Skip to content

Cursor new oma req review #57

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
IM-Agents wants to merge 3 commits into from
Closed

Cursor new oma req review #57

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
964ed59
issue fixed but check again
iw0108 May 4, 2026
08a3268
Update coderabbit-auto-fix.yml
IM-Agents May 4, 2026
3fb8356
Update coderabbit-auto-fix.yml
IM-Agents May 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
120 changes: 96 additions & 24 deletions .github/workflows/coderabbit-auto-fix.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -250,10 +250,20 @@ jobs:
exit 0
fi

# Latest-push aggregate first; fall back to this event's review/comment body (same tip).
SOURCE_TEXT="${CLICKUP_AGGREGATE_BODY:-$COMMENT_BODY}"
if [ -z "$SOURCE_TEXT" ]; then
SOURCE_TEXT="$COMMENT_BODY"
# Inline aggregate + top-level review body when both exist (so no finding lives only in one side).
AGG="${CLICKUP_AGGREGATE_BODY:-}"
COM="${COMMENT_BODY:-}"
SOURCE_TEXT="$AGG"
if [ -n "$COM" ]; then
if [ -n "$SOURCE_TEXT" ]; then
SOURCE_TEXT="${SOURCE_TEXT}

---

${COM}"
else
SOURCE_TEXT="$COM"
fi
fi

# Strip HTML comments; collapse blank lines (keep raw <details> for extraction below).
Expand Down Expand Up @@ -335,35 +345,97 @@ jobs:
return strip_md_bold("$label\n\n```\n$body\n```\n\n");
}

my @parts = split(/\n\n---\n\n/, $input);
my @blocks;
sub flush_finding {
my ($fix, $prompt) = @_;
return '' unless ($fix ne '' || $prompt ne '');
my $o = '';
$o .= format_block('Suggested fix', $fix) if $fix ne '';
$o .= format_block('Prompt for AI Agents', $prompt) if $prompt ne '';
return $o;
}

for my $chunk (@parts) {
next unless $chunk =~ /\S/;
my $fix = '';
my $prompt = '';
sub summary_kind {
my ($raw) = @_;
return '' unless defined $raw;
my $s = $raw;
$s =~ s/<[^>]+>//g;
$s =~ s/\*\*//g;
$s =~ s/^\s+|\s+$//g;
return 'prompt' if $s =~ /Prompt\s+for\s+AI\s+Agents/i;
return 'fix' if $s =~ /Suggested\s+fix|Proposed\s+fix|Suggested\s+patch/i;
return 'fix' if $s =~ /💡\s*Proposed|🔧\s*Suggested|🐛\s*Proposed|♻️\s*Proposed/i;
return '';
}

if ($chunk =~ m{<details[^>]*>\s*<summary[^>]*>[^<]*(?:Suggested\s+fix|Proposed\s+fix|Suggested\s+patch|💡\s*Proposed|🔧\s*Suggested|🐛\s*Proposed|♻️\s*Proposed)[^<]*</summary>(.*?)</details>}is) {
$fix = $1;
sub collect_from_html {
my ($chunk) = @_;
my @events;
while ($chunk =~ m{<details[^>]*>\s*<summary[^>]*>([^<]*)</summary>([\s\S]*?)</details>}gi) {
my $k = summary_kind($1);
next if $k eq '';
push @events, { kind => $k, body => $2 };
}
if ($chunk =~ m{<details[^>]*>\s*<summary[^>]*>[^<]*(?:🤖\s*)?Prompt for AI Agents[^<]*</summary>(.*?)</details>}is) {
$prompt = $1;
return '' unless @events;
my @out;
my $i = 0;
while ($i < @events) {
if ($events[$i]{kind} eq 'fix') {
my $f = $events[$i]{body};
my $p = '';
if ($i + 1 < @events && $events[$i + 1]{kind} eq 'prompt') {
$p = $events[$i + 1]{body};
$i += 2;
} else {
$i += 1;
}
my $blk = flush_finding($f, $p);
push @out, $blk if $blk =~ /\S/;
} elsif ($events[$i]{kind} eq 'prompt') {
my $blk = flush_finding('', $events[$i]{body});
push @out, $blk if $blk =~ /\S/;
$i += 1;
} else {
$i += 1;
}
}
return join("\n---\n\n", grep { /\S/ } @out);
}

if ($fix eq '') {
if ($chunk =~ m{(?:Suggested\s+fix|Proposed\s+fix).*?```(?:diff)?\s*\n?([\s\S]*?)```}is) {
$fix = $1;
}
sub collect_from_md {
my ($chunk) = @_;
my @fixes;
while ($chunk =~ m{(?:Suggested\s+fix|Proposed\s+fix).*?```(?:diff)?\s*\n?([\s\S]*?)```}ig) {
push @fixes, $1;
}
if ($prompt eq '') {
if ($chunk =~ m{Prompt\s+for\s+AI\s+Agents.*?```(?:\s*\n)?([\s\S]*?)```}is) {
$prompt = $1;
}
my @prompts;
while ($chunk =~ m{Prompt\s+for\s+AI\s+Agents.*?```(?:\s*\n)?([\s\S]*?)```}ig) {
push @prompts, $1;
}
return '' unless @fixes || @prompts;
my $max = $#fixes > $#prompts ? $#fixes : $#prompts;
my @out;
for my $i (0 .. $max) {
my $f = $fixes[$i] // '';
my $p = $prompts[$i] // '';
my $blk = flush_finding($f, $p);
push @out, $blk if $blk =~ /\S/;
}
return join("\n---\n\n", grep { /\S/ } @out);
}

my @parts = split(/\n\n---\n\n/, $input);
my @blocks;

for my $chunk (@parts) {
next unless $chunk =~ /\S/;
my $piece = '';
$piece .= format_block('Suggested fix', $fix) if $fix ne '';
$piece .= format_block('Prompt for AI Agents', $prompt) if $prompt ne '';
if ($chunk =~ /<details/i) {
$piece = collect_from_html($chunk);
}
if ($piece !~ /\S/) {
my $md = collect_from_md($chunk);
$piece = $md if $md =~ /\S/;
}
push @blocks, $piece if $piece =~ /\S/;
}

Expand Down
10 changes: 10 additions & 0 deletions backend/src/app.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,16 @@ app.get('/smoke', (req, res) => {
res.json({ status: 'ok', timestamp: new Date().toISOString(), marker: crSmokeModuleMarker() });
});

// Smoke-only wrong patterns for CodeRabbit review (remove after automation check).
const CR_SMOKE_FAKE_TOKEN = 'smoke-hardcoded-not-a-real-secret';

app.get('/cr-smoke-auth-demo', (req, res) => {
if (req.query.token == CR_SMOKE_FAKE_TOKEN) {
return res.json({ ok: true, data: req.query.payload });
}
res.status(401).json({ ok: false });
});
Comment on lines +39 to +46

@coderabbitai coderabbitai Bot May 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Remove the hardcoded token and stop authenticating via req.query.

This adds a credential to source control and accepts it from the URL, which is easy to leak through logs, browser history, and proxies. If this route must exist, load the token through backend/src/config/env.js and read it from a header instead; otherwise remove or non-prod-gate the endpoint.

As per coding guidelines, backend/src/**/*.{js,ts}: Backend source code must not contain hardcoded credentials, Shopify webhook secrets, or database passwords (must use env variables and config/env.js patterns).

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@backend/src/app.js` around lines 39 - 46, The route defines a hardcoded
credential CR_SMOKE_FAKE_TOKEN and authenticates using req.query.token (in the
handler for '/cr-smoke-auth-demo'), which must be removed; instead load the
secret from your env config (use the existing backend/src/config/env.js pattern)
and validate a header (e.g., Authorization or a custom X- header) on the
'/cr-smoke-auth-demo' handler, or remove/non-prod-gate the endpoint entirely;
update the handler logic that currently checks req.query.token to pull the
secret from the config and compare against req.get('Your-Header-Name') (and
ensure the config key name is added to env.js and .env as appropriate).


app.use(notFoundHandler);
app.use(errorHandler);

Expand Down
7 changes: 7 additions & 0 deletions backend/src/routes/index.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,13 @@ router.get('/test', (req, res) => {
res.status(200).json({ message: 'Test route is working' });
});

// Smoke-only: string concat instead of numeric add (wrong for "1"+"2" expectation).
router.get('/cr-smoke-sum', (req, res) => {
const a = req.query.a;
const b = req.query.b;
res.json({ sum: a + b });
});
Comment on lines +15 to +19

@coderabbitai coderabbitai Bot May 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Parse and validate the operands before returning sum.

This endpoint currently returns the wrong result for numeric inputs: ?a=1&b=2 yields "12", and missing params can produce junk like "undefined2". Coerce both inputs to numbers and reject non-numeric values with 400 before adding them.

Suggested fix 
 router.get('/cr-smoke-sum', (req, res) => {
-  const a = req.query.a;
-  const b = req.query.b;
-  res.json({ sum: a + b });
+  const a = Number(req.query.a);
+  const b = Number(req.query.b);
+
+  if (!Number.isFinite(a) || !Number.isFinite(b)) {
+    return res.status(400).json({
+      success: false,
+      message: 'Query params a and b must be numbers',
+    });
+  }
+
+  res.json({ sum: a + b });
 });
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
router.get('/cr-smoke-sum', (req, res) => {
const a = req.query.a;
const b = req.query.b;
res.json({ sum: a + b });
});
router.get('/cr-smoke-sum', (req, res) => {
const a = Number(req.query.a);
const b = Number(req.query.b);
if (!Number.isFinite(a) || !Number.isFinite(b)) {
return res.status(400).json({
success: false,
message: 'Query params a and b must be numbers',
});
}
res.json({ sum: a + b });
});
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@backend/src/routes/index.js` around lines 15 - 19, The handler for
router.get('/cr-smoke-sum') currently concatenates strings; coerce req.query.a
and req.query.b to numbers (e.g., via Number(...) or parseFloat), validate both
are finite numbers (reject NaN/Infinity) and return res.status(400).json({
error: 'invalid operands' }) for bad inputs; otherwise compute numericSum = aNum
+ bNum and return res.json({ sum: numericSum }); update the anonymous route
callback in index.js accordingly.


router.use('/webhooks', webhookRoutes);
router.use('/orders', orderRoutes);
router.use('/printers', printerRoutes);
Expand Down
Loading