Sprint 13.2: Implement YARP API Gateway, migrate geoblocking, and cleanup ApiService#219
Merged
Sprint 13.2: Implement YARP API Gateway, migrate geoblocking, and cleanup ApiService#219
Conversation
Contributor
|
Warning Rate limit exceeded
To keep reviews running without waiting, you can enable usage-based add-on for your organization. This allows additional reviews beyond the hourly cap. Account admins can enable it under billing. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughAdiciona um projeto API Gateway (YARP) com resiliência, CORS, rate limiting e edge auth; move/centraliza middlewares de rate limiting e restrição geográfica para camada Shared; atualiza wiring do AppHost para usar o gateway, remove validações/CORS antigas do ApiService e cria testes para Gateway. Changes
Sequence Diagram(s)sequenceDiagram
participant Cliente
participant Gateway
participant Keycloak
participant Cache
participant ApiService
Cliente->>Gateway: Requisição /api/... (token opcional)
Gateway->>Keycloak: Validar JWT (issuer/audience/sign)
Keycloak-->>Gateway: Token válido/negado
Gateway->>Cache: Checar contador (IP / auth)
Cache-->>Gateway: Dentro do limite / excedeu
Gateway->>ApiService: Forward (X-Forwarded-For, X-Gateway-Name, timeout)
ApiService-->>Gateway: 200 OK / erro
Gateway-->>Cliente: Responde (CORS aplic., headers, 200/429/401/451)
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Review rate limit: 0/1 reviews remaining, refill in 37 minutes and 37 seconds.Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 6
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
src/Bootstrapper/MeAjudaAi.Gateway/Middlewares/GeographicRestrictionMiddleware.cs (1)
133-136:⚠️ Potential issue | 🟠 Major | ⚡ Quick win
FailOpennunca é aplicado aqui.Quando a localização não pode ser determinada, este branch sempre libera a requisição. Se a configuração vier com
FailOpen = false, a opção perde efeito e o gateway continua operando em fail-open.🛠️ Ajuste sugerido
if (string.IsNullOrEmpty(city) && string.IsNullOrEmpty(state)) { - logger.LogWarning("Geographic restriction: Could not determine user location, allowing access (fail-open)"); - return true; + if (options.CurrentValue.FailOpen) + { + logger.LogWarning("Geographic restriction: Could not determine user location, allowing access (fail-open)"); + return true; + } + + logger.LogWarning("Geographic restriction: Could not determine user location, rejecting request (fail-closed)"); + return false; }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@src/Bootstrapper/MeAjudaAi.Gateway/Middlewares/GeographicRestrictionMiddleware.cs` around lines 133 - 136, O branch que trata city/state nulos libera sempre a requisição; altere GeographicRestrictionMiddleware (no método que avalia city/state) para respeitar a opção FailOpen: ao não conseguir determinar localização, leia a configuração (ex.: options.FailOpen or _options.FailOpen) e, se for true, manter o comportamento atual (logger.LogWarning + return true), caso contrário faça logger.LogWarning/LogError apropriado e recuse a requisição (return false); garanta que as mensagens de log indiquem explicitamente o valor de FailOpen para facilitar debug.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@src/Aspire/MeAjudaAi.AppHost/Program.cs`:
- Around line 213-216: O gateway está sendo registrado apenas no fluxo de
desenvolvimento; mova ou duplique a criação do gateway para o caminho de
produção para manter a arquitetura consistente: instanciar o gateway via
builder.AddProject<Projects.MeAjudaAi_Gateway>("gateway") com
.WithReference(apiService), .WithExternalHttpEndpoints() e .WaitFor(apiService)
fora (ou também dentro) de ConfigureDevelopmentEnvironment de modo que tanto
ambientes de desenvolvimento quanto produção registrem o mesmo gateway e
dependência do apiService.
In
`@src/Bootstrapper/MeAjudaAi.Gateway/Middlewares/GeographicRestrictionMiddleware.cs`:
- Around line 56-58: The default block message and allowed-regions fallback are
in English; update GeographicRestrictionMiddleware so
GetAllowedRegionsDescription() returns Portuguese descriptions and change the
fallback template used from options.CurrentValue.BlockedMessage to a Portuguese
string (e.g., "Acesso da sua região não permitido. Regiões permitidas:
{allowedRegions}.") before performing template.Replace; also review and apply
the same PT-BR fallback change for the other occurrences noted (around the logic
at lines handling 204-206) so all user-facing payloads from this middleware are
consistently Portuguese.
- Around line 184-187: A lógica dentro de GeographicRestrictionMiddleware está
encerrando a busca ao encontrar a cidade igual mas com estado diferente; em vez
de "if (configCity.Equals(city...)) { if (!string.IsNullOrEmpty(state)) return
configState.Equals(state...); return true; }" altere para que, ao encontrar a
cidade igual, apenas retorne true se o estado também corresponder (ou se o
configState for vazio/wildcard); caso contrário continue a iterar pelos demais
itens de AllowedCities e só após terminar a iteração retorne false. Mantenha as
comparações StringComparison.OrdinalIgnoreCase e as variáveis (configCity,
configState, city, state, AllowedCities) para localizar onde aplicar a mudança.
- Around line 168-176: O branch que trata entradas apenas com "Cidade"
(variables citySpan and separatorIndex) só autoriza quando state está vazio ou
está presente em options.CurrentValue.AllowedStates, o que faz "Linhares"
bloquear "Linhares|ES" se AllowedStates não estiver configurado; altere a lógica
dentro do bloco que compara configCityOnly com city (em
GeographicRestrictionMiddleware) para que, quando houver correspondência de
cidade, seja permitida se AllowedStates for nulo ou vazio, caso contrário exija
que state esteja presente em AllowedStates (usar AllowedStates?.Any(...) ?? true
ou equivalente) e mantenha a comparação case-insensitive com
StringComparison.OrdinalIgnoreCase.
- Around line 159-162: The current city-check branch in
GeographicRestrictionMiddleware returns true when
options.CurrentValue.AllowedCities is null, which bypasses AllowedStates;
instead remove the early "return true" and, inside the if (city) branch, first
try to validate against options.CurrentValue.AllowedCities when present and if
AllowedCities is null fall through to validate against
options.CurrentValue.AllowedStates (and only allow the request if the state
whitelist permits it); update the logic that references
options.CurrentValue.AllowedCities and options.CurrentValue.AllowedStates so
state-only restrictions are enforced when city whitelist is absent.
In `@src/Bootstrapper/MeAjudaAi.Gateway/Program.cs`:
- Line 17: A chamada
builder.Services.AddHttpClient<IGeographicValidationService,
IbgeGeographicValidationService>() está referenciando uma implementação
inexistente (IbgeGeographicValidationService) e causa erro de compilação;
corrija registrando a implementação correta ou adicionando/renomeando a classe
ausente: verifique a interface IGeographicValidationService e substitua
IbgeGeographicValidationService pelo nome da classe concreta existente (por
exemplo IbgeGeographicValidationServiceImpl) ou crie/implemente a classe
IbgeGeographicValidationService que implementa IGeographicValidationService e
aponte o registro para ela.
---
Outside diff comments:
In
`@src/Bootstrapper/MeAjudaAi.Gateway/Middlewares/GeographicRestrictionMiddleware.cs`:
- Around line 133-136: O branch que trata city/state nulos libera sempre a
requisição; altere GeographicRestrictionMiddleware (no método que avalia
city/state) para respeitar a opção FailOpen: ao não conseguir determinar
localização, leia a configuração (ex.: options.FailOpen or _options.FailOpen) e,
se for true, manter o comportamento atual (logger.LogWarning + return true),
caso contrário faça logger.LogWarning/LogError apropriado e recuse a requisição
(return false); garanta que as mensagens de log indiquem explicitamente o valor
de FailOpen para facilitar debug.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 48b56d50-3af7-4940-946f-cf9dbc890901
⛔ Files ignored due to path filters (1)
src/Bootstrapper/MeAjudaAi.Gateway/packages.lock.jsonis excluded by!**/packages.lock.json
📒 Files selected for processing (18)
Directory.Packages.propsMeAjudaAi.slnxdocs/roadmap.mdsrc/Aspire/MeAjudaAi.AppHost/MeAjudaAi.AppHost.csprojsrc/Aspire/MeAjudaAi.AppHost/Program.cssrc/Bootstrapper/MeAjudaAi.ApiService/Extensions/SecurityExtensions.cssrc/Bootstrapper/MeAjudaAi.ApiService/Extensions/ServiceCollectionExtensions.cssrc/Bootstrapper/MeAjudaAi.ApiService/Options/CorsOptions.cssrc/Bootstrapper/MeAjudaAi.ApiService/Options/GeographicRestrictionOptions.cssrc/Bootstrapper/MeAjudaAi.ApiService/Options/RateLimitOptions.cssrc/Bootstrapper/MeAjudaAi.ApiService/Program.cssrc/Bootstrapper/MeAjudaAi.Gateway/MeAjudaAi.Gateway.csprojsrc/Bootstrapper/MeAjudaAi.Gateway/Middlewares/GeographicRestrictionMiddleware.cssrc/Bootstrapper/MeAjudaAi.Gateway/Options/GeographicRestrictionOptions.cssrc/Bootstrapper/MeAjudaAi.Gateway/Program.cssrc/Bootstrapper/MeAjudaAi.Gateway/appsettings.jsontests/MeAjudaAi.ApiService.Tests/Unit/Middlewares/GeographicRestrictionMiddlewareTests.cstests/MeAjudaAi.ApiService.Tests/Unit/Middlewares/RateLimitingMiddlewareTests.cs
💤 Files with no reviewable changes (8)
- src/Bootstrapper/MeAjudaAi.ApiService/Program.cs
- src/Bootstrapper/MeAjudaAi.ApiService/Options/RateLimitOptions.cs
- src/Bootstrapper/MeAjudaAi.ApiService/Options/GeographicRestrictionOptions.cs
- src/Bootstrapper/MeAjudaAi.ApiService/Options/CorsOptions.cs
- tests/MeAjudaAi.ApiService.Tests/Unit/Middlewares/GeographicRestrictionMiddlewareTests.cs
- src/Bootstrapper/MeAjudaAi.ApiService/Extensions/ServiceCollectionExtensions.cs
- tests/MeAjudaAi.ApiService.Tests/Unit/Middlewares/RateLimitingMiddlewareTests.cs
- src/Bootstrapper/MeAjudaAi.ApiService/Extensions/SecurityExtensions.cs
Owner
Author
|
@coderabbitai o que acha da ideia deste pull request para arquitetura modular? Acha que vale a pena continuar a implementacao de um gateway usando YARP? |
Contributor
|
Tip For best results, initiate chat on the files or code changes.
✅ Por que vale a pena continuar com YARPYARP é a escolha certa para um stack .NET:
A decisão de centralizar no Gateway é correta:
|
Contributor
There was a problem hiding this comment.
Actionable comments posted: 6
🧹 Nitpick comments (1)
src/Bootstrapper/MeAjudaAi.ApiService/Options/RateLimit/RateLimitOptions.cs (1)
1-1: 💤 Low valueImport não utilizado:
System.ComponentModel.DataAnnotations.O
using System.ComponentModel.DataAnnotationsnão é usado nesta classe. Pode ser removido para manter o código limpo.♻️ Remoção do import
-using System.ComponentModel.DataAnnotations; - namespace MeAjudaAi.ApiService.Options.RateLimit;🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@src/Bootstrapper/MeAjudaAi.ApiService/Options/RateLimit/RateLimitOptions.cs` at line 1, Remove the unused using directive "using System.ComponentModel.DataAnnotations;" from the RateLimitOptions.cs file; open the RateLimitOptions class (RateLimitOptions) and delete that import line so only required usings remain, ensuring no compilation impact or references to DataAnnotations exist in the class.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@src/Bootstrapper/MeAjudaAi.ApiService/Program.cs`:
- Around line 137-147: A variável allowCredentials está lida mas nunca
usada—sempre chama AllowCredentials() no UseCors, o que ignora a configuração e
pode lançar se allowedOrigins estiver vazio; ajuste o lambda de app.UseCors para
usar allowCredentials: só invoque policy.AllowCredentials() se allowCredentials
for true e allowedOrigins tiver pelo menos uma origem específica
(allowedOrigins.Any()); se allowCredentials for true e allowedOrigins estiver
vazio, lance uma InvalidOperationException ou desative credenciais
explicitamente (defina allowCredentials = false) para evitar configuração
inválida; além disso, trate o caso de allowedOrigins vazio separando os caminhos
(por exemplo, usar policy.AllowAnyOrigin() somente quando allowCredentials for
false) para garantir que WithOrigins/AllowAnyOrigin e AllowCredentials não
entrem em conflito.
In
`@src/Bootstrapper/MeAjudaAi.Gateway/Middlewares/GeographicRestrictionMiddleware.cs`:
- Around line 174-188: A lógica dentro de GeographicRestrictionMiddleware que
trata entries de AllowedCities sem UF (quando separatorIndex < 0) é muito
restritiva: atualmente, se a requisição fornece city+state e
options.CurrentValue.AllowedStates é nulo/vazio, o match falha; altere o bloco
que usa configCityOnly, city, state e options.CurrentValue.AllowedStates para
que, quando configCityOnly.Equals(city,...), o método aceite a cidade
independentemente do state quando não houver AllowedStates configurado (ou seja,
retorne true em vez de false), e somente valide state contra AllowedStates se
AllowedStates estiver preenchido; mantenha o comportamento atual de retornar
true imediatamente se state for vazio.
In `@src/Bootstrapper/MeAjudaAi.Gateway/Program.cs`:
- Around line 118-129: The in-memory rate counter is incremented non-atomically
causing lost updates under concurrency; update the increment to be atomic by
changing GatewayRateCounter to expose an atomic increment method (or make its
Value a long and use Interlocked.Increment) and replace direct assignments like
"counter.Value = counter.Value + 1" with a call to that atomic increment
(references: windowKey, IMemoryCache, GatewayRateCounter, counter.Value). Apply
the same fix to the other occurrence noted (the block around lines 168-170) so
all increments use the atomic method.
- Around line 82-99: The rate-limit middleware reads
context.User.Identity.IsAuthenticated before authentication runs, so
authenticated-rate limits never apply; either move the app.Use(...) registration
so it runs after app.UseAuthentication() (and app.UseAuthorization() if present)
or, inside this middleware (e.g., the delegate registered in app.Use(...)),
proactively call await context.AuthenticateAsync() and use the returned
result.Principal to determine authentication instead of context.User; update
references in this middleware (clientIp, options.General.EnableIpWhitelist,
options.General.WhitelistedIps, isAuthenticated) accordingly so authenticated
requests are correctly bucketed.
- Around line 27-38: The CORS setup is using WithHeaders("*") and always calls
AllowCredentials(), which breaks preflight handling and ignores the configured
AllowCredentials flag; update the AddCors policy building (the block that calls
builder.Services.AddCors and the inner policy) to: check
GatewayCorsOptions.AllowedHeaders for a single "*" and call
policy.AllowAnyHeader() in that case otherwise use policy.WithHeaders(...);
likewise only call policy.AllowCredentials() when
GatewayCorsOptions.AllowCredentials is true; keep existing calls to
WithOrigins(...), WithMethods(...), and SetPreflightMaxAge(...) unchanged.
In `@tests/MeAjudaAi.Gateway.Tests/Unit/Options/GatewayOptionsTests.cs`:
- Around line 59-69: O teste
GeographicRestrictionOptions_DefaultValues_ShouldBeInitialized está assumindo
que AllowedStates e AllowedCities são listas vazias, mas na classe
GeographicRestrictionOptions essas propriedades são do tipo List<string>? e
ficam nulas por padrão; atualize o teste (método
GeographicRestrictionOptions_DefaultValues_ShouldBeInitialized) para verificar
options.AllowedStates.Should().BeNull() e
options.AllowedCities.Should().BeNull() ou, alternativamente, inicialize as
propriedades AllowedStates e AllowedCities na classe
GeographicRestrictionOptions com novas listas vazias para manter o assert
BeEmpty() nos testes — escolha e aplique uma das duas correções de forma
consistente.
---
Nitpick comments:
In `@src/Bootstrapper/MeAjudaAi.ApiService/Options/RateLimit/RateLimitOptions.cs`:
- Line 1: Remove the unused using directive "using
System.ComponentModel.DataAnnotations;" from the RateLimitOptions.cs file; open
the RateLimitOptions class (RateLimitOptions) and delete that import line so
only required usings remain, ensuring no compilation impact or references to
DataAnnotations exist in the class.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: a838293d-28b9-462a-90ed-08e25c61ee84
⛔ Files ignored due to path filters (3)
src/Bootstrapper/MeAjudaAi.ApiService/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Bootstrapper/MeAjudaAi.Gateway/packages.lock.jsonis excluded by!**/packages.lock.jsontests/MeAjudaAi.Gateway.Tests/packages.lock.jsonis excluded by!**/packages.lock.json
📒 Files selected for processing (20)
.github/workflows/ci-backend.ymlsrc/Aspire/MeAjudaAi.AppHost/Program.cssrc/Aspire/MeAjudaAi.AppHost/appsettings.jsonsrc/Bootstrapper/MeAjudaAi.ApiService/Extensions/ServiceCollectionExtensions.cssrc/Bootstrapper/MeAjudaAi.ApiService/MeAjudaAi.ApiService.csprojsrc/Bootstrapper/MeAjudaAi.ApiService/Middlewares/RateLimitingMiddleware.cssrc/Bootstrapper/MeAjudaAi.ApiService/Options/RateLimit/RateLimitOptions.cssrc/Bootstrapper/MeAjudaAi.ApiService/Program.cssrc/Bootstrapper/MeAjudaAi.ApiService/appsettings.jsonsrc/Bootstrapper/MeAjudaAi.Gateway/MeAjudaAi.Gateway.csprojsrc/Bootstrapper/MeAjudaAi.Gateway/Middlewares/GeographicRestrictionMiddleware.cssrc/Bootstrapper/MeAjudaAi.Gateway/Options/GatewayCorsOptions.cssrc/Bootstrapper/MeAjudaAi.Gateway/Options/GatewayRateLimitOptions.cssrc/Bootstrapper/MeAjudaAi.Gateway/Options/GeographicRestrictionOptions.cssrc/Bootstrapper/MeAjudaAi.Gateway/Program.cssrc/Bootstrapper/MeAjudaAi.Gateway/appsettings.jsontests/MeAjudaAi.ApiService.Tests/Unit/Extensions/SecurityExtensionsTests.cstests/MeAjudaAi.ApiService.Tests/Unit/Options/OptionsTests.cstests/MeAjudaAi.Gateway.Tests/MeAjudaAi.Gateway.Tests.csprojtests/MeAjudaAi.Gateway.Tests/Unit/Options/GatewayOptionsTests.cs
💤 Files with no reviewable changes (3)
- src/Aspire/MeAjudaAi.AppHost/appsettings.json
- src/Bootstrapper/MeAjudaAi.ApiService/appsettings.json
- tests/MeAjudaAi.ApiService.Tests/Unit/Options/OptionsTests.cs
✅ Files skipped from review due to trivial changes (2)
- src/Bootstrapper/MeAjudaAi.ApiService/Middlewares/RateLimitingMiddleware.cs
- src/Bootstrapper/MeAjudaAi.ApiService/MeAjudaAi.ApiService.csproj
🚧 Files skipped from review as they are similar to previous changes (4)
- src/Bootstrapper/MeAjudaAi.Gateway/appsettings.json
- src/Bootstrapper/MeAjudaAi.Gateway/MeAjudaAi.Gateway.csproj
- src/Bootstrapper/MeAjudaAi.Gateway/Options/GeographicRestrictionOptions.cs
- src/Aspire/MeAjudaAi.AppHost/Program.cs
Owner
Author
|
@coderabbitai o que acha da implementação do proxy reverse usando YARP? Está completa? Falta algo? Está funcional? Faltam testes? Devo remover mais testes? |
Contributor
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: Length of output: 21690
✅ O que está funcional
🔴 Bugs críticos encontrados1.
|
| O que testar | Prioridade |
|---|---|
GeographicRestrictionMiddleware — feature flag desabilitada, header malformado, FailOpen, estado permitido/bloqueado |
🔴 Alta |
Rate limit inline / CalculateScaledLimit — limite excedido, bypass por whitelist de IP, retorno 429 com Retry-After |
🔴 Alta |
CalculateScaledLimit — cálculo correto para janelas de 60s/3600s/86400s |
🟡 Média |
JWT — configuração de Authority/Audience carregada corretamente |
🟡 Média |
Sugiro especialmente testes para CalculateScaledLimit, pois é uma função pura e fácil de testar:
[Theory]
[InlineData(30, 300, 1000, 60, 30)] // janela 1min → usa perMinute
[InlineData(0, 300, 0, 3600, 300)] // somente perHour
[InlineData(30, 300, 1000, 120, 60)] // janela 2min → 60 req
public void CalculateScaledLimit_ShouldReturnCorrectThreshold(
int perMinute, int perHour, int perDay, int windowSeconds, int expected) { ... }📋 Resumo
| Área | Status |
|---|---|
| Roteamento YARP | ✅ Funcional |
| CORS | AllowCredentials ignorado |
| JWT | ✅ Configurado (sem testes) |
| Rate limiting | 🔴 Bug de ordem de middleware + race condition |
| GeographicRestriction | ✅ Migrado (sem testes no Gateway) |
| Polly/Circuit Breaker | |
| HealthCheck | 🔴 Policy inválida ("adaptive") |
| Testes | 🔴 Apenas testes de opções; middlewares sem cobertura |
Não remova mais testes — pelo contrário, adicione os listados acima, especialmente para GeographicRestrictionMiddleware e rate limiting, para manter a meta de ≥90% de cobertura.
🧠 Learnings used
Learnt from: frigini
Repo: frigini/MeAjudaAi PR: 0
File: :0-0
Timestamp: 2026-04-20T22:04:25.820Z
Learning: MeAjudaAi (PRs futuros): para cobertura global, NÃO excluir *Configuration e *Extensions (há smoke tests exercitando-os); também não excluir *.Monitoring.*, MeAjudaAi.Shared.Jobs.* e MeAjudaAi.Shared.Mediator.*. Manter excluídos apenas Request/Response/Dto/DTO/IntegrationEvent e *DbContextFactory; Endpoints podem ficar excluídos globalmente, a menos que sejam white-listados por módulo com E2E (ex.: +MeAjudaAi.Modules.Payments.API.*Endpoint; -*Endpoint).
Learnt from: frigini
Repo: frigini/MeAjudaAi PR: 0
File: :0-0
Timestamp: 2026-04-24T20:02:36.451Z
Learning: MeAjudaAi ci-backend.yml (linha 272): Para tornar os endpoints de um módulo visíveis na cobertura do ReportGenerator, adicionar o assembly antes de `-*Endpoint` no classfilters, ex: `+MeAjudaAi.Modules.Bookings.API.*Endpoint` (após `+MeAjudaAi.Modules.Payments.API.*Endpoint`). Isso é necessário apenas para módulos com cobertura E2E. Módulos sem E2E mantêm os endpoints excluídos.
Learnt from: frigini
Repo: frigini/MeAjudaAi PR: 0
File: :0-0
Timestamp: 2026-04-24T20:02:36.451Z
Learning: MeAjudaAi Shared coverage: Classes de infraestrutura de messaging que dependem de broker RabbitMQ real (RabbitMqDeadLetterService, DeadLetterExtensions, FailedMessageInfo, FailureAttempt, EnvironmentMetadata) são candidatas a [ExcludeFromCodeCoverage] pois não são testáveis unitariamente. Utilitários puros (PhoneNumberValidator, PiiMaskingHelper, SlugHelper, UuidGenerator) devem ter testes unitários adicionados em vez de serem excluídos.
Learnt from: frigini
Repo: frigini/MeAjudaAi PR: 0
File: :0-0
Timestamp: 2026-04-19T15:37:29.889Z
Learning: MeAjudaAi: objetivo de cobertura global é ≥90% (linhas), mantendo thresholds 90/80 no CI; quando a meta estiver ameaçada, preferir excluir “glue/DTO” (Endpoints/Extensions/Options/IntegrationEvent/DbContextFactory) e adicionar testes de alto impacto, em vez de reduzir o threshold.
Learnt from: frigini
Repo: frigini/MeAjudaAi PR: 0
File: :0-0
Timestamp: 2026-01-16T21:50:23.593Z
Learning: For frigini/MeAjudaAi Web reviews, prefer commit-by-commit (newest-first) with concise verdicts and concrete follow-ups; prioritize reuse of Shared.Contracts for enums/constants to keep Web aligned with backend/shared code.
Learnt from: frigini
Repo: frigini/MeAjudaAi PR: 77
File: src/Modules/Providers/Tests/Unit/Application/Queries/GetProvidersByIdsQueryTests.cs:65-77
Timestamp: 2025-12-18T00:35:33.829Z
Learning: MeAjudaAi repo: Exceção à política de idioma para comentários — em testes, os cabeçalhos AAA (Arrange, Act, Assert) devem permanecer em inglês e não devem ser traduzidos. Comentários/XML continuam em português; logs em inglês; mensagens ao usuário (validações/APIs) em português.
Learnt from: frigini
Repo: frigini/MeAjudaAi PR: 0
File: :0-0
Timestamp: 2026-04-24T21:04:28.437Z
Learning: MeAjudaAi Bookings.API: Classes não-endpoint dentro do assembly da API (Extensions, BookingsEndpoints, ProviderAuthorizationResult, ProviderAuthorizationResultExtensions) não são capturadas pelo classfilter `+MeAjudaAi.Modules.Bookings.API.*Endpoint` e devem receber [ExcludeFromCodeCoverage] individualmente (são glue/wiring). Já `ProviderAuthorizationResolver` contém lógica real de autorização e deve ter testes unitários próprios.
…eware, and configure module test dependencies
Contributor
There was a problem hiding this comment.
♻️ Duplicate comments (3)
src/Bootstrapper/MeAjudaAi.Gateway/Middlewares/GeographicRestrictionMiddleware.cs (1)
167-168:⚠️ Potential issue | 🔴 Critical | ⚡ Quick win
AllowedStatesainda pode ser bypassado quandoAllowedCitiesé nulo.Com
citypreenchida, oreturn trueimediato ignora totalmente whitelist por estado. Em cenário de restrição por UF apenas, isso libera tráfego indevido.🔧 Ajuste sugerido
- if (options.CurrentValue.AllowedCities == null) return true; + if (options.CurrentValue.AllowedCities == null) + { + if (options.CurrentValue.AllowedStates == null || !options.CurrentValue.AllowedStates.Any()) + { + return true; + } + + return !string.IsNullOrEmpty(state) && + options.CurrentValue.AllowedStates.Any(s => + s.Equals(state, StringComparison.OrdinalIgnoreCase)); + }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@src/Bootstrapper/MeAjudaAi.Gateway/Middlewares/GeographicRestrictionMiddleware.cs` around lines 167 - 168, The early return "if (options.CurrentValue.AllowedCities == null) return true;" lets state-based whitelisting be bypassed when AllowedCities is null; change the logic in GeographicRestrictionMiddleware to only short-circuit when both AllowedCities and AllowedStates are null or empty (e.g., check options.CurrentValue.AllowedCities and options.CurrentValue.AllowedStates), and otherwise proceed to evaluate state whitelist when city is not provided so AllowedStates is enforced; update the conditional that currently references options.CurrentValue.AllowedCities to perform a combined null/empty check before returning true.src/Bootstrapper/MeAjudaAi.Gateway/Program.cs (2)
127-131:⚠️ Potential issue | 🟠 Major | ⚡ Quick winContador de rate limit continua não atômico sob concorrência.
Value++e leitura posterior deValuepodem perder incrementos em rajadas, subcontando requests e afrouxando o limite real.🔧 Ajuste sugerido
- counter.Increment(); + var currentCount = counter.Increment(); var scaledLimit = CalculateScaledLimit(requestsPerMinute, requestsPerHour, requestsPerDay, windowSeconds); - if (counter.Value > scaledLimit) + if (currentCount > scaledLimit)class GatewayRateCounter { - public int Value { get; set; } - - public void Increment() => Value++; + private int _value; + public int Increment() => Interlocked.Increment(ref _value); }Also applies to: 169-173
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@src/Bootstrapper/MeAjudaAi.Gateway/Program.cs` around lines 127 - 131, The counter increment and subsequent read are not atomic (counter.Increment(); then checking counter.Value), which can lose increments under concurrency; change the logic so the increment-and-check is atomic — either use an atomic primitive (e.g., Interlocked.Increment returning the new value) or add an atomic helper on your Counter (e.g., IncrementAndGet/TryIncrement) and use that return value when comparing to CalculateScaledLimit(requestsPerMinute, requestsPerHour, requestsPerDay, windowSeconds); apply the same fix to the second occurrence around the block at the other location (the code referenced in the comment for lines 169-173).
