[PROD RELEASE] - Q2 #823

kkartunov · 2025-06-17T06:13:58Z

QA bug fixes
Copilot Portal

fix(PM-1077): permission issue to delete copilot invite

PM-589 add migration for fixing copilot request model

github-actions · 2025-06-17T06:15:14Z

src/models/projectMemberInvite.js

@@ -55,6 +65,14 @@ module.exports = function defineProjectMemberInvite(sequelize, DataTypes) {
    raw: true,
  });

+  ProjectMemberInvite.getPendingInvitesForApplication = applicationId => ProjectMemberInvite.findAll({


Consider adding input validation for applicationId to ensure it is of the expected type and format before querying the database.

github-actions · 2025-06-17T06:15:14Z

src/models/projectMemberInvite.js

+  ProjectMemberInvite.getPendingInvitesForApplication = applicationId => ProjectMemberInvite.findAll({
+    where: {
+      applicationId,
+      status: INVITE_STATUS.PENDING,


Ensure that INVITE_STATUS.PENDING is defined and imported correctly. If it's a constant, verify its source and usage.

github-actions · 2025-06-17T06:15:18Z

src/permissions/constants.js

+
+  LIST_COPILOT_OPPORTUNITY: {
+    meta: {
+      title: 'Apply copilot opportunity',


The title for LIST_COPILOT_OPPORTUNITY seems to be incorrect as it duplicates the title from APPLY_COPILOT_OPPORTUNITY. Consider changing it to something more appropriate like 'List copilot opportunities'.

github-actions · 2025-06-17T06:15:18Z

src/permissions/constants.js

+    meta: {
+      title: 'Apply copilot opportunity',
+      group: 'Apply Copilot',
+      description: 'Who can apply for copilot opportunity.',


The description for LIST_COPILOT_OPPORTUNITY is identical to the one for APPLY_COPILOT_OPPORTUNITY. It might be more accurate to describe what listing copilot opportunities entails.

github-actions · 2025-06-17T06:15:20Z

src/permissions/constants.js

@@ -599,6 +638,7 @@ export const PERMISSION = { // eslint-disable-line import/prefer-default-export
    topcoderRoles: [
      ...TOPCODER_ROLES_ADMINS,
      USER_ROLE.COPILOT_MANAGER,
+      USER_ROLE.PROJECT_MANAGER,


Consider verifying if the addition of USER_ROLE.PROJECT_MANAGER to topcoderRoles is necessary for the intended functionality, as it might affect permissions and access control.

github-actions · 2025-06-17T06:15:24Z

src/permissions/copilotApplications.view.js

+ * @return {Promise}              Returns a promise
+ */
+module.exports = freq => new Promise((resolve, reject) => {
+  const opportunityId = _.parseInt(freq.params.id);


Consider adding validation to ensure freq.params.id is a valid number before using _.parseInt. This could prevent potential issues if the parameter is not a number.

github-actions · 2025-06-17T06:15:24Z

src/permissions/copilotApplications.view.js

+ */
+module.exports = freq => new Promise((resolve, reject) => {
+  const opportunityId = _.parseInt(freq.params.id);
+  const currentUserId = freq.authUser.userId;


Ensure that freq.authUser and freq.authUser.userId are defined before accessing userId. This will prevent runtime errors if authUser is undefined.

github-actions · 2025-06-17T06:15:24Z

src/permissions/copilotApplications.view.js

+module.exports = freq => new Promise((resolve, reject) => {
+  const opportunityId = _.parseInt(freq.params.id);
+  const currentUserId = freq.authUser.userId;
+  return models.CopilotOpportunity.findOne({


Consider adding error handling for the findOne operation. If the database query fails, it should be handled gracefully.

github-actions · 2025-06-17T06:15:24Z

src/permissions/copilotApplications.view.js

+      req.context.currentOpportunity = opportunity;
+      const isProjectManager = util.hasProjectManagerRole(req);
+
+      return models.CopilotApplication.findOne({


Similar to the previous comment, add error handling for this findOne operation to manage potential database query failures.

github-actions · 2025-06-17T06:15:24Z

src/permissions/copilotApplications.view.js

+        // user is not an admin nor is a registered project member
+        return reject(new Error(errorMessage));
+      }
+      return resolve(true);


