Repository navigation
Feature/t151 integrate approval buttons UI - #42
Conversation
|
Warning Review limit reached
Next review available in: 37 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughChangesLuồng phê duyệt phiếu xuất
Estimated code review effort: 4 (Complex) | ~60 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/components/DataTable.vue`:
- Around line 27-32: Thêm prop Boolean `clickable` với giá trị mặc định `false`
cho component DataTable, rồi chỉ áp dụng class `clickable-row` và xử lý `@click`
trong vòng lặp `<tr>` khi prop này được bật. Giữ nguyên việc emit `row-click` và
trạng thái hiển thị không tương tác mặc định khi `clickable` là `false`.
In `@src/components/StockOutApprovalDetail.vue`:
- Around line 75-78: Trong luồng xử lý duyệt của StockOutApprovalDetail, bỏ lời
gọi loadDetail() sau approveExportReceipt(). Gán kết quả receipt đã normalize từ
approveExportReceipt() vào receipt.value, rồi lấy mã phiếu từ kết quả đó để tạo
actionMessage, giữ nguyên fallback về props.receiptId khi cần.
In `@src/router/index.js`:
- Line 69: Keep the ADMIN/MANAGER frontend guard for /pending-export-approvals
as a UX-only restriction, and ensure backend authorization independently
validates these roles for GET /api/export-receipts/pending-approval and PUT
/api/export-receipts/:id/approve on every request; do not treat the route guard
as a security boundary.
In `@src/services/stockOutApprovalService.js`:
- Around line 6-11: Configure a finite timeout on the Axios instance created as
exportReceiptClient, using the project’s established timeout constant or an
appropriate bounded duration. Keep the existing baseURL and headers unchanged so
requests such as approveExportReceipt cannot wait indefinitely.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 7c541f87-95ff-4021-8f79-e228762b36a7
📒 Files selected for processing (7)
src/components/AppSidebar.vuesrc/components/DataTable.vuesrc/components/StockOutApprovalDetail.vuesrc/router/index.jssrc/services/stockOutApprovalService.jssrc/views/PendingExportApprovalsView.vuesrc/views/StockDocumentDetailView.vue
| function canAccessRoute(path, role) { | ||
| if (path === '/employees' || path === '/users') return role === 'ADMIN' | ||
| if (path === '/approvals') return role === 'ADMIN' || role === 'MANAGER' | ||
| if (path === '/approvals' || path === '/pending-export-approvals') return role === 'ADMIN' || role === 'MANAGER' |
There was a problem hiding this comment.
🔒 Security & Privacy | 🔵 Trivial
Frontend guard chỉ hỗ trợ UX, không thay thế authorization backend.
Phân quyền ADMIN/MANAGER cho /pending-export-approvals đúng theo luồng duyệt. Tuy nhiên, route guard ở frontend chỉ ẩn/hiện trang để UX tốt hơn — backend vẫn phải kiểm tra quyền trên mỗi API (GET /api/export-receipts/pending-approval, PUT /api/export-receipts/:id/approve). Nếu backend không kiểm tra, user có thể gọi API trực tiếp bỏ qua guard.
As per path instructions: "Nhắc rõ frontend guard chỉ hỗ trợ UX, không thay thế authorization ở backend."
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/router/index.js` at line 69, Keep the ADMIN/MANAGER frontend guard for
/pending-export-approvals as a UX-only restriction, and ensure backend
authorization independently validates these roles for GET
/api/export-receipts/pending-approval and PUT /api/export-receipts/:id/approve
on every request; do not treat the route guard as a security boundary.
Source: Path instructions
|
@coderabbitai review |
✅ Action performedReview finished.
|
e3d244c to
df46945
Compare
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/components/AppSidebar.vue`:
- Around line 27-35: Update the visibleItems computed in AppSidebar to derive
the role from the reactive useAuthStore state, using currentRole or currentUser
instead of getCurrentRoleCode(). Preserve the existing ADMIN, MANAGER, and
approval visibility rules while ensuring the list recomputes after login,
logout, or account changes.
In `@src/router/index.js`:
- Around line 67-72: Update canAccessRoute to add an explicit /import-excel
check that permits only the ADMIN role, before the fallback return true. Keep
all existing route rules unchanged.
In `@src/views/PendingExportApprovalsView.vue`:
- Around line 167-182: Cập nhật thuộc tính :disabled của các nút phân trang
trong PendingExportApprovalsView để kết hợp isLoading với hasPreviousPage và
hasNextPage tương ứng, đảm bảo cả hai nút bị vô hiệu hóa trong khi dữ liệu đang
tải.
- Around line 209-211: Update the empty-state text in PendingExportApprovalsView
so it instructs users to click the request code to open the quick detail view,
rather than implying that clicking any row opens quick details. Preserve the
existing behavior where clicking a row uses goToDetail for page navigation.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 579bf999-ecc0-4137-8f94-7ab0f1cb5daa
📒 Files selected for processing (7)
src/components/AppSidebar.vuesrc/components/DataTable.vuesrc/components/StockOutApprovalDetail.vuesrc/router/index.jssrc/services/stockOutApprovalService.jssrc/views/PendingExportApprovalsView.vuesrc/views/StockDocumentDetailView.vue
2 participants
check và merge code giúp tui nha
Summary by CodeRabbit