30-34:⚠️ Potential issue | 🟠 Major | ⚡ Quick winConfiguração de CORS ainda não respeita wildcard/configuração de credenciais.
WithHeaders("*")não equivale aAllowAnyHeader()para preflight, eAllowCredentials()está sendo aplicado sempre, ignorandoGatewayCorsOptions.AllowCredentials.🔧 Ajuste sugerido
options.AddDefaultPolicy(policy => { - policy.WithOrigins(corsConfig.AllowedOrigins.ToArray()) - .WithMethods(corsConfig.AllowedMethods.ToArray()) - .WithHeaders(corsConfig.AllowedHeaders.ToArray()) - .AllowCredentials() - .SetPreflightMaxAge(TimeSpan.FromSeconds(corsConfig.MaxAgeSeconds)); + if (corsConfig.AllowedOrigins.Count == 0) + { + if (corsConfig.AllowCredentials) + throw new InvalidOperationException("Cannot use AllowCredentials with wildcard origins."); + policy.AllowAnyOrigin(); + } + else + { + policy.WithOrigins(corsConfig.AllowedOrigins.ToArray()); + } + + policy.WithMethods(corsConfig.AllowedMethods.ToArray()); + + if (corsConfig.AllowedHeaders.Count == 1 && corsConfig.AllowedHeaders[0] == "*") + policy.AllowAnyHeader(); + else + policy.WithHeaders(corsConfig.AllowedHeaders.ToArray()); + + if (corsConfig.AllowCredentials) + policy.AllowCredentials(); + + policy.SetPreflightMaxAge(TimeSpan.FromSeconds(corsConfig.MaxAgeSeconds)); });🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@src/Bootstrapper/MeAjudaAi.Gateway/Program.cs` around lines 30 - 34, O CORS está aplicando .WithHeaders(...).AllowCredentials() sem respeitar wildcards e a flag GatewayCorsOptions.AllowCredentials; ajuste em Program.cs para: quando corsConfig.AllowedHeaders contém "*" chamar AllowAnyHeader() em vez de .WithHeaders(...); quando corsConfig.AllowedOrigins contém "*" usar policy.SetIsOriginAllowed(_ => true) (não .WithOrigins("*")) para permitir wildcard combinado com credenciais, caso contrário usar .WithOrigins(corsConfig.AllowedOrigins.ToArray()); e só chamar .AllowCredentials() se corsConfig.AllowCredentials for true; preserve .WithMethods(...) e .SetPreflightMaxAge(...) conforme já usado.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Duplicate comments:
In
`@src/Bootstrapper/MeAjudaAi.Gateway/Middlewares/GeographicRestrictionMiddleware.cs`:
- Around line 167-168: The early return "if (options.CurrentValue.AllowedCities
== null) return true;" lets state-based whitelisting be bypassed when
AllowedCities is null; change the logic in GeographicRestrictionMiddleware to
only short-circuit when both AllowedCities and AllowedStates are null or empty
(e.g., check options.CurrentValue.AllowedCities and
options.CurrentValue.AllowedStates), and otherwise proceed to evaluate state
whitelist when city is not provided so AllowedStates is enforced; update the
conditional that currently references options.CurrentValue.AllowedCities to
perform a combined null/empty check before returning true.
In `@src/Bootstrapper/MeAjudaAi.Gateway/Program.cs`:
- Around line 127-131: The counter increment and subsequent read are not atomic
(counter.Increment(); then checking counter.Value), which can lose increments
under concurrency; change the logic so the increment-and-check is atomic —
either use an atomic primitive (e.g., Interlocked.Increment returning the new
value) or add an atomic helper on your Counter (e.g.,
IncrementAndGet/TryIncrement) and use that return value when comparing to
CalculateScaledLimit(requestsPerMinute, requestsPerHour, requestsPerDay,
windowSeconds); apply the same fix to the second occurrence around the block at
the other location (the code referenced in the comment for lines 169-173).
- Around line 30-34: O CORS está aplicando .WithHeaders(...).AllowCredentials()
sem respeitar wildcards e a flag GatewayCorsOptions.AllowCredentials; ajuste em
Program.cs para: quando corsConfig.AllowedHeaders contém "*" chamar
AllowAnyHeader() em vez de .WithHeaders(...); quando corsConfig.AllowedOrigins
contém "*" usar policy.SetIsOriginAllowed(_ => true) (não .WithOrigins("*"))
para permitir wildcard combinado com credenciais, caso contrário usar
.WithOrigins(corsConfig.AllowedOrigins.ToArray()); e só chamar
.AllowCredentials() se corsConfig.AllowCredentials for true; preserve
.WithMethods(...) e .SetPreflightMaxAge(...) conforme já usado.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 0ea79397-ffd9-4b92-922a-74af6412124c
📒 Files selected for processing (7)
.github/actions/setup-backend/action.ymlDirectory.Packages.propsMeAjudaAi.slnxsrc/Bootstrapper/MeAjudaAi.ApiService/Options/GeographicRestrictionOptions.cssrc/Bootstrapper/MeAjudaAi.ApiService/Program.cssrc/Bootstrapper/MeAjudaAi.Gateway/Middlewares/GeographicRestrictionMiddleware.cssrc/Bootstrapper/MeAjudaAi.Gateway/Program.cs
✅ Files skipped from review due to trivial changes (2)
- .github/actions/setup-backend/action.yml
- MeAjudaAi.slnx
🚧 Files skipped from review as they are similar to previous changes (1)
- src/Bootstrapper/MeAjudaAi.ApiService/Options/GeographicRestrictionOptions.cs
…are configuration
Owner
Author
|
@coderabbitai para a próxima atividade, que farei em outra branch, quero refatorar a camada de persistencia, por que me incomoda a quantidade de repositories que tenho. Para isso preciso que analise o que está criado em Shared e como está aplicado nos módulos, ve se é viável implementar o seguinte plano: `O objetivo é refatorar a camada de persistencia, removendo os repositories e testes relacionados e removendo tambem código da camada de aplicação e usar EF.Core como Unit Of Work e como Repository, já que ele foi desenhado para isso, aplicando DDD diretamente sem precisar de wrapping classes. Temos que isolar a camada de aplicacao (dos módulos) do EF.Core. Algumas definições/regras:
Exemplo de IRepository: public interface IRepository<TAggregate, TKey> //single DDD TAggregate é a Entity que vamos aplicar ,strongly typed TKey } Exemplo de IUnitOfWork: public interface IUnitOfWork Exemplo de uso em um endpoint independente do EF.Core, ignorante da persistencia: public static async Task AddInvoiceLine( } uma implementacao de um ApiDbContext: public partial class ApiDbContext(DbContextOptions options) } e pode usar partial implementation para tornar AppDbContext mais simples (esse mesmo código por aggregate): public partial class ApiDbContext : IRepository<Product, Product.ProductId> } e o ApiDbContext ficaria mais limpo assim: public partial class ApiDbContext(DbContextOptions options) } As queries são únicas, cada uma é criada em EF.Core, que supoerta CQRS nativamente. Exemplo de interface query: public interface IProductQueries } Agora uma classe que pertence a camada de infrastrutura: public class DbContextProductQueries(ApiDbContext dbContext) : IProductQueries Agora exemplo de endpoint usnando a query (basicamente para todo endpoint, prepare os parametros, invoque a query): public static class ProductEndpoints }` |
Contributor
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chainVou primeiro analisar a estrutura atual da camada de persistência no Shared e nos módulos. 🏁 Script executed: Length of output: 30252 Ótimo, agora preciso ver os detalhes das interfaces e implementações existentes. 🏁 Script executed: Length of output: 56231 Deixa eu ver mais alguns detalhes importantes — o 🏁 Script executed: Length of output: 22259
✅ O plano é viável e arquiteturalmente sólidoA refatoração proposta vai na direção certa. O 📊 Inventário do estado atual
🔴 Problemas concretos encontrados que o plano resolve1. Todos os repositórios atuais chamam public async Task AddAsync(AllowedCity allowedCity, ...) {
await context.AllowedCities.AddAsync(allowedCity, cancellationToken);
await context.SaveChangesAsync(cancellationToken); // ← cada método persiste sozinho
}Isso torna impossível agrupar múltiplas operações em uma única transação. O novo modelo com 2. // Domain interface — mas SaveChanges não pertence ao domínio!
Task<int> SaveChangesAsync(CancellationToken cancellationToken = default);Isso é um vazamento de infraestrutura. O 3. O
|
Método atual em IProviderRepository |
Destino no novo modelo |
|---|---|
GetBySlugAsync |
IProviderQueries |
GetByIdsAsync |
IProviderQueries |
GetByCityAsync |
IProviderQueries |
GetByStateAsync |
IProviderQueries |
GetByVerificationStatusAsync |
IProviderQueries |
GetByTypeAsync |
IProviderQueries |
GetProviderStatusAsync |
IProviderQueries |
HasProvidersWithServiceAsync |
IProviderQueries |
GetByUserIdAsync |
IProviderQueries |
ExistsAsync |
IProviderQueries ou lógica no handler |
GetByIdAsync (command side) |
IRepository<Provider, ProviderId>.TryFindAsync |
AddAsync |
IRepository<Provider, ProviderId>.Add |
DeleteAsync |
IRepository<Provider, ProviderId>.Delete |
O ProviderQueryService existente já faz isso para queries de paginação — é só expandir esse padrão.
🏗️ Estrutura proposta para o Shared
src/Shared/Database/
├── IRepository.cs ← NOVO (interface genérica)
├── IUnitOfWork.cs ← NOVO (interface UoW)
├── BaseDbContext.cs ← manter (já tem domain event dispatch)
├── Outbox/
│ └── IOutboxRepository.cs ← manter como está
...
IRepository<TAggregate, TKey> no Shared:
// src/Shared/Database/IRepository.cs
namespace MeAjudaAi.Shared.Database;
public interface IRepository<TAggregate, TKey>
{
Task<TAggregate?> TryFindAsync(TKey key, CancellationToken cancellationToken = default);
void Add(TAggregate aggregate);
void Delete(TAggregate aggregate);
// Default implementation com key (evita duplicação nos DbContexts parciais)
async Task DeleteAsync(TKey key, CancellationToken cancellationToken = default)
{
var aggregate = await TryFindAsync(key, cancellationToken)
?? throw new ArgumentException($"Aggregate with key '{key}' not found.");
Delete(aggregate);
}
}IUnitOfWork no Shared:
// src/Shared/Database/IUnitOfWork.cs
namespace MeAjudaAi.Shared.Database;
public interface IUnitOfWork
{
IRepository<TAggregate, TKey> GetRepository<TAggregate, TKey>();
Task<int> SaveChangesAsync(CancellationToken cancellationToken = default);
}🗺️ Estratégia de migração recomendada
Fase 1 — Piloto com Locations (menor escopo: 1 aggregate, 1 DbContext, handlers simples)
O LocationsDbContext herda de BaseDbContext (domain events preservados automaticamente). A migração ficaria:
// partial — arquivo principal
public partial class LocationsDbContext(
DbContextOptions<LocationsDbContext> options,
IDomainEventProcessor domainEventProcessor)
: BaseDbContext(options, domainEventProcessor), IUnitOfWork
{
public DbSet<AllowedCity> AllowedCities => Set<AllowedCity>();
public IRepository<TAggregate, TKey> GetRepository<TAggregate, TKey>() =>
(IRepository<TAggregate, TKey>)this;
protected override void OnModelCreating(ModelBuilder modelBuilder) { ... }
// GetDomainEventsAsync / ClearDomainEvents permanecem
}
// partial — AllowedCity aggregate
public partial class LocationsDbContext : IRepository<AllowedCity, Guid>
{
async Task<AllowedCity?> IRepository<AllowedCity, Guid>.TryFindAsync(
Guid key, CancellationToken cancellationToken) =>
await AllowedCities.FirstOrDefaultAsync(x => x.Id == key, cancellationToken);
void IRepository<AllowedCity, Guid>.Add(AllowedCity aggregate) =>
AllowedCities.Add(aggregate);
void IRepository<AllowedCity, Guid>.Delete(AllowedCity aggregate) =>
AllowedCities.Remove(aggregate);
}Handler CreateAllowedCityHandler com o novo padrão:
public sealed class CreateAllowedCityHandler(
IUnitOfWork uow,
IAllowedCityQueries queries, // ← queries viram interface separada
IGeocodingService geocodingService, ...) : ICommandHandler<...>
{
public async Task<Result<Guid>> HandleAsync(CreateAllowedCityCommand command, ...)
{
var exists = await queries.ExistsAsync(command.CityName, command.StateSigla, cancellationToken);
if (exists) return Result<Guid>.Failure(Error.Conflict(...));
var allowedCity = new AllowedCity(...);
uow.GetRepository<AllowedCity, Guid>().Add(allowedCity);
await uow.SaveChangesAsync(cancellationToken);
return Result<Guid>.Success(allowedCity.Id);
}
}Fase 2 — Migrar módulos simples (Ratings, Documents, ServiceCatalogs)
Fase 3 — Migrar módulos com queries complexas (Providers, Users) expandindo IXxxQueries
Fase 4 — Tratar Bookings separadamente (manter IBookingCommandService para AddIfNoOverlapAsync)
📋 Resumo da viabilidade
| Aspecto | Avaliação |
|---|---|
| Direção arquitetural | ✅ Correta e coerente com DDD |
| Elimina boilerplate de repositories | ✅ Reduz ~60% do código de persistência |
| Preserva domain event dispatch (BaseDbContext) | ✅ Automático via herança |
IOutboxRepository — migrável? |
❌ Manter como está (infraestrutura de mensageria) |
AddIfNoOverlapAsync (Bookings) |
|
| Queries complexas (Providers, Users) | IXxxQueries (padrão já existe em ProviderQueryService) |
| Testes de integração existentes | |
AddModuleRepositories (Scrutor) |
A refatoração é totalmente viável — recomendo Locations como módulo piloto na nova branch, validando o padrão antes de expandir para os demais módulos.
✏️ Learnings added
Learnt from: frigini
URL: https://github.com/frigini/MeAjudaAi/pull/219
Timestamp: 2026-04-30T02:20:29.084Z
Learning: MeAjudaAi (refatoração futura de persistência): Plano acordado — remover repository wrapper classes e usar EF Core DbContext como IUnitOfWork + IRepository<TAggregate, TKey>. IRepository<T,K> e IUnitOfWork irão para src/Shared/Database/. DbContexts usam partial classes por aggregate. Módulo piloto: Locations. Exceções: IOutboxRepository<TMessage> permanece como está (infraestrutura de mensageria); AddIfNoOverlapAsync do Bookings precisa de Domain/Application Service dedicado. Queries complexas (GetByCity, GetByState, etc.) migram para IXxxQueries com AsNoTracking. AddModuleRepositories (Scrutor) deve ser substituído por registro explícito do DbContext como IUnitOfWork.
Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.
🧠 Learnings used
Learnt from: frigini
Repo: frigini/MeAjudaAi PR: 0
File: :0-0
Timestamp: 2026-04-20T22:04:25.820Z
Learning: MeAjudaAi (PRs futuros): para cobertura global, NÃO excluir *Configuration e *Extensions (há smoke tests exercitando-os); também não excluir *.Monitoring.*, MeAjudaAi.Shared.Jobs.* e MeAjudaAi.Shared.Mediator.*. Manter excluídos apenas Request/Response/Dto/DTO/IntegrationEvent e *DbContextFactory; Endpoints podem ficar excluídos globalmente, a menos que sejam white-listados por módulo com E2E (ex.: +MeAjudaAi.Modules.Payments.API.*Endpoint; -*Endpoint).
Learnt from: frigini
Repo: frigini/MeAjudaAi PR: 0
File: :0-0
Timestamp: 2026-04-24T20:02:36.451Z
Learning: MeAjudaAi ci-backend.yml (linha 272): Para tornar os endpoints de um módulo visíveis na cobertura do ReportGenerator, adicionar o assembly antes de `-*Endpoint` no classfilters, ex: `+MeAjudaAi.Modules.Bookings.API.*Endpoint` (após `+MeAjudaAi.Modules.Payments.API.*Endpoint`). Isso é necessário apenas para módulos com cobertura E2E. Módulos sem E2E mantêm os endpoints excluídos.
Learnt from: frigini
Repo: frigini/MeAjudaAi PR: 0
File: :0-0
Timestamp: 2026-04-24T20:02:36.451Z
Learning: MeAjudaAi Shared coverage: Classes de infraestrutura de messaging que dependem de broker RabbitMQ real (RabbitMqDeadLetterService, DeadLetterExtensions, FailedMessageInfo, FailureAttempt, EnvironmentMetadata) são candidatas a [ExcludeFromCodeCoverage] pois não são testáveis unitariamente. Utilitários puros (PhoneNumberValidator, PiiMaskingHelper, SlugHelper, UuidGenerator) devem ter testes unitários adicionados em vez de serem excluídos.
Learnt from: frigini
Repo: frigini/MeAjudaAi PR: 0
File: :0-0
Timestamp: 2026-04-19T15:37:29.889Z
Learning: MeAjudaAi: objetivo de cobertura global é ≥90% (linhas), mantendo thresholds 90/80 no CI; quando a meta estiver ameaçada, preferir excluir “glue/DTO” (Endpoints/Extensions/Options/IntegrationEvent/DbContextFactory) e adicionar testes de alto impacto, em vez de reduzir o threshold.
Learnt from: frigini
Repo: frigini/MeAjudaAi PR: 0
File: :0-0
Timestamp: 2026-04-24T21:04:28.437Z
Learning: MeAjudaAi Bookings.API: Classes não-endpoint dentro do assembly da API (Extensions, BookingsEndpoints, ProviderAuthorizationResult, ProviderAuthorizationResultExtensions) não são capturadas pelo classfilter `+MeAjudaAi.Modules.Bookings.API.*Endpoint` e devem receber [ExcludeFromCodeCoverage] individualmente (são glue/wiring). Já `ProviderAuthorizationResolver` contém lógica real de autorização e deve ter testes unitários próprios.
Learnt from: frigini
Repo: frigini/MeAjudaAi PR: 0
File: :0-0
Timestamp: 2026-01-16T21:50:23.593Z
Learning: For frigini/MeAjudaAi Web reviews, prefer commit-by-commit (newest-first) with concise verdicts and concrete follow-ups; prioritize reuse of Shared.Contracts for enums/constants to keep Web aligned with backend/shared code.
Learnt from: frigini
Repo: frigini/MeAjudaAi PR: 77
File: src/Modules/Providers/Tests/Unit/Application/Queries/GetProvidersByIdsQueryTests.cs:65-77
Timestamp: 2025-12-18T00:35:33.829Z
Learning: MeAjudaAi repo: Exceção à política de idioma para comentários — em testes, os cabeçalhos AAA (Arrange, Act, Assert) devem permanecer em inglês e não devem ser traduzidos. Comentários/XML continuam em português; logs em inglês; mensagens ao usuário (validações/APIs) em português.
Learnt from: frigini
Repo: frigini/MeAjudaAi PR: 0
File: :0-0
Timestamp: 2026-04-24T21:04:28.437Z
Learning: MeAjudaAi coverlet.runsettings: `ExcludeByAttribute` deve incluir `ExcludeFromCodeCoverage` (além de Obsolete,GeneratedCode,CompilerGenerated). Sem isso, todas as classes decoradas com [ExcludeFromCodeCoverage] continuam sendo instrumentadas pelo coverlet e contam como linhas não cobertas no relatório, reduzindo a cobertura global. Correção: `<ExcludeByAttribute>Obsolete,GeneratedCode,CompilerGenerated,ExcludeFromCodeCoverage</ExcludeByAttribute>`.
added 2 commits
April 29, 2026 23:21
…leware and add dependency lock files across modules and test suites
Owner
Author
|
@coderabbitai agora sobre a atual implementaçãodo gateway usando YARP, está completa? Precisa de mais alguma coisa? |
Contributor
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chainDeixa eu verificar o estado atual de todos os arquivos do gateway para dar uma resposta precisa. 🏁 Script executed: Length of output: 23841
✅ Corrigido desde a última análise
🔴 Ainda falta corrigir1.
|
| Teste | Prioridade |
|---|---|
GeographicRestrictionMiddleware — feature flag off, header malformado, FailOpen, estado permitido/bloqueado |
🔴 Alta |
Rate limit — limite excedido retorna 429 + Retry-After, bypass por whitelist de IP |
🔴 Alta |
CalculateScaledLimit — cálculo correto para janelas de 60s/3600s/86400s (função pura) |
🟡 Média |
📋 Resumo
| Área | Estado atual |
|---|---|
| Roteamento YARP | ✅ Funcional |
| CORS | ✅ Corrigido |
| JWT / Auth | ✅ Configurado (sem testes) |
| Rate limiting (ordem de middleware) | ✅ Corrigido — mas com chamadas duplicadas |
| Thread safety do contador | ✅ Corrigido |
| GeographicRestriction | |
| HealthCheck policy | 🔴 "adaptive" inválido |
| Polly/Circuit Breaker | |
| Testes | 🔴 Apenas opções; sem cobertura de comportamento |
Os 3 itens críticos para corrigir antes do merge são: remover UseAuthentication duplicado, corrigir a policy "adaptive" e adicionar null-guards nas listas no middleware.
🧠 Learnings used
Learnt from: frigini
Repo: frigini/MeAjudaAi PR: 0
File: :0-0
Timestamp: 2026-04-30T02:20:29.084Z
Learning: MeAjudaAi (refatoração futura de persistência): Plano acordado — remover repository wrapper classes e usar EF Core DbContext como IUnitOfWork + IRepository<TAggregate, TKey>. IRepository<T,K> e IUnitOfWork irão para src/Shared/Database/. DbContexts usam partial classes por aggregate. Módulo piloto: Locations. Exceções: IOutboxRepository<TMessage> permanece como está (infraestrutura de mensageria); AddIfNoOverlapAsync do Bookings precisa de Domain/Application Service dedicado. Queries complexas (GetByCity, GetByState, etc.) migram para IXxxQueries com AsNoTracking. AddModuleRepositories (Scrutor) deve ser substituído por registro explícito do DbContext como IUnitOfWork.
Learnt from: frigini
Repo: frigini/MeAjudaAi PR: 0
File: :0-0
Timestamp: 2026-04-20T22:04:25.820Z
Learning: MeAjudaAi (PRs futuros): para cobertura global, NÃO excluir *Configuration e *Extensions (há smoke tests exercitando-os); também não excluir *.Monitoring.*, MeAjudaAi.Shared.Jobs.* e MeAjudaAi.Shared.Mediator.*. Manter excluídos apenas Request/Response/Dto/DTO/IntegrationEvent e *DbContextFactory; Endpoints podem ficar excluídos globalmente, a menos que sejam white-listados por módulo com E2E (ex.: +MeAjudaAi.Modules.Payments.API.*Endpoint; -*Endpoint).
Learnt from: frigini
Repo: frigini/MeAjudaAi PR: 0
File: :0-0
Timestamp: 2026-04-24T20:02:36.451Z
Learning: MeAjudaAi Shared coverage: Classes de infraestrutura de messaging que dependem de broker RabbitMQ real (RabbitMqDeadLetterService, DeadLetterExtensions, FailedMessageInfo, FailureAttempt, EnvironmentMetadata) são candidatas a [ExcludeFromCodeCoverage] pois não são testáveis unitariamente. Utilitários puros (PhoneNumberValidator, PiiMaskingHelper, SlugHelper, UuidGenerator) devem ter testes unitários adicionados em vez de serem excluídos.
Learnt from: frigini
Repo: frigini/MeAjudaAi PR: 0
File: :0-0
Timestamp: 2026-04-24T21:04:28.437Z
Learning: MeAjudaAi Bookings.API: Classes não-endpoint dentro do assembly da API (Extensions, BookingsEndpoints, ProviderAuthorizationResult, ProviderAuthorizationResultExtensions) não são capturadas pelo classfilter `+MeAjudaAi.Modules.Bookings.API.*Endpoint` e devem receber [ExcludeFromCodeCoverage] individualmente (são glue/wiring). Já `ProviderAuthorizationResolver` contém lógica real de autorização e deve ter testes unitários próprios.
Learnt from: frigini
Repo: frigini/MeAjudaAi PR: 0
File: :0-0
Timestamp: 2026-04-24T20:02:36.451Z
Learning: MeAjudaAi ci-backend.yml (linha 272): Para tornar os endpoints de um módulo visíveis na cobertura do ReportGenerator, adicionar o assembly antes de `-*Endpoint` no classfilters, ex: `+MeAjudaAi.Modules.Bookings.API.*Endpoint` (após `+MeAjudaAi.Modules.Payments.API.*Endpoint`). Isso é necessário apenas para módulos com cobertura E2E. Módulos sem E2E mantêm os endpoints excluídos.
Learnt from: frigini
Repo: frigini/MeAjudaAi PR: 0
File: :0-0
Timestamp: 2026-04-19T15:37:29.889Z
Learning: MeAjudaAi: objetivo de cobertura global é ≥90% (linhas), mantendo thresholds 90/80 no CI; quando a meta estiver ameaçada, preferir excluir “glue/DTO” (Endpoints/Extensions/Options/IntegrationEvent/DbContextFactory) e adicionar testes de alto impacto, em vez de reduzir o threshold.
Learnt from: frigini
Repo: frigini/MeAjudaAi PR: 0
File: :0-0
Timestamp: 2026-04-24T21:04:28.437Z
Learning: MeAjudaAi coverlet.runsettings: `ExcludeByAttribute` deve incluir `ExcludeFromCodeCoverage` (além de Obsolete,GeneratedCode,CompilerGenerated). Sem isso, todas as classes decoradas com [ExcludeFromCodeCoverage] continuam sendo instrumentadas pelo coverlet e contam como linhas não cobertas no relatório, reduzindo a cobertura global. Correção: `<ExcludeByAttribute>Obsolete,GeneratedCode,CompilerGenerated,ExcludeFromCodeCoverage</ExcludeByAttribute>`.
Learnt from: frigini
Repo: frigini/MeAjudaAi PR: 0
File: :0-0
Timestamp: 2026-01-16T21:50:23.593Z
Learning: For frigini/MeAjudaAi Web reviews, prefer commit-by-commit (newest-first) with concise verdicts and concrete follow-ups; prioritize reuse of Shared.Contracts for enums/constants to keep Web aligned with backend/shared code.
Learnt from: frigini
Repo: frigini/MeAjudaAi PR: 77
File: src/Modules/Providers/Tests/Unit/Application/Queries/GetProvidersByIdsQueryTests.cs:65-77
Timestamp: 2025-12-18T00:35:33.829Z
Learning: MeAjudaAi repo: Exceção à política de idioma para comentários — em testes, os cabeçalhos AAA (Arrange, Act, Assert) devem permanecer em inglês e não devem ser traduzidos. Comentários/XML continuam em português; logs em inglês; mensagens ao usuário (validações/APIs) em português.
Learnt from: frigini
Repo: frigini/MeAjudaAi PR: 77
File: src/Modules/Documents/Application/Handlers/UploadDocumentCommandHandler.cs:133-143
Timestamp: 2025-12-17T18:26:37.409Z
Learning: MeAjudaAi logging policy: logs must be in English, comments may remain in Portuguese. Portuguese logs were additionally found in Users (API/Extensions.cs:83), Providers (API/Extensions.cs:74), ServiceCatalogs (API/Extensions.cs:78,86,93), and Locations (multiple clients/services lines listed). SearchProviders module currently has no Portuguese logs.
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (1)
src/Bootstrapper/MeAjudaAi.Gateway/Middlewares/GeographicRestrictionMiddleware.cs (1)
173-176:⚠️ Potential issue | 🟠 Major | ⚡ Quick winNão ignore
AllowedStatesquando a request também trazcity.Do jeito que está, uma configuração só por UF deixa de funcionar assim que o header de cidade vem preenchido: o código retorna
falseantes de checarAllowedStates, então requests válidas comocity=Vitória+state=ESacabam bloqueadas.💡 Ajuste sugerido
if (!string.IsNullOrEmpty(city)) { - if (!hasAllowedCities) return false; + if (!hasAllowedCities) + { + return !string.IsNullOrEmpty(state) && + options.CurrentValue.AllowedStates.Any(s => + s.Equals(state, StringComparison.OrdinalIgnoreCase)); + }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@src/Bootstrapper/MeAjudaAi.Gateway/Middlewares/GeographicRestrictionMiddleware.cs` around lines 173 - 176, O trecho em GeographicRestrictionMiddleware.cs está retornando false imediatamente quando existe um header city (variável city) e não há cidades configuradas (hasAllowedCities), o que impede verificar AllowedStates; altere a lógica para não rejeitar cedo: quando city for fornecida, avalie também hasAllowedStates/state (por exemplo variáveis state e hasAllowedStates) e só retorne false se nem city estiver em AllowedCities nem state estiver em AllowedStates; em outras palavras, em vez de if (!string.IsNullOrEmpty(city) { if (!hasAllowedCities) return false; } faça uma verificação combinada que permite a requisição se city ∈ AllowedCities OR state ∈ AllowedStates, caso contrário retorne false.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@src/Bootstrapper/MeAjudaAi.ApiService/Program.cs`:
- Line 194: Remove the redundant geoblocking enforcement in ApiService by
deleting or disabling the call to
app.UseMiddleware<GeographicRestrictionMiddleware>() in Program.cs so that only
MeAjudaAi.Gateway performs geographic restriction; ensure no other code paths in
Program.cs or Startup still instantiate or register
GeographicRestrictionMiddleware or its services to avoid double validation and
payload divergence.
In
`@src/Bootstrapper/MeAjudaAi.Gateway/Middlewares/GeographicRestrictionMiddleware.cs`:
- Around line 202-216: The current logic in GeographicRestrictionMiddleware
(when comparing configCity/configState with request city/state) incorrectly
grants access if the allowlist entry specifies a state (configState non-empty)
but the incoming request lacks state: the final "return true" should not bypass
the state requirement. Change the branch handling configState ≠ empty so that if
request state is empty you skip this allowlist entry (e.g., continue to next
entry) instead of returning true; keep the existing behavior that if configState
is empty a matching city is allowed.
---
Duplicate comments:
In
`@src/Bootstrapper/MeAjudaAi.Gateway/Middlewares/GeographicRestrictionMiddleware.cs`:
- Around line 173-176: O trecho em GeographicRestrictionMiddleware.cs está
retornando false imediatamente quando existe um header city (variável city) e
não há cidades configuradas (hasAllowedCities), o que impede verificar
AllowedStates; altere a lógica para não rejeitar cedo: quando city for
fornecida, avalie também hasAllowedStates/state (por exemplo variáveis state e
hasAllowedStates) e só retorne false se nem city estiver em AllowedCities nem
state estiver em AllowedStates; em outras palavras, em vez de if
(!string.IsNullOrEmpty(city) { if (!hasAllowedCities) return false; } faça uma
verificação combinada que permite a requisição se city ∈ AllowedCities OR state
∈ AllowedStates, caso contrário retorne false.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: f1c1aa8f-a0ec-43d7-80cf-dc3f7cda7f6b
⛔ Files ignored due to path filters (16)
src/Bootstrapper/MeAjudaAi.ApiService/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Modules/Bookings/Tests/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Modules/Communications/Tests/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Modules/Documents/Tests/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Modules/Locations/Tests/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Modules/Payments/Tests/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Modules/Providers/Tests/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Modules/Ratings/Tests/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Modules/SearchProviders/Tests/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Modules/ServiceCatalogs/Tests/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Modules/Users/Tests/packages.lock.jsonis excluded by!**/packages.lock.jsontests/MeAjudaAi.ApiService.Tests/packages.lock.jsonis excluded by!**/packages.lock.jsontests/MeAjudaAi.Architecture.Tests/packages.lock.jsonis excluded by!**/packages.lock.jsontests/MeAjudaAi.E2E.Tests/packages.lock.jsonis excluded by!**/packages.lock.jsontests/MeAjudaAi.Integration.Tests/packages.lock.jsonis excluded by!**/packages.lock.jsontests/MeAjudaAi.Shared.Tests/packages.lock.jsonis excluded by!**/packages.lock.json
📒 Files selected for processing (9)
src/Bootstrapper/MeAjudaAi.ApiService/MeAjudaAi.ApiService.csprojsrc/Bootstrapper/MeAjudaAi.ApiService/Middlewares/GeographicRestrictionMiddleware.cssrc/Bootstrapper/MeAjudaAi.ApiService/Options/GeographicRestrictionOptions.cssrc/Bootstrapper/MeAjudaAi.ApiService/Program.cssrc/Bootstrapper/MeAjudaAi.Gateway/Middlewares/GeographicRestrictionMiddleware.cssrc/Bootstrapper/MeAjudaAi.Gateway/Options/GeographicRestrictionOptions.cssrc/Bootstrapper/MeAjudaAi.Gateway/Program.cssrc/Shared/Messaging/MessagingExtensions.cstests/MeAjudaAi.Shared.Tests/Unit/ServiceDefaults/ExtensionsTests.cs
✅ Files skipped from review due to trivial changes (2)
- src/Bootstrapper/MeAjudaAi.ApiService/MeAjudaAi.ApiService.csproj
- src/Bootstrapper/MeAjudaAi.Gateway/Options/GeographicRestrictionOptions.cs
🚧 Files skipped from review as they are similar to previous changes (1)
- src/Bootstrapper/MeAjudaAi.Gateway/Program.cs
added 2 commits
April 30, 2026 00:03
…dleware for the gateway service
…and configured region settings
Owner
Author
|
@coderabbitai agora verifique novamente sobre a atual implementaçãodo gateway usando YARP, está completa? Precisa de mais alguma coisa? |
Contributor
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chainVou verificar o estado atual de todos os arquivos do gateway. 🏁 Script executed: Length of output: 16882 Vou verificar um detalhe adicional antes de dar a resposta final. 🏁 Script executed: Length of output: 17985
✅ Corrigido / Implementado
🔴 Crítico — quebrará o CIContradição entre testes de
|
| Teste | Prioridade |
|---|---|
RateLimitingMiddleware — disabled → chama next |
🔴 Alta |
RateLimitingMiddleware — limite excedido → 429 + Retry-After |
🔴 Alta |
RateLimitingMiddleware — IP em whitelist → bypass |
🔴 Alta |
GeographicRestrictionMiddleware — feature flag off → chama next |
🔴 Alta |
GeographicRestrictionMiddleware — estado bloqueado → 451 |
🔴 Alta |
GeographicRestrictionMiddleware — FailOpen = true sem header → permite |
🟡 Média |
CalculateScaledLimit — janelas 60s/3600s/86400s (método private static) |
🟡 Média |
Para testar CalculateScaledLimit sem tornar o método público, a alternativa é testá-lo via comportamento do middleware (injetando opções conhecidas e verificando se o 429 é retornado no count correto).
📋 Resumo
| Área | Estado |
|---|---|
| Roteamento YARP | ✅ Funcional |
| CORS | ✅ Correto |
| JWT / Auth | ✅ Correto |
| Ordem do middleware | ✅ Correto |
| Thread safety | ✅ Correto |
| Rate limiting (classe dedicada) | ✅ Correto |
| GeographicRestriction | ✅ Compartilhado com Shared |
| Testes — options defaults | ✅ Cobertos (com contradição a corrigir) |
Testes — BeNull vs BeEmpty |
🔴 Contradição: CI vai falhar |
"CircuitBreaker" YARP |
🟡 Campo inválido, ignorado silenciosamente |
| Polly / Circuit Breaker | |
| Testes comportamentais | 🔴 Ausentes para ambos os middlewares |
A implementação está funcionalmente sólida — os bugs críticos foram corrigidos. O bloqueador para merge é a contradição nos testes (vai quebrar o CI). Os testes comportamentais são recomendados antes de habilitar o gateway em produção para manter a meta de ≥90% de cobertura.
🧠 Learnings used
Learnt from: frigini
Repo: frigini/MeAjudaAi PR: 0
File: :0-0
Timestamp: 2026-04-30T02:20:29.084Z
Learning: MeAjudaAi (refatoração futura de persistência): Plano acordado — remover repository wrapper classes e usar EF Core DbContext como IUnitOfWork + IRepository<TAggregate, TKey>. IRepository<T,K> e IUnitOfWork irão para src/Shared/Database/. DbContexts usam partial classes por aggregate. Módulo piloto: Locations. Exceções: IOutboxRepository<TMessage> permanece como está (infraestrutura de mensageria); AddIfNoOverlapAsync do Bookings precisa de Domain/Application Service dedicado. Queries complexas (GetByCity, GetByState, etc.) migram para IXxxQueries com AsNoTracking. AddModuleRepositories (Scrutor) deve ser substituído por registro explícito do DbContext como IUnitOfWork.
Learnt from: frigini
Repo: frigini/MeAjudaAi PR: 0
File: :0-0
Timestamp: 2026-04-20T22:04:25.820Z
Learning: MeAjudaAi (PRs futuros): para cobertura global, NÃO excluir *Configuration e *Extensions (há smoke tests exercitando-os); também não excluir *.Monitoring.*, MeAjudaAi.Shared.Jobs.* e MeAjudaAi.Shared.Mediator.*. Manter excluídos apenas Request/Response/Dto/DTO/IntegrationEvent e *DbContextFactory; Endpoints podem ficar excluídos globalmente, a menos que sejam white-listados por módulo com E2E (ex.: +MeAjudaAi.Modules.Payments.API.*Endpoint; -*Endpoint).
Learnt from: frigini
Repo: frigini/MeAjudaAi PR: 0
File: :0-0
Timestamp: 2026-04-24T20:02:36.451Z
Learning: MeAjudaAi Shared coverage: Classes de infraestrutura de messaging que dependem de broker RabbitMQ real (RabbitMqDeadLetterService, DeadLetterExtensions, FailedMessageInfo, FailureAttempt, EnvironmentMetadata) são candidatas a [ExcludeFromCodeCoverage] pois não são testáveis unitariamente. Utilitários puros (PhoneNumberValidator, PiiMaskingHelper, SlugHelper, UuidGenerator) devem ter testes unitários adicionados em vez de serem excluídos.
Learnt from: frigini
Repo: frigini/MeAjudaAi PR: 0
File: :0-0
Timestamp: 2026-04-24T21:04:28.437Z
Learning: MeAjudaAi Bookings.API: Classes não-endpoint dentro do assembly da API (Extensions, BookingsEndpoints, ProviderAuthorizationResult, ProviderAuthorizationResultExtensions) não são capturadas pelo classfilter `+MeAjudaAi.Modules.Bookings.API.*Endpoint` e devem receber [ExcludeFromCodeCoverage] individualmente (são glue/wiring). Já `ProviderAuthorizationResolver` contém lógica real de autorização e deve ter testes unitários próprios.
Learnt from: frigini
Repo: frigini/MeAjudaAi PR: 0
File: :0-0
Timestamp: 2026-04-24T20:02:36.451Z
Learning: MeAjudaAi ci-backend.yml (linha 272): Para tornar os endpoints de um módulo visíveis na cobertura do ReportGenerator, adicionar o assembly antes de `-*Endpoint` no classfilters, ex: `+MeAjudaAi.Modules.Bookings.API.*Endpoint` (após `+MeAjudaAi.Modules.Payments.API.*Endpoint`). Isso é necessário apenas para módulos com cobertura E2E. Módulos sem E2E mantêm os endpoints excluídos.
Learnt from: frigini
Repo: frigini/MeAjudaAi PR: 0
File: :0-0
Timestamp: 2026-04-19T15:37:29.889Z
Learning: MeAjudaAi: objetivo de cobertura global é ≥90% (linhas), mantendo thresholds 90/80 no CI; quando a meta estiver ameaçada, preferir excluir “glue/DTO” (Endpoints/Extensions/Options/IntegrationEvent/DbContextFactory) e adicionar testes de alto impacto, em vez de reduzir o threshold.
Learnt from: frigini
Repo: frigini/MeAjudaAi PR: 0
File: :0-0
Timestamp: 2026-04-24T21:04:28.437Z
Learning: MeAjudaAi coverlet.runsettings: `ExcludeByAttribute` deve incluir `ExcludeFromCodeCoverage` (além de Obsolete,GeneratedCode,CompilerGenerated). Sem isso, todas as classes decoradas com [ExcludeFromCodeCoverage] continuam sendo instrumentadas pelo coverlet e contam como linhas não cobertas no relatório, reduzindo a cobertura global. Correção: `<ExcludeByAttribute>Obsolete,GeneratedCode,CompilerGenerated,ExcludeFromCodeCoverage</ExcludeByAttribute>`.
Learnt from: frigini
Repo: frigini/MeAjudaAi PR: 77
File: src/Modules/Providers/Tests/Unit/Application/Queries/GetProvidersByIdsQueryTests.cs:65-77
Timestamp: 2025-12-18T00:35:33.829Z
Learning: MeAjudaAi repo: Exceção à política de idioma para comentários — em testes, os cabeçalhos AAA (Arrange, Act, Assert) devem permanecer em inglês e não devem ser traduzidos. Comentários/XML continuam em português; logs em inglês; mensagens ao usuário (validações/APIs) em português.
Learnt from: frigini
Repo: frigini/MeAjudaAi PR: 0
File: :0-0
Timestamp: 2026-01-16T21:50:23.593Z
Learning: For frigini/MeAjudaAi Web reviews, prefer commit-by-commit (newest-first) with concise verdicts and concrete follow-ups; prioritize reuse of Shared.Contracts for enums/constants to keep Web aligned with backend/shared code.
Learnt from: frigini
Repo: frigini/MeAjudaAi PR: 77
File: src/Modules/Documents/Application/Handlers/UploadDocumentCommandHandler.cs:133-143
Timestamp: 2025-12-17T18:26:37.409Z
Learning: MeAjudaAi logging policy: logs must be in English, comments may remain in Portuguese. Portuguese logs were additionally found in Users (API/Extensions.cs:83), Providers (API/Extensions.cs:74), ServiceCatalogs (API/Extensions.cs:78,86,93), and Locations (multiple clients/services lines listed). SearchProviders module currently has no Portuguese logs.
Contributor
There was a problem hiding this comment.
Actionable comments posted: 6
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@src/Shared/Middleware/GeographicRestrictionMiddleware.cs`:
- Around line 163-165: The code calls
options.CurrentValue.AllowedStates.Any(...) (and similarly
AllowedCities.Any(...)) without null-checking the collections after using
hasAllowedStates/hasAllowedCities, which can lead to a NullReferenceException if
the binder set the lists to null; update the conditional branches in
GeographicRestrictionMiddleware (the blocks referencing
hasAllowedStates/hasAllowedCities and the Any(...) calls) to use the guarded
collections (e.g., options.CurrentValue?.AllowedStates != null &&
options.CurrentValue.AllowedStates.Any(...)) or reuse the already-evaluated
hasAllowedStates/hasAllowedCities booleans and only call .Any() on a non-null
collection (for example assign var allowedStates =
options.CurrentValue?.AllowedStates; check allowedStates != null &&
allowedStates.Any(...)), and apply the same fix to the other occurrences around
the 183-188 and 218-219 regions.
- Around line 54-58: A resposta 451 monta AllowedCities sem separar "Cidade|UF",
então entradas com pipe ficam Name="Cidade|UF" e State=null; ajuste a projeção
usada ao criar o GeographicRestrictionErrorResponse para pré-parsear each entry
de options.CurrentValue.AllowedCities: para cada string, faça split por '|' (uma
vez), Trim() das partes e passar AllowedCity.Create(cityName, stateAbbrev) (ou
null se não houver segunda parte), mantendo a proteção nula para AllowedCities;
altere a expressão que usa AllowedCity.Create(name, null) para essa lógica de
parsing antes de construir GeographicRestrictionErrorResponse (referências:
GeographicRestrictionErrorResponse, AllowedCity.Create,
options.CurrentValue.AllowedCities, UserLocation.Create).
- Around line 129-136: The code computes simpleValidation via
ValidateLocationSimple(city, state) but then ignores it when
geographicValidationService is present, so the whitelist
(AllowedCities/AllowedStates) can be bypassed; change the logic in the block
around geographicValidationService and ValidateCityAsync so that if
simpleValidation is true you return true immediately (preserve the local
whitelist short-circuit), otherwise call
geographicValidationService.ValidateCityAsync(...) and return its result; if the
service is null return simpleValidation. Update the method containing
ValidateLocationSimple and the geographicValidationService usage to implement
this short-circuit behavior.
In
`@tests/MeAjudaAi.Gateway.Tests/Unit/Middleware/GeographicRestrictionMiddlewareTests.cs`:
- Around line 15-24: The test
GeographicRestrictionOptions_DefaultValues_ShouldBeInitialized expects
AllowedStates and AllowedCities to be null but the implementation of
GeographicRestrictionOptions initializes them as empty lists; update the
assertions in that test (or the test method) to expect empty collections instead
of null by using FluentAssertions collection checks (e.g., Should().BeEmpty())
for the AllowedStates and AllowedCities properties on the
GeographicRestrictionOptions instance.
- Around line 12-98: Falta cobertura do middleware real: escreva testes
unitários/integrados que invoquem GeographicRestrictionMiddleware.InvokeAsync
diretamente (ou via TestServer) para cobrir: flag de feature desligada (não
bloquear), header de localização malformado (tratamento/graceful), comportamento
com FailOpen = false retornando 451 e casos que permitem e negam acesso com
diferentes AllowedStates/AllowedCities; use GeographicRestrictionOptions para
configurar o middleware, injete/monte um HttpContext com os cabeçalhos
necessários, chame InvokeAsync e asserte StatusCode e corpo usando
GeographicRestrictionErrorResponse/AllowedCity/UserLocation para validar o
payload, além de testar que quando permitido a pipeline continua (next
middleware executado).
In
`@tests/MeAjudaAi.Gateway.Tests/Unit/Middleware/RateLimitingMiddlewareTests.cs`:
- Around line 12-112: Add unit tests that exercise
RateLimitingMiddleware.InvokeAsync to cover the main runtime flows missing from
the suite: create tests that (1) verify middleware no-ops when
RateLimitingOptions.General.Enabled is false, (2) verify requests bypassed when
client IP is in GeneralSettings.WhitelistedIps with EnableIpWhitelist=true, (3)
simulate anonymous vs authenticated buckets by setting HttpContext.User/claims
and assert counters increment separately using RateLimitCounter behavior, and
(4) assert the middleware returns 429 with a Retry-After header and the
configured GeneralSettings.ErrorMessage when limits are exceeded. Use the
existing _optionsMock and _cache to inject RateLimitingOptions and memory state,
invoke RateLimitingMiddleware.InvokeAsync(HttpContext, RequestDelegate) and
assert response status, headers, and that the cache counters changed as
expected.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 33380ade-9c69-4b96-8add-b9816a126952
📒 Files selected for processing (9)
src/Bootstrapper/MeAjudaAi.ApiService/Options/GeographicRestrictionOptions.cssrc/Bootstrapper/MeAjudaAi.ApiService/Program.cssrc/Bootstrapper/MeAjudaAi.Gateway/Program.cssrc/Bootstrapper/MeAjudaAi.Gateway/appsettings.jsonsrc/Shared/Middleware/GeographicRestrictionMiddleware.cssrc/Shared/Middleware/RateLimitingMiddleware.cstests/MeAjudaAi.Gateway.Tests/Unit/Middleware/GeographicRestrictionMiddlewareTests.cstests/MeAjudaAi.Gateway.Tests/Unit/Middleware/RateLimitingMiddlewareTests.cstests/MeAjudaAi.Gateway.Tests/Unit/Options/GatewayOptionsTests.cs
💤 Files with no reviewable changes (1)
- src/Bootstrapper/MeAjudaAi.ApiService/Options/GeographicRestrictionOptions.cs
🚧 Files skipped from review as they are similar to previous changes (2)
- src/Bootstrapper/MeAjudaAi.Gateway/appsettings.json
- tests/MeAjudaAi.Gateway.Tests/Unit/Options/GatewayOptionsTests.cs
…ngs for regional access control and rate limiting
Owner
Author
|
@coderabbitai analise novamente se falta algo na implementacao por favor. Verifique se deve-se retirar implementações antigas que se sobrepõem ao YARP e ao projeto Gateway. Também analise se preciso limpar, simplificar ou alterar a implementação de autorização/autenticação existentes no módulo users e na implementação do Keycloak, dado que parte disso agora é responsabilidade do gateway. |
Contributor
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chainVou analisar o estado atual completo do código para verificar sobreposições e a situação de autenticação/autorização. 🏁 Script executed: Length of output: 41293 Preciso de mais detalhes antes de dar a resposta final. 🏁 Script executed: Length of output: 185202
Resumo executivo
O que remover/ajustar por sobreposição ao Gateway
Itens a manter (não remover)
Users/Keycloak — o que pode simplificar/limpar
Opcional (se quiser que o Gateway também negue anônimos no edge)
Checklist para o próximo PR (limpeza coordenada)
Se quiser, eu detalho os diffs para cada arquivo acima na próxima etapa. 🧠 Learnings used |
…dleware and configuration extensions
Contributor
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: Length of output: 48096 🏁 Script executed: Length of output: 81058 🏁 Script executed: Length of output: 33868
Causa-raiz
Correções propostas
Patches sugeridos
using MeAjudaAi.Shared.Monitoring;
+using MeAjudaAi.Shared.Middleware;
...
services.AddMemoryCache();
+
+ // Geographic restriction options (used by GeographicRestrictionMiddleware)
+ services.Configure<GeographicRestrictionOptions>(
+ configuration.GetSection(GeographicRestrictionOptions.SectionName));
["GeographicRestriction:Enabled"] = "true",
- ["GeographicRestriction:FailOpen"] = "false",
+ ["GeographicRestriction:FailOpen"] = "true",
["GeographicRestriction:AllowedCities:0"] = "Muriaé",
["GeographicRestriction:AllowedCities:1"] = "Itaperuna",
["GeographicRestriction:AllowedCities:2"] = "Linhares",
["GeographicRestriction:AllowedStates:0"] = "MG",
["GeographicRestriction:AllowedStates:1"] = "RJ",
["GeographicRestriction:AllowedStates:2"] = "ES",Impacto esperado por teste (exemplos)
Opcional (hardening)
Posso abrir um plano de alteração para aplicar esses ajustes na próxima branch?
🏁 Script executed: Length of output: 319 🏁 Script executed: Length of output: 0
Causa-raiz
Quais testes quebram (provável)
Correções propostas
// após services.AddMemoryCache();
services.Configure<GeographicRestrictionOptions>(
configuration.GetSection(GeographicRestrictionOptions.SectionName));
Arquivo: tests/MeAjudaAi.Integration.Tests/Base/BaseApiTest.cs - ["GeographicRestriction:FailOpen"] = "false",
+ ["GeographicRestriction:FailOpen"] = "true",Efeito esperado (após o bind):
Observação
Quer que eu abra um plano de alteração com esses dois patches para a próxima branch?
✏️ Learnings added
🧠 Learnings usedThe requested changes have been implemented and a pull request has been created: View PR |
…associated integration and unit tests
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
src/Bootstrapper/MeAjudaAi.ApiService/Middlewares/RequestLoggingMiddleware.cs (1)
140-161:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winEvite reintroduzir IP loopback no fallback final.
Em Line 140 você filtra
::1/127.0.0.1, mas em Line 161 oreturn remoteIp ?? "unknown"pode devolver loopback novamente quando não houver headers de proxy.🔧 Ajuste sugerido
- return remoteIp ?? "unknown"; + if (remoteIp == "::1" || remoteIp == "127.0.0.1") + return "unknown"; + + return remoteIp ?? "unknown";🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@src/Bootstrapper/MeAjudaAi.ApiService/Middlewares/RequestLoggingMiddleware.cs` around lines 140 - 161, The final return can reintroduce loopback because remoteIp is returned unchecked; in the RequestLoggingMiddleware method that determines client IP (variable remoteIp), ensure you treat loopback values ("::1", "127.0.0.1") the same as null: before the final return, check if remoteIp is null or equals "::1" or "127.0.0.1" and if so return "unknown" (or the proxy header value if present), otherwise return remoteIp; update the tail logic where it currently does return remoteIp ?? "unknown" to perform this loopback filter.src/Shared/Middleware/GeographicRestrictionMiddleware.cs (1)
17-25:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winFaça
EnabledeDefaultBlockedMessagevalerem no fluxo.Hoje
Enablednão desliga a restrição eDefaultBlockedMessagenunca é usado; o middleware continua dependendo só da feature flag e do literal hardcoded. Se esses campos vão permanecer no contrato, eles precisam ser consumidos aqui.💡 Ajuste sugerido
public async Task InvokeAsync(HttpContext context, IGeographicValidationService? geographicValidationService = null) { var isFeatureEnabled = await featureManager.IsEnabledAsync(FeatureFlags.GeographicRestriction); - if (!isFeatureEnabled) + if (!isFeatureEnabled || !options.CurrentValue.Enabled) { await next(context); return; } @@ - var template = options.CurrentValue.BlockedMessage ?? "Acesso da sua região não permitido. Regiões permitidas: {allowedRegions}."; + var template = options.CurrentValue.BlockedMessage + ?? options.CurrentValue.DefaultBlockedMessage + ?? "Acesso da sua região não permitido. Regiões permitidas: {allowedRegions}.";Also applies to: 50-52, 243-252
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@src/Shared/Middleware/GeographicRestrictionMiddleware.cs` around lines 17 - 25, O middleware atualmente só depende da feature flag; ajuste InvokeAsync para também respeitar o contrato de configuração: antes de aplicar a restrição combine a checagem do featureManager.IsEnabledAsync(FeatureFlags.GeographicRestriction) com a propriedade Enabled do objeto de configuração (se Enabled for false, pule a validação e chame next(context) mesmo que a feature esteja ativa). Ao bloquear, não use o literal hardcoded: leia e retorne o texto de DefaultBlockedMessage do contrato (ou fallback seguro se nulo/vazio) como corpo/resposta ao usuário. Localize a lógica dentro de InvokeAsync que chama IGeographicValidationService e onde a resposta de bloqueio é gerada para aplicar essas mudanças.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@src/Bootstrapper/MeAjudaAi.ApiService/Program.cs`:
- Around line 65-67: The endpoints RegisterCustomerEndpoint,
ProviderRegistrationEndpoints, GetPublicProviderByIdOrSlugEndpoint and
StripeWebhookEndpoint declare .RequireRateLimiting(RateLimitPolicies.*) but the
ApiService doesn't register or enable rate limiting; either remove those
.RequireRateLimiting(...) calls so the gateway is solely responsible, or
implement defense-in-depth by adding services.AddRateLimiter(...) with the
RateLimitPolicies configuration inside AddApiServices and calling
app.UseRateLimiter() inside UseApiServices so the named policies
(RateLimitPolicies.*) can be resolved at runtime.
---
Outside diff comments:
In
`@src/Bootstrapper/MeAjudaAi.ApiService/Middlewares/RequestLoggingMiddleware.cs`:
- Around line 140-161: The final return can reintroduce loopback because
remoteIp is returned unchecked; in the RequestLoggingMiddleware method that
determines client IP (variable remoteIp), ensure you treat loopback values
("::1", "127.0.0.1") the same as null: before the final return, check if
remoteIp is null or equals "::1" or "127.0.0.1" and if so return "unknown" (or
the proxy header value if present), otherwise return remoteIp; update the tail
logic where it currently does return remoteIp ?? "unknown" to perform this
loopback filter.
In `@src/Shared/Middleware/GeographicRestrictionMiddleware.cs`:
- Around line 17-25: O middleware atualmente só depende da feature flag; ajuste
InvokeAsync para também respeitar o contrato de configuração: antes de aplicar a
restrição combine a checagem do
featureManager.IsEnabledAsync(FeatureFlags.GeographicRestriction) com a
propriedade Enabled do objeto de configuração (se Enabled for false, pule a
validação e chame next(context) mesmo que a feature esteja ativa). Ao bloquear,
não use o literal hardcoded: leia e retorne o texto de DefaultBlockedMessage do
contrato (ou fallback seguro se nulo/vazio) como corpo/resposta ao usuário.
Localize a lógica dentro de InvokeAsync que chama IGeographicValidationService e
onde a resposta de bloqueio é gerada para aplicar essas mudanças.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: c7b5a157-3bb9-4959-95cf-9a42adfb382d
📒 Files selected for processing (26)
src/Bootstrapper/MeAjudaAi.ApiService/Extensions/MiddlewareExtensions.cssrc/Bootstrapper/MeAjudaAi.ApiService/Extensions/ServiceCollectionExtensions.cssrc/Bootstrapper/MeAjudaAi.ApiService/Middlewares/ContentSecurityPolicyMiddleware.cssrc/Bootstrapper/MeAjudaAi.ApiService/Middlewares/RateLimitingMiddleware.cssrc/Bootstrapper/MeAjudaAi.ApiService/Middlewares/RequestLoggingMiddleware.cssrc/Bootstrapper/MeAjudaAi.ApiService/Options/GeographicRestrictionOptions.cssrc/Bootstrapper/MeAjudaAi.ApiService/Options/RateLimit/AnonymousLimits.cssrc/Bootstrapper/MeAjudaAi.ApiService/Options/RateLimit/AuthenticatedLimits.cssrc/Bootstrapper/MeAjudaAi.ApiService/Options/RateLimit/EndpointLimits.cssrc/Bootstrapper/MeAjudaAi.ApiService/Options/RateLimit/GeneralSettings.cssrc/Bootstrapper/MeAjudaAi.ApiService/Options/RateLimit/RoleLimits.cssrc/Bootstrapper/MeAjudaAi.ApiService/Program.cssrc/Bootstrapper/MeAjudaAi.ApiService/appsettings.jsonsrc/Bootstrapper/MeAjudaAi.Gateway/Program.cssrc/Bootstrapper/MeAjudaAi.Gateway/appsettings.jsonsrc/Shared/Middleware/GeographicRestrictionMiddleware.cssrc/Shared/Middleware/RateLimitingMiddleware.cstests/MeAjudaAi.ApiService.Tests/Unit/Options/OptionsTests.cstests/MeAjudaAi.ApiService.Tests/Unit/Options/SecurityOptionsTests.cstests/MeAjudaAi.Gateway.Tests/Unit/Middleware/GeographicRestrictionMiddlewareTests.cstests/MeAjudaAi.Gateway.Tests/Unit/Middleware/RateLimitingMiddlewareTests.cstests/MeAjudaAi.Gateway.Tests/Unit/Options/GatewayOptionsTests.cstests/MeAjudaAi.Integration.Tests/Base/BaseApiTest.cstests/MeAjudaAi.Integration.Tests/Middleware/GeographicRestrictionIntegrationTests.cstests/MeAjudaAi.Integration.Tests/Modules/Locations/IbgeUnavailabilityTests.cstests/MeAjudaAi.Integration.Tests/appsettings.Testing.json
💤 Files with no reviewable changes (8)
- src/Bootstrapper/MeAjudaAi.ApiService/Extensions/MiddlewareExtensions.cs
- src/Bootstrapper/MeAjudaAi.ApiService/Options/RateLimit/RoleLimits.cs
- src/Bootstrapper/MeAjudaAi.ApiService/Options/RateLimit/EndpointLimits.cs
- src/Bootstrapper/MeAjudaAi.ApiService/Options/RateLimit/AnonymousLimits.cs
- src/Bootstrapper/MeAjudaAi.ApiService/Options/RateLimit/AuthenticatedLimits.cs
- src/Bootstrapper/MeAjudaAi.ApiService/Options/GeographicRestrictionOptions.cs
- src/Bootstrapper/MeAjudaAi.ApiService/Options/RateLimit/GeneralSettings.cs
- src/Bootstrapper/MeAjudaAi.ApiService/Middlewares/RateLimitingMiddleware.cs
✅ Files skipped from review due to trivial changes (1)
- tests/MeAjudaAi.Integration.Tests/appsettings.Testing.json
🚧 Files skipped from review as they are similar to previous changes (5)
- src/Bootstrapper/MeAjudaAi.Gateway/appsettings.json
- tests/MeAjudaAi.Gateway.Tests/Unit/Middleware/RateLimitingMiddlewareTests.cs
- tests/MeAjudaAi.Gateway.Tests/Unit/Options/GatewayOptionsTests.cs
- tests/MeAjudaAi.Gateway.Tests/Unit/Middleware/GeographicRestrictionMiddlewareTests.cs
- src/Shared/Middleware/RateLimitingMiddleware.cs
Owner
Author
|
@coderabbitai poderia, mais uma vez, analisar se tudo foi inplementado e se ainda falta limpeza fora do gateway e nos testes? |
Contributor
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: Length of output: 263044
Status de implementação
Pequenas limpezas restantes (fora do Gateway)
Backlog técnico recomendado (próxima sprint)
Resumo
Posso preparar um plano de mudanças com os diffs desses pontos, se quiser. 🧠 Learnings used |
Owner
Author
@coderabbitai Sobre isso: Backlog técnico recomendado (próxima sprint) Resiliência no YARP: ligar Polly/Resilience conforme GatewayResilience (TimeoutSeconds/RetryCount) para efetivar timeouts e retries do proxy. Agora é a hora para fazer, o que deve ser feito? |
Contributor
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chainDeixa eu inspecionar o estado atual do Gateway antes de gerar o plano. 🏁 Script executed: Length of output: 49544
Plano: Resiliência YARP + Edge Auth GuardO que será implementado:
🧠 Learnings usedThe requested changes have been implemented and a pull request has been created: View PR |
…ilience and logging infrastructure
Owner
Author
|
@coderabbitai agora mais uma vez, uma revisão do que foi implementado, se falta algo a implementar e a limpar! No ultimo commit tratei tambem de Resiliência no YARP e “edge auth guard” no Gateway para /api/** com allowlist de rotas públicas |
Contributor
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: Length of output: 69426
Críticos para corrigir agora
app.UseCors();
app.UseAuthentication();
app.UseAuthorization();
app.UseEdgeAuthGuard(); // agora, com User já autenticado
app.UseMiddleware<RateLimitingMiddleware>();
app.MapDefaultEndpoints();
app.UseMiddleware<GeographicRestrictionMiddleware>();
app.MapReverseProxy();
// Novo handler
internal sealed class RetryDelegatingHandler(GatewayResilienceOptions opts, ILogger logger) : DelegatingHandler
{
private static readonly HashSet<string> DefaultRetryableMethods =
new(["GET","HEAD","OPTIONS"], StringComparer.OrdinalIgnoreCase);
protected override async Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken ct)
{
var allowRetry = (opts.RetryableMethods?.Count > 0 ? opts.RetryableMethods : DefaultRetryableMethods)
.Contains(request.Method.Method);
if (!allowRetry || opts.RetryCount <= 0)
return await base.SendAsync(request, ct);
HttpResponseMessage? last = null;
for (int attempt = 0; attempt <= opts.RetryCount; attempt++)
{
last = await base.SendAsync(request, ct);
if (!IsTransient(last)) return last;
if (attempt < opts.RetryCount)
await Task.Delay(TimeSpan.FromMilliseconds(opts.RetryBaseDelayMs * Math.Pow(2, attempt)), ct);
}
return last!;
}
private static bool IsTransient(HttpResponseMessage r) =>
(int)r.StatusCode >= 500 || r.StatusCode is System.Net.HttpStatusCode.TooManyRequests or System.Net.HttpStatusCode.RequestTimeout;
}
// Na factory
public HttpMessageHandler CreateHandler(ForwarderHttpClientContext _)
{
var sockets = new SocketsHttpHandler { /* ...timeouts... */ };
if (_options.RetryCount > 0)
return new RetryDelegatingHandler(_options, _logger) { InnerHandler = sockets };
return sockets;
}
Ajustes recomendados (pequenos, mas importantes)
"ReverseProxy": {
"Clusters": {
"api-cluster": {
"HttpClient": {
"ActivityTimeout": "00:00:45"
},
"HealthCheck": { "...": "..." },
"Destinations": { "...": "..." }
}
}
}
var path = context.Request.Path.Value ?? string.Empty;
if (!path.StartsWith("/api/", StringComparison.OrdinalIgnoreCase))
{
await _next(context);
return;
}
O que está correto (parabéns)
Lacunas de testes a considerar
Checklist resumido
Se quiser, preparo um mini-PR com esses diffs. Quer que eu já estruture o plano de mudanças? 🧠 Learnings used |
…ent factory for the gateway
Contributor
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@src/Bootstrapper/MeAjudaAi.Gateway/Middlewares/EdgeAuthGuardMiddleware.cs`:
- Around line 69-73: A resposta de erro JSON em EdgeAuthGuardMiddleware usa a
chave message em inglês; atualize o objeto errorResponse (no método que monta a
resposta de 401) para usar uma mensagem em português, por exemplo alterando
"Authentication required. Please provide a valid token." para uma mensagem
portuguesa apropriada e consistente com o frontend (mantenha as outras chaves
como error e publicRoutes/_options.PublicRoutes intactas).
In
`@src/Bootstrapper/MeAjudaAi.Gateway/Middlewares/ResilientForwarderHttpClientFactory.cs`:
- Around line 81-107: The retry loop in
ResilientForwarderHttpClientFactory.SendAsync only retries on transient
HttpResponseMessage values and never disposes previous transient responses, and
it doesn't handle transient exceptions; update SendAsync to wrap base.SendAsync
in a try/catch to detect transient exceptions (using the existing IsTransient
logic or a new IsTransientException helper) and treat them like transient
responses for retry, and when a transient HttpResponseMessage is encountered
dispose it (e.g., call Dispose()) before the next attempt to free connections;
keep using _options.RetryCount and the exponential backoff based on
_options.RetryBaseDelayMs, log attempts via _logger.LogWarning as before, and
ensure the final return still returns the last successful response or rethrows
the final exception if all retries fail.
In
`@tests/MeAjudaAi.Gateway.Tests/Unit/Middleware/EdgeAuthGuardMiddlewareTests.cs`:
- Around line 35-123: Os testes InvokeAsync_WhenDisabled_ShouldCallNext e
InvokeAsync_PublicRoute_ShouldCallNext apenas verificam StatusCode==200 (valor
padrão) e não confirmam que o delegate "next" foi executado; altere os casos de
teste para passar um delegate next que tenha um observable side-effect (ex.:
definir um response header ou setar uma flag) ao criar EdgeAuthGuardMiddleware
(construtor usado nas fábricas/tests), e então asserte esse side-effect após
chamar InvokeAsync(context) — localize a criação do middleware em
CreateMiddleware e na inicialização direta do EdgeAuthGuardMiddleware e
substitua Task.CompletedTask por um delegate que aplica o efeito detectável no
DefaultHttpContext.
In
`@tests/MeAjudaAi.Gateway.Tests/Unit/Middleware/ResilientForwarderHttpClientFactoryTests.cs`:
- Around line 29-109: Add a test that actually exercises the retry pipeline when
RetryCount > 0 by creating GatewayResilienceOptions with RetryCount > 0 and
RetryableMethods set, calling CreateHandler on the factory, wrapping the
resulting DelegatingHandler around a fake inner handler that counts SendAsync
invocations, then send a single HttpRequestMessage with an HTTP method not in
RetryableMethods and assert the inner handler was invoked exactly once (no
retries), and send one with a method in RetryableMethods and assert retries
occur (inner handler invoked >1). Target CreateHandler, GatewayResilienceOptions
and ForwarderHttpClientContext to locate the code; implement the fake inner
handler in the test to reliably assert retry behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 10e60754-d8d2-45ad-8572-8017bd45c214
📒 Files selected for processing (18)
src/Bootstrapper/MeAjudaAi.ApiService/Endpoints/ProviderRegistrationEndpoints.cssrc/Bootstrapper/MeAjudaAi.ApiService/Extensions/SecurityExtensions.cssrc/Bootstrapper/MeAjudaAi.ApiService/Middlewares/RequestLoggingMiddleware.cssrc/Bootstrapper/MeAjudaAi.ApiService/appsettings.jsonsrc/Bootstrapper/MeAjudaAi.Gateway/Middlewares/EdgeAuthGuardMiddleware.cssrc/Bootstrapper/MeAjudaAi.Gateway/Middlewares/ResilientForwarderHttpClientFactory.cssrc/Bootstrapper/MeAjudaAi.Gateway/Options/EdgeAuthGuardOptions.cssrc/Bootstrapper/MeAjudaAi.Gateway/Options/GatewayResilienceOptions.cssrc/Bootstrapper/MeAjudaAi.Gateway/Program.cssrc/Bootstrapper/MeAjudaAi.Gateway/appsettings.jsonsrc/Modules/Providers/API/Endpoints/Public/GetPublicProviderByIdOrSlugEndpoint.cssrc/Modules/Users/API/Endpoints/Public/RegisterCustomerEndpoint.cssrc/Shared/Middleware/GeographicRestrictionMiddleware.cstests/MeAjudaAi.Gateway.Tests/Unit/Middleware/EdgeAuthGuardMiddlewareTests.cstests/MeAjudaAi.Gateway.Tests/Unit/Middleware/ResilientForwarderHttpClientFactoryTests.cstests/MeAjudaAi.Gateway.Tests/Unit/Options/EdgeAuthGuardOptionsTests.cstests/MeAjudaAi.Gateway.Tests/Unit/Options/GatewayResilienceOptionsTests.cstests/MeAjudaAi.Integration.Tests/Base/BaseApiTest.cs
💤 Files with no reviewable changes (3)
- src/Modules/Providers/API/Endpoints/Public/GetPublicProviderByIdOrSlugEndpoint.cs
- src/Modules/Users/API/Endpoints/Public/RegisterCustomerEndpoint.cs
- src/Bootstrapper/MeAjudaAi.ApiService/Extensions/SecurityExtensions.cs
✅ Files skipped from review due to trivial changes (1)
- src/Bootstrapper/MeAjudaAi.Gateway/Options/EdgeAuthGuardOptions.cs
🚧 Files skipped from review as they are similar to previous changes (2)
- src/Bootstrapper/MeAjudaAi.Gateway/appsettings.json
- src/Bootstrapper/MeAjudaAi.ApiService/appsettings.json
Owner
Author
|
@coderabbitai analise se ainda falta algo a ser implementada e limpada do fora do projeto gateway e dos testes, e agora preciso aumentar a cobertura pois caiu para 89.83%, bem próximo dos 90% mas suficiente para quebrar a pipeline |
Contributor
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: Length of output: 59370
O que ainda falta implementar/limpar fora do Gateway
Por que a cobertura caiu
Plano de aumento de cobertura (mínimo, seguro, sem mexer em produção)
Importante: Não gaste tempo cobrindo Options — classfilter exclui -*Options. Abaixo, o plano com os arquivos e testes propostos.
Observações finais
Quer que eu execute esse plano agora? Posso ajustar se preferir outro foco (ex.: cobrir também SecurityHeadersMiddleware/StaticFilesMiddleware no ApiService). 🧠 Learnings usedThe requested changes have been implemented and a pull request has been created: View PR |
…client factory with unit tests
Owner
Author
|
@coderabbitai full review |
Contributor
✅ Actions performedFull review triggered. |
Owner
Author
|
@coderabbitai 89,78% agora, abaixou um pouco. |
Contributor
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain
🏁 Script executed: Length of output: 140919
Abaixo vão 4 testes pequenos e de alto impacto. Eles só adicionam testes (nenhuma alteração de produção) e costumam recuperar >0.3–0.6 pp.
Append em tests/MeAjudaAi.Gateway.Tests/Unit/Middleware/ResilientForwarderHttpClientFactoryTests.cs: [Fact]
public async Task SendAsync_Get_Retries_UntilSuccess()
{
var logger = new Mock<ILogger<ResilientForwarderHttpClientFactory>>().Object;
var options = new GatewayResilienceOptions { RetryCount = 2, RetryBaseDelayMs = 1 };
var factory = new ResilientForwarderHttpClientFactory(Options.Create(options), logger);
var handler = factory.CreateHandler(new ForwarderHttpClientContext());
var delegating = handler as DelegatingHandler;
delegating.Should().NotBeNull();
int calls = 0;
delegating!.InnerHandler = new StubHandler(() =>
{
calls++;
return calls < 3
? new HttpResponseMessage(HttpStatusCode.InternalServerError)
: new HttpResponseMessage(HttpStatusCode.OK);
});
using var client = new HttpMessageInvoker(delegating);
var resp = await client.SendAsync(new HttpRequestMessage(HttpMethod.Get, "http://unit.test"), CancellationToken.None);
calls.Should().Be(3);
resp.StatusCode.Should().Be(HttpStatusCode.OK);
}
[Fact]
public async Task SendAsync_Post_DoesNotRetry_ByDefault()
{
var logger = new Mock<ILogger<ResilientForwarderHttpClientFactory>>().Object;
var options = new GatewayResilienceOptions { RetryCount = 3, RetryBaseDelayMs = 1 }; // POST não está em RetryableMethods por padrão
var factory = new ResilientForwarderHttpClientFactory(Options.Create(options), logger);
var handler = factory.CreateHandler(new ForwarderHttpClientContext());
var delegating = handler as DelegatingHandler; delegating.Should().NotBeNull();
int calls = 0;
delegating!.InnerHandler = new StubHandler(() =>
{
calls++;
return new HttpResponseMessage(HttpStatusCode.ServiceUnavailable);
});
using var client = new HttpMessageInvoker(delegating);
var resp = await client.SendAsync(new HttpRequestMessage(HttpMethod.Post, "http://unit.test"), CancellationToken.None);
calls.Should().Be(1);
resp.StatusCode.Should().Be(HttpStatusCode.ServiceUnavailable);
}
[Fact]
public async Task SendAsync_TransientException_Retries_ThenSucceeds()
{
var logger = new Mock<ILogger<ResilientForwarderHttpClientFactory>>().Object;
var options = new GatewayResilienceOptions { RetryCount = 2, RetryBaseDelayMs = 1 };
var factory = new ResilientForwarderHttpClientFactory(Options.Create(options), logger);
var handler = factory.CreateHandler(new ForwarderHttpClientContext());
var delegating = handler as DelegatingHandler; delegating.Should().NotBeNull();
int calls = 0;
delegating!.InnerHandler = new ExceptionThenSuccessHandler(() =>
{
calls++;
if (calls < 3) throw new HttpRequestException("Transient");
return new HttpResponseMessage(HttpStatusCode.OK);
});
using var client = new HttpMessageInvoker(delegating);
var resp = await client.SendAsync(new HttpRequestMessage(HttpMethod.Get, "http://unit.test"), CancellationToken.None);
calls.Should().Be(3);
resp.StatusCode.Should().Be(HttpStatusCode.OK);
}
[Fact]
public async Task SendAsync_AllRetries_Exhausted_Throws()
{
var logger = new Mock<ILogger<ResilientForwarderHttpClientFactory>>().Object;
var options = new GatewayResilienceOptions { RetryCount = 2, RetryBaseDelayMs = 1 };
var factory = new ResilientForwarderHttpClientFactory(Options.Create(options), logger);
var handler = factory.CreateHandler(new ForwarderHttpClientContext());
var delegating = handler as DelegatingHandler; delegating.Should().NotBeNull();
delegating!.InnerHandler = new ExceptionThenSuccessHandler(() => throw new HttpRequestException("Always"));
using var client = new HttpMessageInvoker(delegating);
var act = async () => await client.SendAsync(new HttpRequestMessage(HttpMethod.Get, "http://unit.test"), CancellationToken.None);
await act.Should().ThrowAsync<HttpRequestException>();
}
private sealed class StubHandler : HttpMessageHandler
{
private readonly Func<HttpResponseMessage> _responder;
public StubHandler(Func<HttpResponseMessage> responder) => _responder = responder;
protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
=> Task.FromResult(_responder());
}
private sealed class ExceptionThenSuccessHandler : HttpMessageHandler
{
private readonly Func<HttpResponseMessage> _responder;
public ExceptionThenSuccessHandler(Func<HttpResponseMessage> responder) => _responder = responder;
protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
=> Task.FromResult(_responder());
}
Append em tests/MeAjudaAi.Gateway.Tests/Unit/Middleware/RateLimitingMiddlewareTests.cs (na classe BehaviorTests): [Fact]
public async Task InvokeAsync_LimitExceeded_WritesJsonBody()
{
var middleware = CreateMiddleware();
var context = new DefaultHttpContext();
context.Connection.RemoteIpAddress = System.Net.IPAddress.Parse("10.0.0.1");
context.Response.Body = new MemoryStream();
// Estourar rapidamente (janela default 60s, lim/min=30)
for (int i = 0; i < 35; i++)
await middleware.InvokeAsync(context);
context.Response.StatusCode.Should().Be(429);
context.Response.ContentType.Should().Contain("application/json");
context.Response.Body.Position = 0;
using var reader = new StreamReader(context.Response.Body);
var json = await reader.ReadToEndAsync();
json.Should().Contain("\"error\"");
json.Should().Contain("\"retryAfterSeconds\"");
}
Append em tests/MeAjudaAi.Gateway.Tests/Unit/Middleware/GeographicRestrictionMiddlewareTests.cs (na BehaviorTests): [Fact]
public async Task InvokeAsync_AllowedCity_CallsNext()
{
var nextCalled = false;
var middleware = CreateMiddleware(_ => { nextCalled = true; return Task.CompletedTask; }, configure: opts =>
{
opts.Enabled = true;
opts.FailOpen = false;
opts.AllowedCities = ["Muriaé|MG"]; // com estado no pipe
opts.AllowedStates = []; // força o ramo por cidades
});
_featureManagerMock
.Setup(x => x.IsEnabledAsync(FeatureFlags.GeographicRestriction))
.ReturnsAsync(true);
var context = new DefaultHttpContext();
context.Request.Headers["X-User-Location"] = "Muriaé|MG";
await middleware.InvokeAsync(context);
nextCalled.Should().BeTrue();
}
Por que isso deve recuperar ≥90%
Observações rápidas
Quer que eu já gere um plano com PR de testes apenas? 🧠 Learnings used |
… and resilient forwarder middleware components
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (1)
src/Bootstrapper/MeAjudaAi.Gateway/Middlewares/ResilientForwarderHttpClientFactory.cs (1)
90-105:⚠️ Potential issue | 🟠 Major | ⚡ Quick winNão descarte a última resposta transitória.
Se todas as tentativas retornarem
429/503/504/408, o loop fazDispose()também da resposta final e cai noHttpRequestExceptiongenérico. Isso faz o gateway perder status/body/headers do upstream (por exemplo,Retry-After) e muda a semântica da proxyagem.💡 Ajuste sugerido
- if (!IsTransient(last)) + if (!IsTransient(last) || attempt == _options.RetryCount) { return last; } _logger.LogWarning( "Retry attempt {AttemptNumber}/{MaxAttempts} for {Method} {Url} - Status: {StatusCode}", attempt + 1, _options.RetryCount, request.Method.Method, request.RequestUri, last.StatusCode); last.Dispose(); last = null;Also applies to: 118-135
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@src/Bootstrapper/MeAjudaAi.Gateway/Middlewares/ResilientForwarderHttpClientFactory.cs` around lines 90 - 105, O loop em ResilientForwarderHttpClientFactory está chamando last.Dispose() mesmo quando a última tentativa falha com um status transitório (avaliado por IsTransient) e isso faz perder o HttpResponseMessage final (status/body/headers como Retry-After); altere a lógica no método que contém as variáveis last, attempt, _options.RetryCount e IsTransient para não descartar (não chamar Dispose) na última iteração quando todas as tentativas terminaram com respostas transitórias — em vez disso retorne o HttpResponseMessage final (last) para preservar cabeçalhos e corpo; aplique o mesmo ajuste também no outro bloco equivalente mencionado (linhas ~118-135) para manter a semântica de proxyagem.
🧹 Nitpick comments (1)
tests/MeAjudaAi.Gateway.Tests/Unit/Middleware/GeographicRestrictionMiddlewareTests.cs (1)
167-181: ⚡ Quick winFortaleça os testes de bloqueio (451) validando short-circuit da pipeline.
Hoje esses testes validam
StatusCode, mas não provam que onextnão executou. Um bug que continue a pipeline após bloquear pode passar despercebido.🔧 Ajuste sugerido (exemplo de padrão)
[Fact] public async Task InvokeAsync_BlockedState_Returns451() { - var middleware = CreateMiddleware(); + var nextCalled = false; + var middleware = CreateMiddleware(_ => { nextCalled = true; return Task.CompletedTask; }); _featureManagerMock .Setup(x => x.IsEnabledAsync(FeatureFlags.GeographicRestriction)) .ReturnsAsync(true); var context = new DefaultHttpContext(); context.Request.Headers["X-User-Location"] = "Salvador|BA"; await middleware.InvokeAsync(context); context.Response.StatusCode.Should().Be(451); + nextCalled.Should().BeFalse(); }Based on learnings: objetivo de cobertura global é ≥90% (linhas), priorizando testes de alto impacto.
Also applies to: 237-268, 271-305, 329-349
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@tests/MeAjudaAi.Gateway.Tests/Unit/Middleware/GeographicRestrictionMiddlewareTests.cs` around lines 167 - 181, O teste InvokeAsync_BlockedState_Returns451 apenas valida StatusCode; altere-o para também garantir que a pipeline foi interrompida (o RequestDelegate "next" não foi chamado) — ao criar o middleware via CreateMiddleware(), passe um RequestDelegate mockado ou um delegate que seta uma flag/lança se invocado, invoque middleware.InvokeAsync(context) e depois asserte que a flag não foi alterada / o mock não recebeu chamadas, mantendo a verificação de context.Response.StatusCode == 451; aplique o mesmo padrão aos outros testes citados (linhas 237-268, 271-305, 329-349) usando os mesmos símbolos CreateMiddleware e InvokeAsync para localizar o código.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@src/Bootstrapper/MeAjudaAi.Gateway/Middlewares/EdgeAuthGuardMiddleware.cs`:
- Around line 69-74: Remove the _options.PublicRoutes property from the 401
error response in EdgeAuthGuardMiddleware so unauthenticated clients do not
receive the allowlist; locate the anonymous object named errorResponse (created
in EdgeAuthGuardMiddleware) and delete the publicRoutes field, leaving only
error and message (or conditionally include publicRoutes only under an
internal/debug flag if absolutely needed).
In
`@src/Bootstrapper/MeAjudaAi.Gateway/Middlewares/ResilientForwarderHttpClientFactory.cs`:
- Around line 36-44: The current SocketsHttpHandler setup only sets
ConnectTimeout and ResponseDrainTimeout but does not enforce a total request
timeout; change the factory so that the created invoker/client enforces the
overall request timeout using TimeoutSeconds: either construct an HttpClient
from the SocketsHttpHandler and set HttpClient.Timeout =
TimeSpan.FromSeconds(_options.TimeoutSeconds), or ensure every SendAsync call
from the created HttpMessageInvoker uses a CancellationTokenSource with a
timeout (linked to the ambient token) derived from _options.TimeoutSeconds;
update the code paths that create/use the SocketsHttpHandler and
HttpMessageInvoker (symbols: SocketsHttpHandler, _options.TimeoutSeconds,
HttpMessageInvoker, X-Request-Timeout) so the gateway actually aborts
long-running upstream requests rather than only sending the informational
header.
---
Duplicate comments:
In
`@src/Bootstrapper/MeAjudaAi.Gateway/Middlewares/ResilientForwarderHttpClientFactory.cs`:
- Around line 90-105: O loop em ResilientForwarderHttpClientFactory está
chamando last.Dispose() mesmo quando a última tentativa falha com um status
transitório (avaliado por IsTransient) e isso faz perder o HttpResponseMessage
final (status/body/headers como Retry-After); altere a lógica no método que
contém as variáveis last, attempt, _options.RetryCount e IsTransient para não
descartar (não chamar Dispose) na última iteração quando todas as tentativas
terminaram com respostas transitórias — em vez disso retorne o
HttpResponseMessage final (last) para preservar cabeçalhos e corpo; aplique o
mesmo ajuste também no outro bloco equivalente mencionado (linhas ~118-135) para
manter a semântica de proxyagem.
---
Nitpick comments:
In
`@tests/MeAjudaAi.Gateway.Tests/Unit/Middleware/GeographicRestrictionMiddlewareTests.cs`:
- Around line 167-181: O teste InvokeAsync_BlockedState_Returns451 apenas valida
StatusCode; altere-o para também garantir que a pipeline foi interrompida (o
RequestDelegate "next" não foi chamado) — ao criar o middleware via
CreateMiddleware(), passe um RequestDelegate mockado ou um delegate que seta uma
flag/lança se invocado, invoque middleware.InvokeAsync(context) e depois asserte
que a flag não foi alterada / o mock não recebeu chamadas, mantendo a
verificação de context.Response.StatusCode == 451; aplique o mesmo padrão aos
outros testes citados (linhas 237-268, 271-305, 329-349) usando os mesmos
símbolos CreateMiddleware e InvokeAsync para localizar o código.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 178ae369-129b-4e6c-bc88-1b302f5a287f
📒 Files selected for processing (7)
src/Bootstrapper/MeAjudaAi.Gateway/MeAjudaAi.Gateway.csprojsrc/Bootstrapper/MeAjudaAi.Gateway/Middlewares/EdgeAuthGuardMiddleware.cssrc/Bootstrapper/MeAjudaAi.Gateway/Middlewares/ResilientForwarderHttpClientFactory.cstests/MeAjudaAi.Gateway.Tests/Unit/Middleware/EdgeAuthGuardMiddlewareTests.cstests/MeAjudaAi.Gateway.Tests/Unit/Middleware/GeographicRestrictionMiddlewareTests.cstests/MeAjudaAi.Gateway.Tests/Unit/Middleware/RateLimitingMiddlewareTests.cstests/MeAjudaAi.Gateway.Tests/Unit/Middleware/ResilientForwarderHttpClientFactoryTests.cs
✅ Files skipped from review due to trivial changes (1)
- src/Bootstrapper/MeAjudaAi.Gateway/MeAjudaAi.Gateway.csproj
🚧 Files skipped from review as they are similar to previous changes (3)
- tests/MeAjudaAi.Gateway.Tests/Unit/Middleware/ResilientForwarderHttpClientFactoryTests.cs
- tests/MeAjudaAi.Gateway.Tests/Unit/Middleware/EdgeAuthGuardMiddlewareTests.cs
- tests/MeAjudaAi.Gateway.Tests/Unit/Middleware/RateLimitingMiddlewareTests.cs
…ctory to gateway service
✅ Contrato da API ValidadoNenhuma breaking change detectada pelo |
Code Coverage Report
|
Minimum allowed line rate is |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
New Features
Comportamento
Chores
Documentação