Consider adding a catch block at the end of the promise chain to handle any unexpected errors that might occur during the execution of the promise.

github-actions · 2025-06-17T06:15:28Z

src/permissions/index.js

@@ -199,4 +200,7 @@ module.exports = () => {
  Authorizer.setPolicy('customerPayment.view', generalPermission(PERMISSION.VIEW_CUSTOMER_PAYMENT));
  Authorizer.setPolicy('customerPayment.edit', generalPermission(PERMISSION.UPDATE_CUSTOMER_PAYMENT));
  Authorizer.setPolicy('customerPayment.confirm', customerPaymentConfirm);
+
+  // Copilot opportunity


The comment // Copilot opportunity could be more descriptive to clarify the purpose of the policy being set for copilotApplications.view. Consider providing a more detailed explanation in the code logic or documentation.

github-actions · 2025-06-17T06:15:31Z

src/routes/copilotOpportunity/assign.js

+import { PERMISSION } from '../../permissions/constants';
+import { COPILOT_APPLICATION_STATUS, COPILOT_OPPORTUNITY_STATUS, COPILOT_REQUEST_STATUS, EVENT, INVITE_STATUS, PROJECT_MEMBER_ROLE, RESOURCES } from '../../constants';
+
+const assignCopilotOpportunityValidations = {


The validation schema for applicationId should include a required() constraint to ensure that this field is always provided in the request body.

github-actions · 2025-06-17T06:15:31Z

src/routes/copilotOpportunity/assign.js

+  validate(assignCopilotOpportunityValidations),
+  async (req, res, next) => {
+    const { applicationId } = req.body;
+    const copilotOpportunityId = _.parseInt(req.params.id);


Consider adding a check to ensure applicationId is not null or undefined before proceeding, to prevent potential runtime errors.

github-actions · 2025-06-17T06:15:31Z

src/routes/copilotOpportunity/assign.js

+      return next(err);
+    }
+
+    return models.sequelize.transaction(async (t) => {


Consider adding a try-catch block around the transaction to handle any unexpected errors that might occur during the transaction process.

github-actions · 2025-06-17T06:15:31Z

src/routes/copilotOpportunity/assign.js

+      }, {
+        transaction: t,
+      })
+


Missing semicolon at the end of the statement. Ensure consistent use of semicolons throughout the code.

github-actions · 2025-06-17T06:15:36Z

src/routes/copilotOpportunityApply/create.js

+  async (req, res, next) => {
+    const { notes } = req.body;
+    const copilotOpportunityId = _.parseInt(req.params.id);
+    if (!util.hasPermissionByReq(PERMISSION.APPLY_COPILOT_OPPORTUNITY, req)) {


Consider checking if req.params.id is defined before parsing it with _.parseInt. This will help avoid potential errors if id is not provided.

github-actions · 2025-06-17T06:15:36Z

src/routes/copilotOpportunityApply/create.js

+      createdBy: req.authUser.userId,
+      updatedBy: req.authUser.userId,
+      opportunityId: copilotOpportunityId,
+      notes: notes ? req.sanitize(notes) : null,


Ensure that req.sanitize is properly defined and implemented to avoid any security vulnerabilities related to input sanitization.

github-actions · 2025-06-17T06:15:36Z

src/routes/copilotOpportunityApply/create.js

+      });
+
+      if (existingApplication) {
+        res.status(200).json(existingApplication);


Returning the existing application with a 200 status code might not be appropriate if the intention is to indicate that the application already exists. Consider using a different status code or providing additional context in the response.

github-actions · 2025-06-17T06:15:36Z

src/routes/copilotOpportunityApply/create.js

+
+          const emailEventType = CONNECT_NOTIFICATION_EVENT.EXTERNAL_ACTION_EMAIL;
+          const copilotPortalUrl = config.get('copilotPortalUrl');
+          listOfSubjects.forEach((subject) => {


Consider handling potential errors in the listOfSubjects.forEach loop, especially if createEvent fails for any subject. This will help ensure that the application process is robust and can handle failures gracefully.

github-actions · 2025-06-17T06:15:40Z

src/routes/copilotOpportunityApply/list.js

+  (req, res, next) => {
+    const canAccessAllApplications = util.hasRoles(req, ADMIN_ROLES) || util.hasProjectManagerRole(req);
+    const userId = req.authUser.userId;
+    const opportunityId = _.parseInt(req.params.id);


Consider adding validation to ensure req.params.id is a valid integer before using _.parseInt to prevent unexpected behavior if the parameter is not a number.

github-actions · 2025-06-17T06:15:40Z

src/routes/copilotOpportunityApply/list.js

+    }
+    const sortableProps = ['createdAt asc', 'createdAt desc'];
+    if (_.indexOf(sortableProps, sort) < 0) {
+      return util.handleError('Invalid sort criteria', null, req, next);


The util.handleError function is called with null as the second argument. Ensure this is intentional and that the function can handle null appropriately.

github-actions · 2025-06-17T06:15:40Z

src/routes/copilotOpportunityApply/list.js

+          as: 'copilotOpportunity',
+        },
+      ],
+      order: [[sortParams[0], sortParams[1]]],


The order array uses sortParams directly from user input. Consider validating sortParams further to prevent potential SQL injection or unexpected behavior.

github-actions · 2025-06-17T06:15:42Z

src/routes/copilotRequest/approveRequest.js

@@ -35,7 +35,7 @@ module.exports = [
      updatedBy: req.authUser.userId,
    });

-    return approveRequest(data)
+    return approveRequest(req, data)


The approveRequest function signature has been changed to include req as a parameter. Ensure that the approveRequest function definition and its internal logic are updated accordingly to handle the req parameter.

github-actions · 2025-06-17T06:15:46Z

src/routes/copilotRequest/approveRequest.service.js

@@ -11,7 +14,7 @@ const resolveTransaction = (transaction, callback) => {
  return models.sequelize.transaction(callback);
 };

-module.exports = (data, existingTransaction) => {
+module.exports = (req, data, existingTransaction) => {


The function signature has been changed to include a new parameter req. Ensure that this parameter is used within the function or is necessary for future use. If not, consider removing it to maintain clean code.

github-actions · 2025-06-17T06:15:49Z

src/routes/copilotRequest/approveRequest.service.js

@@ -52,6 +55,29 @@ module.exports = (data, existingTransaction) => {
                return models.CopilotOpportunity
                  .create(data, { transaction });
              }))
+              .then(async (opportunity) => {
+                const roles = await util.getRolesByRoleName(USER_ROLE.TC_COPILOT, req.log, req.id);


Consider adding error handling for the getRolesByRoleName function call to ensure that any issues retrieving roles are properly managed.

github-actions · 2025-06-17T06:15:49Z

src/routes/copilotRequest/approveRequest.service.js

@@ -52,6 +55,29 @@ module.exports = (data, existingTransaction) => {
                return models.CopilotOpportunity
                  .create(data, { transaction });
              }))
+              .then(async (opportunity) => {
+                const roles = await util.getRolesByRoleName(USER_ROLE.TC_COPILOT, req.log, req.id);
+                const { subjects = [] } = await util.getRoleInfo(roles[0], req.log, req.id);


Check if roles array is empty before accessing roles[0] to avoid potential runtime errors.

github-actions · 2025-06-17T06:15:49Z

src/routes/copilotRequest/approveRequest.service.js

+                const emailEventType = CONNECT_NOTIFICATION_EVENT.EXTERNAL_ACTION_EMAIL;
+                const copilotPortalUrl = config.get('copilotPortalUrl');
+                req.log.info("Sending emails to all copilots about new opportunity");
+                subjects.forEach(subject => {


Consider adding a check to ensure subjects is not empty before iterating over it to prevent unnecessary operations.

github-actions · 2025-06-17T06:15:49Z

src/routes/copilotRequest/approveRequest.service.js

+                const copilotPortalUrl = config.get('copilotPortalUrl');
+                req.log.info("Sending emails to all copilots about new opportunity");
+                subjects.forEach(subject => {
+                  createEvent(emailEventType, {


The createEvent function call should include error handling to manage any potential failures in sending emails.

github-actions · 2025-06-17T06:15:52Z

src/routes/copilotRequest/create.js

@@ -98,7 +98,7 @@ module.exports = [
              updatedBy: req.authUser.userId,
              type: copilotRequest.data.projectType,
            });
-            return approveRequest(approveData, transaction).then(() => copilotRequest);
+            return approveRequest(req, approveData, transaction).then(() => copilotRequest);


The approveRequest function now takes req as an additional parameter. Ensure that the function definition and implementation of approveRequest are updated accordingly to handle this new parameter. Also, verify that req is necessary for the function's logic and that it is used appropriately within the function.

github-actions · 2025-06-17T06:15:55Z

src/routes/copilotRequest/list.js

@@ -1,7 +1,6 @@
 import _ from 'lodash';

 import models from '../../models';
-import { ADMIN_ROLES } from '../../constants';
 import util from '../../util';


The import statement for ADMIN_ROLES has been removed. Ensure that this removal is intentional and that ADMIN_ROLES is not used elsewhere in the code, as this could lead to runtime errors if it is still needed.

github-actions · 2025-06-17T06:15:59Z

src/routes/copilotRequest/list.js

-      isAdmin ? {} : { createdBy: userId },
-      projectId ? { projectId } : {},
-    );
+    const whereCondition = projectId ? { projectId } : {};


The removal of the createdBy condition means that now all users, not just admins, can see all requests if a projectId is not specified. If this change is intentional, ensure that it aligns with the desired access control policies. Otherwise, consider re-implementing the logic to restrict visibility based on user roles.

github-actions · 2025-06-17T06:16:02Z

src/routes/index.js

-  `/${apiVersion}/projects/copilots/opportunities`,
-  `/${apiVersion}/projects/copilot/opportunities/:id(\\d+)`,
+  new RegExp(`^/${apiVersion}/projects/copilots/opportunities$`),
+  new RegExp(`^/${apiVersion}/projects/copilot/opportunity/\\d+$`),


The regex pattern for the copilot opportunity endpoint has been changed from opportunities/:id(\\d+) to opportunity/\\d+. Ensure that this change is intentional and that the endpoint is correctly updated in other parts of the application to reflect this singular form and pattern.

github-actions · 2025-06-17T06:16:04Z

src/routes/index.js

@@ -35,7 +35,7 @@ const jwtAuth = require('tc-core-library-js').middleware.jwtAuthenticator;
 router.all(
  RegExp(`\\/${apiVersion}\\/(copilots|projects|timelines|orgConfig|customer-payments)(?!\\/health).*`),
  (req, res, next) => {
-    if (publicRoutes.some(route => req.path.match(new RegExp(`^${route}$`)))) {
+    if (publicRoutes.some(routeRegex => routeRegex.test(req.path))) {


Consider renaming routeRegex to routePattern for clarity, as it represents a regex pattern rather than a specific route.

github-actions · 2025-06-17T06:16:09Z

src/routes/projectMemberInvites/create.js

  req.log.debug(req.authUser);
-  const emailEventType = CONNECT_NOTIFICATION_EVENT.PROJECT_MEMBER_EMAIL_INVITE_CREATED;
+  const emailEventType = CONNECT_NOTIFICATION_EVENT.EXTERNAL_ACTION_EMAIL;


The change from CONNECT_NOTIFICATION_EVENT.PROJECT_MEMBER_EMAIL_INVITE_CREATED to CONNECT_NOTIFICATION_EVENT.EXTERNAL_ACTION_EMAIL should be verified to ensure it aligns with the intended functionality. This change may affect the type of email notification sent, so please confirm that this is the desired behavior.

github-actions · 2025-06-17T06:16:13Z

src/routes/projectMemberInvites/create.js

@@ -237,13 +238,9 @@ const sendInviteEmail = (req, projectId, invite) => {
          ],
        }],
      },
+      sendgrid_template_id: TEMPLATE_IDS.PROJECT_MEMBER_INVITED,


The sendgrid_template_id is being added here. Ensure that TEMPLATE_IDS.PROJECT_MEMBER_INVITED is defined and correctly set up in your configuration to avoid runtime errors.

github-actions · 2025-06-17T06:16:13Z

src/routes/projectMemberInvites/create.js

@@ -237,13 +238,9 @@ const sendInviteEmail = (req, projectId, invite) => {
          ],
        }],
      },
+      sendgrid_template_id: TEMPLATE_IDS.PROJECT_MEMBER_INVITED,
      recipients: [invite.email],


The recipients field is correctly set to invite.email. Ensure that invite.email is validated and sanitized to prevent any potential security issues.

github-actions · 2025-06-17T06:16:13Z

src/routes/projectMemberInvites/create.js

@@ -237,13 +238,9 @@ const sendInviteEmail = (req, projectId, invite) => {
          ],
        }],
      },
+      sendgrid_template_id: TEMPLATE_IDS.PROJECT_MEMBER_INVITED,
      recipients: [invite.email],
      version: 'v3',


The from field has been removed. Verify that the email sending service has a default sender configured, or ensure that the removal of this field does not affect the email delivery.

github-actions · 2025-06-17T06:16:13Z

src/routes/projectMemberInvites/create.js

-        name: config.get('EMAIL_INVITE_FROM_NAME'),
-        email: config.get('EMAIL_INVITE_FROM_EMAIL'),
-      },
-      categories: [`${process.env.NODE_ENV}:${emailEventType}`.toLowerCase()],
    }, req.log);
  }).catch((error) => {
    req.log.error(error);


Consider adding more detailed error handling or logging to capture specific error scenarios that might occur during the email sending process.

github-actions · 2025-06-17T06:16:17Z

src/routes/projectMemberInvites/create.js

@@ -295,13 +292,12 @@ module.exports = [
    // whom we are inviting, because Member Service has a loose search logic and may return
    // users with handles whom we didn't search for
      .then((foundUsers) => {
-        if(invite.handles) {
+        if (invite.handles) {
          const lowerCaseHandles = invite.handles.map(handle => handle.toLowerCase());
          return foundUsers.filter(foundUser => _.includes(lowerCaseHandles, foundUser.handleLower));
        }


Consider using consistent formatting for the if statement. The opening brace should be on the same line as the if condition, as per common JavaScript style guides.

github-actions · 2025-06-17T06:16:17Z

src/routes/projectMemberInvites/create.js

-          return []
-        }
+
+        return [];


Ensure consistent use of semicolons throughout the code. The addition of a semicolon here is good, but verify that all statements in the file follow this convention for consistency.

github-actions · 2025-06-17T06:16:19Z

src/routes/projectMemberInvites/create.js

+                      Object.assign({}, v.toJSON(), {
+                        source: 'work_manager',
+                      }),
+                     );


There is an extra comma at the end of the Object.assign call. Ensure that the formatting is consistent with the rest of the codebase.

github-actions · 2025-06-17T06:16:25Z

src/routes/projectMemberInvites/delete.js

@@ -74,14 +74,31 @@ module.exports = [
          .update({
            status: INVITE_STATUS.CANCELED,
          })
-          .then((updatedInvite) => {
+          .then(async (updatedInvite) => {


The use of async in the .then() function suggests that there might be an await operation inside this function. Please ensure that any asynchronous operations are properly handled within this block. If there are no await operations, consider removing async to avoid unnecessary complexity.

github-actions · 2025-06-17T06:16:28Z

src/routes/projectMemberInvites/delete.js

            // emit the event
            util.sendResourceToKafkaBus(
              req,
              EVENT.ROUTING_KEY.PROJECT_MEMBER_INVITE_REMOVED,
              RESOURCES.PROJECT_MEMBER_INVITE,
              updatedInvite.toJSON());

+              // update the application if the invite
+              // originated from copilot opportunity
+              if (invite.applicationId) {


Consider adding error handling for the case where invite.applicationId is not found or getPendingInvitesForApplication fails. This will help prevent potential runtime errors.

github-actions · 2025-06-17T06:16:28Z

src/routes/projectMemberInvites/delete.js

+                const allPendingInvitesForApplication = await models.ProjectMemberInvite.getPendingInvitesForApplication(invite.applicationId);
+                // If only the current invite is the open one's
+                // then the application status has to be moved to pending status
+                if (allPendingInvitesForApplication.length === 0) {


The condition allPendingInvitesForApplication.length === 0 might be incorrect if getPendingInvitesForApplication returns an array with the current invite included. Ensure that the logic correctly identifies when there are no other pending invites.

github-actions · 2025-06-17T06:16:30Z