Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

refactor: migrates user password to it's own table #13628

Merged
merged 7 commits into from
Feb 12, 2024

Conversation

zomars
Copy link
Member

@zomars zomars commented Feb 9, 2024

What does this PR do?

Follow up to #13002 #13549

  • Migrates user password to it's own table
  • Makes it harder to leak user password by using include user: true
  • Makes it explicit when you're trying to manipulate password
  • Adds special migration so there no user action required

Type of change

  • Chore (refactoring code, technical debt, workflow improvements)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)

How should this be tested?

  • yarn e2e
  • Test signup

Mandatory Tasks

  • Make sure you have self-reviewed the code. A decent size PR without self-review might be rejected.

Copy link

vercel bot commented Feb 9, 2024

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Comments Updated (UTC)
ai ✅ Ready (Inspect) Visit Preview 💬 Add feedback Feb 12, 2024 3:28pm
api 🔄 Building (Inspect) Visit Preview Feb 12, 2024 3:28pm
5 Ignored Deployments
Name Status Preview Comments Updated (UTC)
cal ⬜️ Ignored (Inspect) Visit Preview Feb 12, 2024 3:28pm
cal-demo ⬜️ Ignored (Inspect) Feb 12, 2024 3:28pm
calcom-web-canary ⬜️ Ignored (Inspect) Visit Preview Feb 12, 2024 3:28pm
qa ⬜️ Ignored (Inspect) Visit Preview Feb 12, 2024 3:28pm
ui ⬜️ Ignored (Inspect) Visit Preview Feb 12, 2024 3:28pm

Copy link
Contributor

github-actions bot commented Feb 9, 2024

Thank you for following the naming conventions! 🙏 Feel free to join our discord and post your PR link.

@github-actions github-actions bot added the ❗️ migrations contains migration files label Feb 9, 2024
@zomars
Copy link
Member Author

zomars commented Feb 9, 2024

Current dependencies on/for this PR:

This stack of pull requests is managed by Graphite.

Copy link
Contributor

github-actions bot commented Feb 10, 2024

📦 Next.js Bundle Analysis for @calcom/web

This analysis was generated by the Next.js Bundle Analysis action. 🤖

One Page Changed Size

The following page changed size from the code in this PR compared to its base branch:

Page Size (compressed) First Load % of Budget (350 KB)
/settings/my-account/out-of-office 269.7 KB 457.86 KB 130.82% (🟢 -1.77%)
Details

Only the gzipped size is provided here based on an expert tip.

First Load is the size of the global bundle plus the bundle for the individual page. If a user were to show up to your website and land on a given page, the first load size represents the amount of javascript that user would need to download. If next/link is used, subsequent page loads would only need to download that page's bundle (the number in the "Size" column), since the global bundle has already been downloaded.

Any third party scripts you have added directly to your app using the <script> tag are not accounted for in this analysis

The "Budget %" column shows what percentage of your performance budget the First Load total takes up. For example, if your budget was 100kb, and a given page's first load size was 10kb, it would be 10% of your budget. You can also see how much this has increased or decreased compared to the base branch of your PR. If this percentage has increased by 20% or more, there will be a red status indicator applied, indicating that special attention should be given to this. If you see "+/- <0.01%" it means that there was a change in bundle size, but it is a trivial enough amount that it can be ignored.

Copy link

deploysentinel bot commented Feb 10, 2024

Current Playwright Test Results Summary

✅ 447 Passing - ⚠️ 17 Flaky

Run may still be in progress, this comment will be updated as current testing workflow or job completes...

(Last updated on 02/12/2024 04:33:19pm UTC)

Run Details

Running Workflow PR Update on Github Actions

Commit: fdf4f94

Started: 02/12/2024 04:24:08pm UTC

⚠️ Flakes

📄   apps/web/playwright/booking/multipleEmailQuestion.e2e.ts • 1 Flake

Test Case Results

Test Case Last 7 days Failures Last 7 days Flakes
Booking With Multiple Email Question and Each Other Question Booking With Multiple email Question and phone Question Multiple email required and Phone required
Retry 1Initial Attempt
0% (0) 0 / 284 runs
failed over last 7 days
6.34% (18) 18 / 284 runs
flaked over last 7 days

📄   apps/web/playwright/booking-pages.e2e.ts • 1 Flake

Test Case Results

Test Case Last 7 days Failures Last 7 days Flakes
pro user -- legacy Time slots should be reserved when selected
Retry 2Retry 1Initial Attempt
0% (0) 0 / 282 runs
failed over last 7 days
4.26% (12) 12 / 282 runs
flaked over last 7 days

📄   apps/web/playwright/booking/selectQuestion.e2e.ts • 2 Flakes

Top 1 Common Error Messages

null

2 Test Cases Affected

Test Case Results

Test Case Last 7 days Failures Last 7 days Flakes
Booking With Phone Question and Each Other Question Booking With Select Question and checkbox group Question Select required and checkbox group required
Retry 1Initial Attempt
0% (0) 0 / 286 runs
failed over last 7 days
4.55% (13) 13 / 286 runs
flaked over last 7 days
Booking With Phone Question and Each Other Question Booking With Select Question and Long text Question Select required and Long text required
Retry 1Initial Attempt
0% (0) 0 / 285 runs
failed over last 7 days
3.51% (10) 10 / 285 runs
flaked over last 7 days

📄   apps/web/playwright/booking/checkboxGroupQuestion.e2e.ts • 1 Flake

Test Case Results

Test Case Last 7 days Failures Last 7 days Flakes
Booking With Checkbox Group Question and Each Other Question Booking With Checkbox Group Question and Address Question Booking With Checkbox Group Question and Phone Question Checkbox Group and Phone not required
Retry 1Initial Attempt
0.34% (1) 1 / 296 run
failed over last 7 days
5.07% (15) 15 / 296 runs
flaked over last 7 days

📄   apps/web/playwright/booking/radioGroupQuestion.e2e.ts • 1 Flake

Test Case Results

Test Case Last 7 days Failures Last 7 days Flakes
Booking With Radio Question and Each Other Question Booking With Radio Question and Address Question Booking With Radio Question and Long text Question Radio and Long text not required
Retry 1Initial Attempt
0% (0) 0 / 292 runs
failed over last 7 days
7.88% (23) 23 / 292 runs
flaked over last 7 days

📄   apps/web/playwright/webhook.e2e.ts • 1 Flake

Test Case Results

Test Case Last 7 days Failures Last 7 days Flakes
Webhook tests BOOKING_REQUESTED can book an event that requires confirmation and get a booking requested event
Retry 1Initial Attempt
0% (0) 0 / 297 runs
failed over last 7 days
0.34% (1) 1 / 297 run
flaked over last 7 days

📄   apps/web/playwright/event-types.e2e.ts • 1 Flake

Test Case Results

Test Case Last 7 days Failures Last 7 days Flakes
Event Types tests -- future user Different Locations Tests can add Attendee Phone Number location and book with it
Retry 1Initial Attempt
0.64% (2) 2 / 314 runs
failed over last 7 days
10.83% (34) 34 / 314 runs
flaked over last 7 days

📄   packages/embeds/embed-core/playwright/tests/action-based.e2e.ts • 8 Flakes

Top 1 Common Error Messages

null

8 Test Cases Affected

Test Case Results

Test Case Last 7 days Failures Last 7 days Flakes
Popup Tests should open embed iframe on click - Configured with light theme
Retry 1Initial Attempt
0.66% (2) 2 / 301 runs
failed over last 7 days
51.83% (156) 156 / 301 runs
flaked over last 7 days
Popup Tests should be able to reschedule
Retry 1Initial Attempt
-109.09% (-156) -156 / 143 runs
failed over last 7 days
109.09% (156) 156 / 143 runs
flaked over last 7 days
Popup Tests should open Routing Forms embed on click
Retry 1Initial Attempt
-109.15% (-155) -155 / 142 runs
failed over last 7 days
109.15% (155) 155 / 142 runs
flaked over last 7 days
Popup Tests Floating Button Popup Pro User - Configured in App with default setting of system theme should open embed iframe according to system theme when no theme is configured through Embed API
Retry 1Initial Attempt
-109.15% (-155) -155 / 142 runs
failed over last 7 days
109.15% (155) 155 / 142 runs
flaked over last 7 days
Popup Tests Floating Button Popup Pro User - Configured in App with default setting of system theme should open embed iframe(Booker Profile Page) with dark theme when configured with dark theme using Embed API
Retry 1Initial Attempt
-108.45% (-154) -154 / 142 runs
failed over last 7 days
108.45% (154) 154 / 142 runs
flaked over last 7 days
Popup Tests Floating Button Popup Pro User - Configured in App with default setting of system theme should open embed iframe according to system theme when configured with 'auto' theme using Embed API
Retry 1Initial Attempt
-109.15% (-155) -155 / 142 runs
failed over last 7 days
109.15% (155) 155 / 142 runs
flaked over last 7 days
Popup Tests Floating Button Popup Pro User - Configured in App with default setting of system theme should open embed iframe(Event Booking Page) with dark theme when configured with dark theme using Embed API
Retry 1Initial Attempt
-108.45% (-154) -154 / 142 runs
failed over last 7 days
108.45% (154) 154 / 142 runs
flaked over last 7 days
Popup Tests prendered embed should be loaded and apply the config given to it
Retry 1Initial Attempt
-108.45% (-154) -154 / 142 runs
failed over last 7 days
108.45% (154) 154 / 142 runs
flaked over last 7 days

📄   packages/embeds/embed-core/playwright/tests/inline.e2e.ts • 1 Flake

Test Case Results

Test Case Last 7 days Failures Last 7 days Flakes
Inline Iframe Inline Iframe - Configured with Dark Theme
Retry 1Initial Attempt
0.67% (2) 2 / 299 runs
failed over last 7 days
43.48% (130) 130 / 299 runs
flaked over last 7 days

View Detailed Build Results


Copy link
Member Author

@zomars zomars left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Self review done

requestedUser:
/** Don't leak the password */
exclude(user, ["password"]),
requestedUser: user,
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No need to exclude anymore

Comment on lines +20 to +27
-- Inserts current user password into new table
INSERT INTO
"UserPassword" ("hash", "userId")
SELECT
u."password",
u.id
FROM
users u;
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This step is to ensure no data is lost

@zomars zomars marked this pull request as ready for review February 10, 2024 03:20
@zomars zomars requested a review from a team February 10, 2024 03:21
@keithwillcode keithwillcode added this to the v3.9 milestone Feb 10, 2024
@PeerRich PeerRich added the Medium priority Created by Linear-GitHub Sync label Feb 12, 2024
@zomars zomars merged commit 7b0d595 into main Feb 12, 2024
39 of 40 checks passed
@zomars zomars deleted the refactor_migrates_user_password_to_it_s_own_table branch February 12, 2024 21:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
api area: API, enterprise API, access token, OAuth core area: core, team members only foundation Medium priority Created by Linear-GitHub Sync ❗️ migrations contains migration files
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants