Skip to content

add timeout in membase#1307

Merged
iceljc merged 1 commit intoSciSharp:masterfrom
iceljc:master
Mar 12, 2026
Merged

add timeout in membase#1307
iceljc merged 1 commit intoSciSharp:masterfrom
iceljc:master

Conversation

@iceljc
Copy link
Collaborator

@iceljc iceljc commented Mar 12, 2026

No description provided.

@qodo-code-review
Copy link
Contributor

Review Summary by Qodo

Add HTTP client timeout to Membase plugin

✨ Enhancement

Grey Divider

Walkthroughs

Description
• Add 5-second timeout to Membase HTTP client
• Improve HTTP request reliability with timeout configuration
Diagram
flowchart LR
  A["MembasePlugin RegisterDI"] -- "ConfigureHttpClient" --> B["HTTP Client Configuration"]
  B -- "Set BaseAddress" --> C["Membase API Connection"]
  B -- "Set Timeout 5s" --> C
Loading

Grey Divider

File Changes

1. src/Plugins/BotSharp.Plugin.Membase/MembasePlugin.cs ✨ Enhancement +5/-1

Add timeout configuration to HTTP client

• Expanded ConfigureHttpClient lambda to multi-line format
• Added c.Timeout = TimeSpan.FromSeconds(5) to set HTTP request timeout
• Improves reliability by preventing indefinite hanging requests

src/Plugins/BotSharp.Plugin.Membase/MembasePlugin.cs


Grey Divider

Qodo Logo

@qodo-code-review
Copy link
Contributor

qodo-code-review bot commented Mar 12, 2026

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (2) 📎 Requirement gaps (0)

Grey Divider


Action required

1. Unvalidated settings.Host URI 📘 Rule violation ⛯ Reliability
Description
The new code constructs and assigns BaseAddress directly from settings.Host without
null/empty/format validation, which can throw during startup if config is missing or not an absolute
URI. This violates the requirement to add null/empty guards and safe fallbacks at external/config
boundaries.
Code

src/Plugins/BotSharp.Plugin.Membase/MembasePlugin.cs[32]

+                    c.BaseAddress = new Uri(settings.Host);
Evidence
Compliance ID 3 requires guards and safe fallbacks at optional/external boundaries; settings.Host
comes from configuration and is used without validation in new Uri(settings.Host), and the default
value shown is a non-absolute host string ("localhost"), increasing the risk of runtime exceptions.

src/Plugins/BotSharp.Plugin.Membase/MembasePlugin.cs[32-32]
src/Plugins/BotSharp.Plugin.Membase/Settings/MembaseSettings.cs[5-5]
Best Practice: Learned patterns

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`settings.Host` is used at a configuration boundary without null/empty/format checks (`new Uri(settings.Host)`), which can throw at runtime (e.g., missing scheme, empty string).

## Issue Context
`MembaseSettings` is populated via `config.Bind("Membase", settings)`, so `Host` is externally provided and should be validated before using it as `HttpClient.BaseAddress`.

## Fix Focus Areas
- src/Plugins/BotSharp.Plugin.Membase/MembasePlugin.cs[30-34]
- src/Plugins/BotSharp.Plugin.Membase/Settings/MembaseSettings.cs[3-8]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


2. Timeout masked as success 🐞 Bug ✓ Correctness
Description
When IMembaseApi calls fail (including from the new 5s timeout), MembaseGraphDb catches the
exception and returns an empty GraphQueryResult, and MembaseController then returns HTTP 200 with
empty Columns/Items. This turns timeouts into silent, incorrect "successful" responses for
/membase/{graphId}/query.
Code

src/Plugins/BotSharp.Plugin.Membase/MembasePlugin.cs[33]

+                    c.Timeout = TimeSpan.FromSeconds(5);
Evidence
With the new 5-second timeout, timeouts become much more likely. The Membase graph implementation
swallows any exception and returns a default (empty) result; the controller then unconditionally
returns 200 OK with those empty values, so clients cannot distinguish a timeout/failure from a
legitimate empty dataset.

src/Plugins/BotSharp.Plugin.Membase/MembasePlugin.cs[30-34]
src/Plugins/BotSharp.Plugin.Membase/GraphDb/MembaseGraphDb.cs[39-60]
src/Plugins/BotSharp.Plugin.Membase/Controllers/MembaseController.cs[40-53]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
Failures from Membase API calls (including HttpClient timeouts introduced in this PR) are swallowed in `MembaseGraphDb.ExecuteQueryAsync` and returned as `new GraphQueryResult()`. `MembaseController` then always returns `200 OK` with empty `Columns/Items`, masking timeouts as successful responses.

### Issue Context
This becomes significantly more impactful after the PR because a 5-second HttpClient timeout will trigger cancellations in normal operation.

### Fix Focus Areas
- src/Plugins/BotSharp.Plugin.Membase/GraphDb/MembaseGraphDb.cs[39-60]
- src/Plugins/BotSharp.Plugin.Membase/Controllers/MembaseController.cs[40-60]
- src/Plugins/BotSharp.Plugin.Membase/MembasePlugin.cs[30-34]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools



Remediation recommended

3. Hardcoded Membase HTTP timeout 📘 Rule violation ✓ Correctness
Description
The new HttpClient timeout is hardcoded to 5 seconds, creating a separate source of truth from
configuration and making environment-specific tuning difficult. This can cause inconsistent behavior
across deployments and violates the single-source-of-truth configuration requirement.
Code

src/Plugins/BotSharp.Plugin.Membase/MembasePlugin.cs[33]

+                    c.Timeout = TimeSpan.FromSeconds(5);
Evidence
Compliance ID 5 requires configuration to use a single source of truth; the PR adds a hardcoded
timeout value in code and there is no corresponding timeout field in MembaseSettings, indicating
configuration cannot control this value.

src/Plugins/BotSharp.Plugin.Membase/MembasePlugin.cs[33-33]
src/Plugins/BotSharp.Plugin.Membase/Settings/MembaseSettings.cs[3-8]
Best Practice: Learned patterns

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`HttpClient.Timeout` is hardcoded (`TimeSpan.FromSeconds(5)`), creating a separate configuration source of truth and preventing environment-specific configuration.

## Issue Context
`MembaseSettings` is already bound from configuration (`config.Bind("Membase", settings)`), but it currently has no timeout field. The PR introduced a hardcoded timeout in `RegisterDI`.

## Fix Focus Areas
- src/Plugins/BotSharp.Plugin.Membase/MembasePlugin.cs[30-34]
- src/Plugins/BotSharp.Plugin.Membase/Settings/MembaseSettings.cs[3-8]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


Grey Divider

ⓘ The new review experience is currently in Beta. Learn more

Grey Divider

Qodo Logo

@iceljc iceljc merged commit 04cd12a into SciSharp:master Mar 12, 2026
3 checks passed
.ConfigureHttpClient(c => c.BaseAddress = new Uri(settings.Host));
.ConfigureHttpClient(c =>
{
c.BaseAddress = new Uri(settings.Host);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Action required

1. Unvalidated settings.host uri 📘 Rule violation ⛯ Reliability

The new code constructs and assigns BaseAddress directly from settings.Host without
null/empty/format validation, which can throw during startup if config is missing or not an absolute
URI. This violates the requirement to add null/empty guards and safe fallbacks at external/config
boundaries.
Agent Prompt
## Issue description
`settings.Host` is used at a configuration boundary without null/empty/format checks (`new Uri(settings.Host)`), which can throw at runtime (e.g., missing scheme, empty string).

## Issue Context
`MembaseSettings` is populated via `config.Bind("Membase", settings)`, so `Host` is externally provided and should be validated before using it as `HttpClient.BaseAddress`.

## Fix Focus Areas
- src/Plugins/BotSharp.Plugin.Membase/MembasePlugin.cs[30-34]
- src/Plugins/BotSharp.Plugin.Membase/Settings/MembaseSettings.cs[3-8]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

.ConfigureHttpClient(c =>
{
c.BaseAddress = new Uri(settings.Host);
c.Timeout = TimeSpan.FromSeconds(5);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Action required

2. Timeout masked as success 🐞 Bug ✓ Correctness

When IMembaseApi calls fail (including from the new 5s timeout), MembaseGraphDb catches the
exception and returns an empty GraphQueryResult, and MembaseController then returns HTTP 200 with
empty Columns/Items. This turns timeouts into silent, incorrect "successful" responses for
/membase/{graphId}/query.
Agent Prompt
### Issue description
Failures from Membase API calls (including HttpClient timeouts introduced in this PR) are swallowed in `MembaseGraphDb.ExecuteQueryAsync` and returned as `new GraphQueryResult()`. `MembaseController` then always returns `200 OK` with empty `Columns/Items`, masking timeouts as successful responses.

### Issue Context
This becomes significantly more impactful after the PR because a 5-second HttpClient timeout will trigger cancellations in normal operation.

### Fix Focus Areas
- src/Plugins/BotSharp.Plugin.Membase/GraphDb/MembaseGraphDb.cs[39-60]
- src/Plugins/BotSharp.Plugin.Membase/Controllers/MembaseController.cs[40-60]
- src/Plugins/BotSharp.Plugin.Membase/MembasePlugin.cs[30-34]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant