no credential is selected.Migration
validate_accounton add/update to set account state; store secrets only in the host keyring.ACCOUNT_*codes; use free mode only when no credential is selected.v1.1.0assets, then update Vortex’s registry with the new checksums.Written for commit 82d87d2. Summary will update on new commits.
Summary by CodeRabbit
{"valid": true}when successful).