Backend agent table public permissions - #1865
Merged
Merged
Conversation
📝 WalkthroughWalkthroughChangesThe PR adds nullable connection-level site runtime policies, an authorized agents endpoint to replace them, Sitenova response and token contract updates, and safeguards against public grants on configured authentication data. Site runtime policy
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant Client
participant AgentsController
participant SetSiteRuntimePolicyUseCase
participant Cedar
participant ConnectionRepository
Client->>AgentsController: Submit site runtime policy
AgentsController->>SetSiteRuntimePolicyUseCase: Pass user, connection, and policy
SetSiteRuntimePolicyUseCase->>Cedar: Check connection:edit
SetSiteRuntimePolicyUseCase->>ConnectionRepository: Replace stored policy
ConnectionRepository-->>SetSiteRuntimePolicyUseCase: Return persisted policy
SetSiteRuntimePolicyUseCase-->>AgentsController: Return SiteRuntimePolicyRO
AgentsController-->>Client: Return policy response
Possibly related PRs
Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 5 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR adds support for storing a per-connection “site runtime policy” (manifest/data contract) for generated sites, exposes it to the SiteNova internal credentials response, and enforces new safety rules that prevent public (anonymous) reads from being granted on the site’s auth/visitor-accounts table and credential column.
Changes:
- Add
site_runtime_policy(jsonb) toconnection, with repository methods to read/write it. - Add an internal agents endpoint to write the runtime policy (manifest) after re-checking
connection:edit(Cedar). - Enforce refusal of public-read grants targeting the manifest’s auth table or credential column, and add e2e coverage for the new policy write + refusal behavior.
Reviewed changes
Copilot reviewed 19 out of 19 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| backend/test/ava-tests/non-saas-tests/non-saas-agents-microservice-public-permissions-e2e.test.ts | Adds e2e tests for writing the runtime manifest and refusing unsafe public grants. |
| backend/src/migrations/1785915298819-AddSiteRuntimePolicyToConnection.ts | Adds site_runtime_policy jsonb column to connection. |
| backend/src/microservices/sitenova-microservice/use-cases/sitenova-get-connection.use.case.ts | Includes siteRuntimePolicy in internal connection credentials response. |
| backend/src/microservices/sitenova-microservice/services/sitenova-enduser-auth.service.ts | Extends end-user token signing to optionally include uid claim; aligns JWT TTL typing. |
| backend/src/microservices/sitenova-microservice/data-structures/sitenova-site.ds.ts | Reads end-user token TTL from ENDUSER_TOKEN_TTL with 24h default; adds optional uid to payload. |
| backend/src/microservices/sitenova-microservice/data-structures/sitenova-internal-responses.ds.ts | Documents/exports optional siteRuntimePolicy field on the internal response DTO. |
| backend/src/microservices/agents-microservice/use-cases/set-site-runtime-policy.use.case.ts | New use case that validates and stores the runtime policy on the connection with audit logging. |
| backend/src/microservices/agents-microservice/use-cases/set-public-permissions.use.case.ts | Adds refusal logic preventing public grants on the manifest auth table / credential column. |
| backend/src/microservices/agents-microservice/use-cases/agents-use-cases.interface.ts | Adds ISetSiteRuntimePolicy interface. |
| backend/src/microservices/agents-microservice/dto/agents-site-runtime-policy.dtos.ts | New DTO for the policy write endpoint. |
| backend/src/microservices/agents-microservice/data-structures/agents.ds.ts | Adds DS for policy write use case. |
| backend/src/microservices/agents-microservice/data-structures/agents-responses.ds.ts | Adds response object for policy write endpoint. |
| backend/src/microservices/agents-microservice/agents.module.ts | Wires new use case provider into the agents module. |
| backend/src/microservices/agents-microservice/agents.controller.ts | Adds POST endpoint to set site runtime policy. |
| backend/src/exceptions/text/messages.ts | Adds new validation/refusal messages for policy/object validation and unsafe grants. |
| backend/src/entities/connection/repository/custom-connection-repository-extension.ts | Adds repository methods to get/update site_runtime_policy. |
| backend/src/entities/connection/repository/connection.repository.interface.ts | Extends repository interface with site runtime policy methods. |
| backend/src/entities/connection/connection.entity.ts | Adds site_runtime_policy jsonb column mapping. |
| backend/src/common/data-injection.tokens.ts | Adds DI token for the new agents use case. |
Suppressed comments (1)
backend/src/microservices/agents-microservice/use-cases/set-public-permissions.use.case.ts:117
- refuseGrantOnSiteAuthTable returns early when
authTableis missing, which also disables the credential-column check. If a stored policy is malformed/partial (e.g., passwordField present but tableName missing), public grants that include the credential column won’t be refused even though the comment says the password column should be blocked wherever it appears.
if (!authTable) {
return;
}
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+83
to
87
| await this.refuseGrantOnSiteAuthTable(connectionId, userId, tables); | ||
|
|
||
| let effective: Array<IPublicTablePermission> = tables; | ||
| if (mode !== 'replace') { | ||
| const existing = await this.cedarAuthService.getPublicPermissions(connectionId); |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (5)
backend/test/ava-tests/non-saas-tests/non-saas-agents-microservice-public-permissions-e2e.test.ts (1)
226-233: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueUse an arrow function for
siteRuntimePolicyRequest.As per coding guidelines: “Prefer arrow functions over function declarations.”
Proposed refactor
-function siteRuntimePolicyRequest(connectionId: string, body: Record<string, unknown>): request.Test { - return request(app.getHttpServer()) +const siteRuntimePolicyRequest = (connectionId: string, body: Record<string, unknown>): request.Test => + request(app.getHttpServer()) .post(`/internal/agents/connection/site-runtime-policy/${connectionId}`) .send(body) .set('Authorization', microserviceAuthHeader()) .set('Content-Type', 'application/json') .set('Accept', 'application/json'); -}🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@backend/test/ava-tests/non-saas-tests/non-saas-agents-microservice-public-permissions-e2e.test.ts` around lines 226 - 233, Convert siteRuntimePolicyRequest from a function declaration to an arrow function while preserving its parameters, return type, request construction, and chaining behavior.Source: Coding guidelines
backend/src/microservices/agents-microservice/use-cases/set-public-permissions.use.case.ts (1)
112-112: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueUse an interface for the policy auth shape.
Move the inline object shape to a named interface. As per coding guidelines: “Use interfaces for object shapes and type for unions and primitives.”
Proposed refactor
+interface SiteRuntimePolicyAuth { + tableName?: unknown; + passwordField?: unknown; +} + - const auth = policy?.auth as { tableName?: unknown; passwordField?: unknown } | undefined; + const auth = policy?.auth as SiteRuntimePolicyAuth | undefined;🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@backend/src/microservices/agents-microservice/use-cases/set-public-permissions.use.case.ts` at line 112, Define a named interface for the policy auth object shape containing the optional tableName and passwordField properties, then replace the inline assertion in the policy permission logic with that interface. Keep the existing optionality and unknown property types unchanged.Source: Coding guidelines
backend/src/microservices/sitenova-microservice/data-structures/sitenova-internal-responses.ds.ts (1)
69-72: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueReplace string concatenation with template literals.
backend/src/microservices/sitenova-microservice/data-structures/sitenova-internal-responses.ds.ts#L69-L72: Use one multiline template literal for the Swagger description.backend/src/microservices/agents-microservice/use-cases/set-public-permissions.use.case.ts#L122-L124: Use one template literal for the refusal log message.As per coding guidelines: “Use template literals instead of string concatenation.”
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@backend/src/microservices/sitenova-microservice/data-structures/sitenova-internal-responses.ds.ts` around lines 69 - 72, Replace the concatenated Swagger description in the response contract with a single multiline template literal, preserving its text and whitespace. Also update the refusal log message in setPublicPermissionsUseCase to use one template literal instead of string concatenation; apply the change in both specified files.Source: Coding guidelines
backend/src/microservices/agents-microservice/dto/agents-site-runtime-policy.dtos.ts (1)
13-16: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueUse template literals for the changed multi-line strings.
backend/src/microservices/agents-microservice/dto/agents-site-runtime-policy.dtos.ts#L13-L16: Replace the concatenated Swagger description with one template literal.backend/src/microservices/agents-microservice/use-cases/set-site-runtime-policy.use.case.ts#L63-L65: Use one template literal for the audit log message.backend/src/microservices/agents-microservice/agents.controller.ts#L137-L140: Replace the concatenated Swagger description with one template literal.As per coding guidelines: “Use template literals instead of string concatenation.”
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@backend/src/microservices/agents-microservice/dto/agents-site-runtime-policy.dtos.ts` around lines 13 - 16, Replace the concatenated multi-line strings with single template literals at agents-site-runtime-policy.dtos.ts lines 13-16 and agents.controller.ts lines 137-140, preserving their existing text. Update the audit log message at set-site-runtime-policy.use.case.ts lines 63-65 similarly, preserving its current content and behavior.Source: Coding guidelines
backend/src/entities/connection/connection.entity.ts (1)
128-131: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winReplace
Record<string, any>with a shared policy type.
site_runtime_policyis a security-relevant runtime contract.anyremoves type checking and differs from the repository'sRecord<string, unknown>contract. Define a sharedSiteRuntimePolicyinterface and use it across the entity, repository, DTO, and response types. Use an index signature withunknownif extension keys are required.As per coding guidelines: “Avoid any types - use specific types or generics instead” and “Use interfaces for object shapes and type for unions and primitives.”
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@backend/src/entities/connection/connection.entity.ts` around lines 128 - 131, Replace the site_runtime_policy Record<string, any> annotation in the connection entity with a shared SiteRuntimePolicy interface, defining extension keys with unknown where needed. Reuse this interface consistently across the related entity, repository, DTO, and response types, preserving nullable and optional behavior while eliminating any.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@backend/src/microservices/agents-microservice/use-cases/set-public-permissions.use.case.ts`:
- Around line 120-121: Update the permission validation around
namesPasswordColumn in the public-grant flow to reject wildcard or omitted
readableColumns whenever the site policy defines passwordField, since those
grants include every column. Preserve the existing explicit password-column and
auth-table checks, while allowing grants only when their expanded columns cannot
expose the configured credential field.
In
`@backend/src/microservices/sitenova-microservice/data-structures/sitenova-site.ds.ts`:
- Around line 9-10: Validate ENDUSER_TOKEN_TTL when initializing
SITENOVA_ENDUSER_TOKEN_TTL, accepting only durations supported by jwt.sign and
rejecting bare numeric or invalid values. Fail configuration loading immediately
with a clear error instead of allowing invalid TTLs to reach token-signing code.
---
Nitpick comments:
In `@backend/src/entities/connection/connection.entity.ts`:
- Around line 128-131: Replace the site_runtime_policy Record<string, any>
annotation in the connection entity with a shared SiteRuntimePolicy interface,
defining extension keys with unknown where needed. Reuse this interface
consistently across the related entity, repository, DTO, and response types,
preserving nullable and optional behavior while eliminating any.
In
`@backend/src/microservices/agents-microservice/dto/agents-site-runtime-policy.dtos.ts`:
- Around line 13-16: Replace the concatenated multi-line strings with single
template literals at agents-site-runtime-policy.dtos.ts lines 13-16 and
agents.controller.ts lines 137-140, preserving their existing text. Update the
audit log message at set-site-runtime-policy.use.case.ts lines 63-65 similarly,
preserving its current content and behavior.
In
`@backend/src/microservices/agents-microservice/use-cases/set-public-permissions.use.case.ts`:
- Line 112: Define a named interface for the policy auth object shape containing
the optional tableName and passwordField properties, then replace the inline
assertion in the policy permission logic with that interface. Keep the existing
optionality and unknown property types unchanged.
In
`@backend/src/microservices/sitenova-microservice/data-structures/sitenova-internal-responses.ds.ts`:
- Around line 69-72: Replace the concatenated Swagger description in the
response contract with a single multiline template literal, preserving its text
and whitespace. Also update the refusal log message in
setPublicPermissionsUseCase to use one template literal instead of string
concatenation; apply the change in both specified files.
In
`@backend/test/ava-tests/non-saas-tests/non-saas-agents-microservice-public-permissions-e2e.test.ts`:
- Around line 226-233: Convert siteRuntimePolicyRequest from a function
declaration to an arrow function while preserving its parameters, return type,
request construction, and chaining behavior.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: b5eb16e3-ea56-47f1-bf3b-cc00b9b93e99
📒 Files selected for processing (19)
backend/src/common/data-injection.tokens.tsbackend/src/entities/connection/connection.entity.tsbackend/src/entities/connection/repository/connection.repository.interface.tsbackend/src/entities/connection/repository/custom-connection-repository-extension.tsbackend/src/exceptions/text/messages.tsbackend/src/microservices/agents-microservice/agents.controller.tsbackend/src/microservices/agents-microservice/agents.module.tsbackend/src/microservices/agents-microservice/data-structures/agents-responses.ds.tsbackend/src/microservices/agents-microservice/data-structures/agents.ds.tsbackend/src/microservices/agents-microservice/dto/agents-site-runtime-policy.dtos.tsbackend/src/microservices/agents-microservice/use-cases/agents-use-cases.interface.tsbackend/src/microservices/agents-microservice/use-cases/set-public-permissions.use.case.tsbackend/src/microservices/agents-microservice/use-cases/set-site-runtime-policy.use.case.tsbackend/src/microservices/sitenova-microservice/data-structures/sitenova-internal-responses.ds.tsbackend/src/microservices/sitenova-microservice/data-structures/sitenova-site.ds.tsbackend/src/microservices/sitenova-microservice/services/sitenova-enduser-auth.service.tsbackend/src/microservices/sitenova-microservice/use-cases/sitenova-get-connection.use.case.tsbackend/src/migrations/1785915298819-AddSiteRuntimePolicyToConnection.tsbackend/test/ava-tests/non-saas-tests/non-saas-agents-microservice-public-permissions-e2e.test.ts
Comment on lines
+120
to
+121
| const namesPasswordColumn = Boolean(passwordField && table.readableColumns?.includes(passwordField)); | ||
| if (namesAuthTable || namesPasswordColumn) { |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Locate relevant files"
fd -a 'set-public-permissions.use.case.ts|cedar-policy-generator.ts|agents-use-cases.interface.ts|agents-.*\.ds.ts|agents-.*\.ds$.|agents-responses.ds.ts' backend/src || true
echo
echo "Search for SetPublicPermissionsDs definition/usages"
rg -n "SetPublicPermissionsDs|SetPublicPermissions|set-public-permissions|readableColumns|passwordField|authTable" backend/src -S | head -200
echo
echo "Inspect target use-case lines"
cat -n backend/src/microservices/agents-microservice/use-cases/set-public-permissions.use.case.ts | sed -n '1,180p'
echo
echo "Inspect public permission interface"
cat -n backend/src/entities/cedar-authorization/cedar-policy-generator.ts | sed -n '1,120p'Repository: rocket-admin/rocketadmin
Length of output: 27009
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Inspect public permissions persistence/validation"
cat -n backend/src/entities/cedar-authorization/cedar-authorization.service.ts | sed -n '300,430p'
cat -n backend/src/microservices/agents-microservice/data-structures/agents.ds.ts | sed -n '1,80p'
cat -n backend/src/microservices/agents-microservice/data-structures/agents-responses.ds.ts | sed -n '1,70p'
cat -n backend/src/microservices/agents-microservice/data-structures/agents.use.cases.interface.ts | sed -n '1,90p'
echo
echo "Search for table metadata calls from agents use case or controller"
rg -n "getConnectionTable|getTable|connectionTable|structure|columns|getReadableColumns|set_public_read_permissions|SetPublicPermissionsDto|SetPublicPermissionsDs" backend/src/microservices/agents-microservice backend/src/entities/cedar-authorization -SRepository: rocket-admin/rocketadmin
Length of output: 9646
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Agents use-case interface"
cat -n backend/src/microservices/agents-microservice/use-cases/agents-use-cases.interface.ts | sed -n '1,90p'
echo
echo "Agents controller relevant flow"
cat -n backend/src/microservices/agents-microservice/agents.controller.ts | sed -n '1,120p'
echo
echo "Validation helpers and policy references"
cat -n backend/src/entities/cedar-authorization/cedar-authorization.service.ts | sed -n '430,540p'
cat -n backend/src/entities/cedar-authorization/cedar-authorization.service.ts | sed -n '1,120p'
echo
echo "Target path and deterministic behavior probe from source text"
python3 - <<'PY'
import pathlib, re
p = pathlib.Path('backend/src/microservices/agents-microservice/use-cases/set-public-permissions.use.case.ts')
s = p.read_text()
checks = [
('refuseGrantOnSiteAuthTable checks existing requests only', re.search(r'for\s+const\s+table\s+of\s+tables\s*\{', s) is not None),
('passwordField check only through explicit readableColumns includes', bool(re.search(r'Boolean\(passwordField\s*&&\s*table\.readableColumns\?\.includes\(passwordField\)\)', s))),
('wildcard/empty readableColumns expands to all columns in generator', bool(re.search(r'else\s*\{\s*policies\.push\(\s*`permit\(\n\s*principal,\n\s*action\s*==\s*RocketAdmin::Action::"column:read",\n\s*resource\s+in\s+\$\{tableRef\}\n\);', s))),
]
for name, ok in checks:
print(f'{name}: {ok}')
PYRepository: rocket-admin/rocketadmin
Length of output: 19972
Sensitive Data Exposure (CWE-200): Exposure of Sensitive Information to an Unauthorized Actor
Reachability: Internal
Reachability path
● Entry
backend/src/microservices/agents-microservice/agents.module.ts:42
SetPublicPermissionsUseCase
│
▼
● Sink
backend/src/microservices/agents-microservice/use-cases/set-public-permissions.use.case.ts
Block wildcard public grants that can include the password field.
readableColumns omitted or empty generates an all-column public grant. The current check only rejects an explicit passwordField entry, so a non-auth table containing that credential field can still be exposed. Expand readableColumns before this check, or reject wildcard grants while a site policy defines passwordField.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@backend/src/microservices/agents-microservice/use-cases/set-public-permissions.use.case.ts`
around lines 120 - 121, Update the permission validation around
namesPasswordColumn in the public-grant flow to reject wildcard or omitted
readableColumns whenever the site policy defines passwordField, since those
grants include every column. Preserve the existing explicit password-column and
auth-table checks, while allowing grants only when their expanded columns cannot
expose the configured credential field.
Comment on lines
+9
to
+10
| export const SITENOVA_ENDUSER_TOKEN_TTL = | ||
| process.env.ENDUSER_TOKEN_TTL && process.env.ENDUSER_TOKEN_TTL.length > 0 ? process.env.ENDUSER_TOKEN_TTL : '24h'; |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n -C 3 'ENDUSER_TOKEN_TTL|SITENOVA_ENDUSER_TOKEN_TTL' backend
rg -n -C 3 'validationSchema|validate\s*:|ConfigModule' backendRepository: rocket-admin/rocketadmin
Length of output: 7274
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Inspect relevant usages and package metadata without running repository code.
printf '\n--- data-structure excerpt ---\n'
sed -n '1,120p' backend/src/microservices/sitenova-microservice/data-structures/sitenova-site.ds.ts
printf '\n--- auth service excerpt ---\n'
sed -n '1,140p' backend/src/microservices/sitenova-microservice/services/sitenova-enduser-auth.service.ts
printf '\n--- jwt dependency metadata ---\n'
python3 - <<'PY'
import json, pathlib
paths = [path for path in pathlib.Path('backend').rglob('package-lock.json') | list(pathlib.Path('.').rglob('package-lock.json'))]
for p in sorted(paths)[:10]:
print(f'\n[{p}]')
try:
data=json.loads(p.read_text())
except Exception as e:
print(e)
continue
for key,node in (data.get('packages') or {}).items():
if key.endswith('/jsonwebtoken') or key == 'jsonwebtoken':
print(node.get('version'), node.get('resolved'))
PY
printf '\n--- docs/package references ---\n'
cat package.json 2>/dev/null | sed -n '1,160p' || true
cat backend/package.json 2>/dev/null | sed -n '1,160p' || true
printf '\n--- static verification of assigned value and usage ---\n'
python3 - <<'PY'
from pathlib import Path
dt=Path('backend/src/microservices/sitenova-microservice/data-structures/sitenova-site.ds.ts')
au=Path('backend/src/microservices/sitenova-microservice/services/sitenova-enduser-auth.service.ts')
for p in (dt, au):
text=p.read_text(encoding='utf-8')
print(p, len(text.splitlines()))
PY
printf '\n--- package-lock jsonwebtoken entries ---\n'
python3 - <<'PY'
import json, pathlib
for p in pathlib.Path('.').rglob('package-lock.json'):
if '.npm' in str(p):
continue
data=json.loads(p.read_text())
for key,node in (data.get('packages') or {}).items():
if key == 'backend' or key.endswith('/jsonwebtoken') or key == 'jsonwebtoken':
print(key, node.get('name'), node.get('version'), node.get('resolved'))
PYRepository: rocket-admin/rocketadmin
Length of output: 7755
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n--- package-lock jsonwebtoken entries ---\n'
python3 - <<'PY'
import json
from pathlib import Path
for p in Path('.').rglob('package-lock.json'):
if '.npm' in str(p):
continue
try:
data=json.loads(p.read_text())
except Exception as e:
print(f'[{p}] parse error {e}')
continue
for key,node in (data.get('packages') or {}).items():
pkg_name=node.get('name') if isinstance(node, dict) else None
if key.endswith('/jsonwebtoken') or key == 'jsonwebtoken' or pkg_name == 'jsonwebtoken':
print(key, pkg_name, node.get('version'), node.get('resolved'))
print()
PY
printf '\n--- root package.json ---\n'
cat package.json 2>/dev/null || true
printf '\n--- backend package.json ---\n'
cat backend/package.json 2>/dev/null | sed -n '1,220p' || true
printf '\n--- config module references ---\n'
cat backend/src/shared/config/config.module.ts 2>/dev/null | sed -n '1,220p' || trueRepository: rocket-admin/rocketadmin
Length of output: 6331
🌐 Web query:
jsonwebtoken v9 expiresIn accepts number milliseconds seconds valid duration string
💡 Result:
In jsonwebtoken v9, the expiresIn option is interpreted differently depending on whether you provide a number or a string [1][2]. When you provide a number, it is interpreted as the count in seconds (e.g., 60 means 60 seconds) [1][3]. When you provide a string, it must be a valid time span string (e.g., "2 days", "10h", "7d") [1][2]. If the string does not specify a unit, it is interpreted as milliseconds by default (e.g., "120" is treated as "120ms") [1][3]. To avoid confusion when using strings, it is recommended to explicitly include the time units (such as "s", "m", "h", "d") [1].
Citations:
- 1: https://github.com/auth0/node-jsonwebtoken/blob/master/README.md
- 2: https://github.com/auth0/node-jsonwebtoken?tab=readme-ov-file
- 3: https://www.npmjs.com/package/jsonwebtoken
Validate ENDUSER_TOKEN_TTL at config load.
SITENOVA_ENDUSER_TOKEN_TTL accepts any non-empty string and passes it to jwt.sign({ expiresIn: ... }). A bare value such as 120 is read as milliseconds, and an invalid duration can make SignUser login or request token signing blow up. Validate the duration up front and fail startup instead of deferring the failure to JWT creation.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@backend/src/microservices/sitenova-microservice/data-structures/sitenova-site.ds.ts`
around lines 9 - 10, Validate ENDUSER_TOKEN_TTL when initializing
SITENOVA_ENDUSER_TOKEN_TTL, accepting only durations supported by jwt.sign and
rejecting bare numeric or invalid values. Fail configuration loading immediately
with a clear error instead of allowing invalid TTLs to reach token-signing code.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
New Features
Bug Fixes
Tests