entity-service: time-card search filters + create/update write path - #989
Conversation
…path
Search: add caseId (task), userId (user), approverId (approver_list, eligible),
and approvedById (approved_by, actual) filters to POST /time-cards/search; state
filtering already existed. UUIDs map to SN sysids; approver fields are glide_lists
matched with CONTAINS on the SN side.
Write path (SN data source, no schema change): add POST /time-cards (create,
state=submitted, caller-supplied approverIds) and PATCH /time-cards/{id}. The
PATCH carries either editable fields (submitter, while submitted) or a state
transition (state=approved, or state=rejected with leadComment) for an eligible
approver in approver_list; SN enforces authorization. Submitter is taken from
the session. Domain types, service, handlers, routes, and openapi documented.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (2)
📝 WalkthroughWalkthroughAdds ChangesTime Card Create/Update API
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 golangci-lint (2.12.2)level=error msg="[linters_context] typechecking error: pattern ./...: directory prefix . does not contain main module or its selected dependencies" Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
entity-service/internal/service/sn_time_card_service.go (1)
374-409: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win
UpdateTimeCardaccepts a no-op request (no state and no editable fields).After ID validation, if
Stateis nil and none of the editable fields/approverIdsare set, the method builds an empty payload and PATCHes ServiceNow with nothing to change. Consider rejecting requests that carry neither a state transition nor any editable field, to fail fast with a clear validation error.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@entity-service/internal/service/sn_time_card_service.go` around lines 374 - 409, UpdateTimeCard currently allows a no-op update when State is nil and no editable fields or approverIds are provided, resulting in an empty PATCH payload to ServiceNow. Add a validation check in snTimeCardService.UpdateTimeCard after the existing ID/state/field validation to reject requests with neither a state transition nor any mutable field set. Use the existing request fields in domain.UpdateTimeCardRequest and return a clear apierror.ValidationError when the update would otherwise be empty.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@entity-service/openapi.yaml`:
- Around line 3536-3573: Update the UpdateTimeCardRequest schema to enforce the
documented PATCH contract by preventing empty bodies and separating state
transitions from editable-field updates. In entity-service/openapi.yaml, add
validation such as minProperties: 1 and, if appropriate, a oneOf that
distinguishes the state/leadComment shape from the edit fields shape for
UpdateTimeCardRequest. Also add a corresponding server-side guard in the time
card update path so the implementation rejects no-op requests consistently with
the schema.
- Around line 1440-1464: The PATCH /time-cards/{id} response list is missing the
UnauthorizedError case documented for create; update the OpenAPI definition for
UpdateTimeCard in openapi.yaml to include a 401 response alongside the existing
200/400/404/500 entries, using the same ErrorResponse schema pattern used by
POST /time-cards.
---
Nitpick comments:
In `@entity-service/internal/service/sn_time_card_service.go`:
- Around line 374-409: UpdateTimeCard currently allows a no-op update when State
is nil and no editable fields or approverIds are provided, resulting in an empty
PATCH payload to ServiceNow. Add a validation check in
snTimeCardService.UpdateTimeCard after the existing ID/state/field validation to
reject requests with neither a state transition nor any mutable field set. Use
the existing request fields in domain.UpdateTimeCardRequest and return a clear
apierror.ValidationError when the update would otherwise be empty.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: c96acbec-0a5b-41c4-b8a1-826598217a0b
📒 Files selected for processing (6)
entity-service/internal/domain/entity.goentity-service/internal/handler/time_card_handler.goentity-service/internal/server/routes.goentity-service/internal/service/interfaces.goentity-service/internal/service/sn_time_card_service.goentity-service/openapi.yaml
…+ minProperties Address CodeRabbit review on wso2-open-operations#989: - UpdateTimeCard rejects a body with neither a state transition nor any editable field (no-op PATCH), and rejects combining a transition with field edits (the transition path ignores edits downstream, which would silently drop them). - openapi: UpdateTimeCardRequest gets minProperties: 1; PATCH /time-cards/{id} documents the 401 response (parity with POST /time-cards).
|
Tip For best results, initiate chat on the files or code changes.
The 🐇✨ ✏️ Learnings added
If you found this review helpful, would you consider giving us a shout-out on X? Thank you for using CodeRabbit! |
Parity with the entity-service contract (wso2-open-operations#989): reject an empty/no-op PATCH body in the spec; the entity service enforces it and this BFF passes the body through.
2 participants
What
Search filters on
POST /time-cards/search: addcaseId,userId,approverId(eligible approver), andapprovedById(actual approver) filters. State filtering already worked. UUIDs are mapped to ServiceNow sysids; the approver fields map to multi-value (glide_list) columns matched with CONTAINS downstream.Write path (ServiceNow data source; no schema change):
POST /time-cards— create a time card in thesubmittedstate. Submitter is taken from the session, never the payload. Caller suppliesapproverIds(eligible approvers).PATCH /time-cards/{id}— one endpoint for both field edits (submitter, while submitted) and state transitions:{"state":"approved"}, or{"state":"rejected","leadComment":"..."}. Authorization (submitter vs eligible approver) is enforced by the downstream ServiceNow integration service.This follows the existing
cases/call-requestsconvention where state transitions go through the resource PATCH rather than action sub-resources.Layers
Domain types, service methods (+ interface), handlers, routes, and
openapi.yamlupdated.go build,go vetclean.Notes
Summary by CodeRabbit
/time-cards, PATCH/time-cards/{id}).