Repository navigation
Conversation
|
Warning Review limit reached
More reviews will be available in 41 minutes and 1 second. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (5)
📝 WalkthroughResumen generalSe implementa una validación de fortaleza de secretos en configuración de entorno, se introduce un módulo de utilidades de contraseña que encapsula bcrypt con validaciones, y se refactorizan los controladores de sesión hacia patrón middleware con manejo centralizado de errores y respuestas normalizadas. CambiosValidación de secretos y utilidades de contraseña con refactor de sesión
Diagramas de secuenciasequenceDiagram
participant Cliente
participant login as login()
participant verifyPassword as verifyPassword()
participant jwt as jwt.verify()
participant BD as Prisma
participant ManejadorErrores as next(error)
Cliente->>login: POST email, password
login->>login: Valida email/password
login->>BD: findFirst(email, status: true)
BD-->>login: usuario o null
alt Usuario no existe
login->>ManejadorErrores: UnauthorizedError
else Usuario existe
login->>verifyPassword: plainPassword, hashedPassword
verifyPassword-->>login: boolean
alt Contraseña inválida
login->>ManejadorErrores: UnauthorizedError
else Contraseña válida
login->>jwt: sign({id_user, email, role}, JWT_SECRET, 30m)
jwt-->>login: token
login->>Cliente: success: true, user, cookie httpOnly
end
end
Estimación de esfuerzo de revisión🎯 3 (Moderato) | ⏱️ ~22 minutos PRs posiblemente relacionadas
Revisores sugeridos
Poema
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/config/env.config.js`:
- Around line 16-27: The validateSecretStrength function currently measures
secret.length without normalizing, so a secret of only spaces can pass; change
it to trim the secret (e.g., const normalized = secret == null ? '' :
secret.trim()) and use normalized.length for the minLength check, and explicitly
reject empty or whitespace-only secrets by throwing an Error (not just a
warning) with the same messaging for production; update any occurrences of
secret.length in validateSecretStrength to use the normalized value and ensure
null/undefined inputs are handled.
In `@src/lib/utils/password.utils.js`:
- Around line 51-55: The current catch in the bcrypt.compare call swallows
operational errors and returns false (causing a 401 downstream); update the
catch in src/lib/utils/password.utils.js (the bcrypt.compare(...) call) to
rethrow the original error (or throw a wrapped error preserving the original)
instead of returning false so real failures propagate to the global
errorHandler; keep returning false only when bcrypt.compare resolves to false
(password mismatch), not on exceptions.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: b05bcc82-cf50-4fa8-a13a-1ac7b1125175
📒 Files selected for processing (3)
src/config/env.config.jssrc/lib/utils/password.utils.jssrc/modules/session/controllers/session.controllers.js
|
2 participants
Summary by CodeRabbit
Release Notes
Bug Fixes
Security