fix: more robust calculation of default location for code generation #1095
Conversation
WalkthroughWalkthroughThe recent updates span across several packages, focusing on enhancing functionality, refining logic, and improving code clarity. Key changes include updating a JetBrains IDE plugin version, refining plugin and package utilities in the schema package, and improving default runtime load paths and module loading mechanisms in the server and test tools packages. These modifications aim to streamline development workflows, improve package management, and ensure more robust and maintainable codebases. Changes
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (invoked as PR comments)
Additionally, you can add CodeRabbit Configration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Review Status
Actionable comments generated: 4
Configuration used: CodeRabbit UI
Files ignored due to path filters (13)
package.jsonis excluded by:!**/*.jsonpackages/ide/jetbrains/package.jsonis excluded by:!**/*.jsonpackages/language/package.jsonis excluded by:!**/*.jsonpackages/misc/redwood/package.jsonis excluded by:!**/*.jsonpackages/plugins/openapi/package.jsonis excluded by:!**/*.jsonpackages/plugins/swr/package.jsonis excluded by:!**/*.jsonpackages/plugins/tanstack-query/package.jsonis excluded by:!**/*.jsonpackages/plugins/trpc/package.jsonis excluded by:!**/*.jsonpackages/runtime/package.jsonis excluded by:!**/*.jsonpackages/schema/package.jsonis excluded by:!**/*.jsonpackages/sdk/package.jsonis excluded by:!**/*.jsonpackages/server/package.jsonis excluded by:!**/*.jsonpackages/testtools/package.jsonis excluded by:!**/*.json
Files selected for processing (5)
- packages/ide/jetbrains/build.gradle.kts (1 hunks)
- packages/schema/src/plugins/plugin-utils.ts (2 hunks)
- packages/schema/src/utils/pkg-utils.ts (4 hunks)
- packages/server/src/shared.ts (4 hunks)
- packages/testtools/src/schema.ts (2 hunks)
Additional comments: 7
packages/ide/jetbrains/build.gradle.kts (1)
- 12-12: The version update from "2.0.0-alpha.4" to "2.0.0-alpha.5" in the
build.gradle.ktsfile is correctly implemented. Ensure that this version increment aligns with the intended changes and dependencies for the JetBrains IDE plugin.packages/server/src/shared.ts (1)
- 2-2: The introduction of
DEFAULT_RUNTIME_LOAD_PATHand specific type imports (ModelMeta,PolicyDef,ZodSchemas) from@zenstackhq/runtimeis a good practice for clarity and maintainability.packages/schema/src/plugins/plugin-utils.ts (1)
- 6-6: Importing
getPackageManagerfrom../utils/pkg-utilsis a good addition for enhancing the logic to determine the default output folder. This modular approach improves code readability and maintainability.packages/schema/src/utils/pkg-utils.ts (3)
- 4-4: The introduction of
matchfrom 'ts-pattern' for pattern matching in thegetPackageManagerfunction is a good practice for improving code readability and maintainability.- 16-16: Refining the
FindUptype definition to handle boolean extensions and improve the function signature forfindUpenhances the readability and usability of these utilities.- 46-59: Refactoring the
getPackageManagerfunction to use pattern matching for determining the package manager provides a clearer and more informative approach. This change improves the function's readability and maintainability.packages/testtools/src/schema.ts (1)
- 5-11: Reorganizing the imports for
AuthUser,CrudContract,EnhancementKind, andEnhancementOptionsfrom@zenstackhq/runtimeto use type annotations and definingDEFAULT_RUNTIME_LOAD_PATHfor module loading are good practices for improving code clarity and maintainability.
| /* eslint-disable @typescript-eslint/no-var-requires */ | ||
| import type { ModelMeta, PolicyDef, ZodSchemas } from '@zenstackhq/runtime'; | ||
| import { DEFAULT_RUNTIME_LOAD_PATH, type ModelMeta, type PolicyDef, type ZodSchemas } from '@zenstackhq/runtime'; | ||
| import path from 'path'; | ||
| import { AdapterBaseOptions } from './types'; | ||
|
|
There was a problem hiding this comment.
📝 NOTE
This review was outside the diff hunks, and no overlapping diff hunk was found. Original lines [33-33]
Detected possible user input going into path.join or path.resolve functions in the getDefaultModelMeta, getDefaultPolicy, and getDefaultZodSchemas functions. This could potentially lead to a path traversal vulnerability. Ensure that the loadPath parameter is sanitized or validated before use to prevent unauthorized file system access.
Also applies to: 61-61, 92-92
| import fs from 'fs'; | ||
| import path from 'path'; | ||
| import { PluginRunnerOptions } from '../cli/plugin-runner'; | ||
| import { getPackageManager } from '../utils/pkg-utils'; | ||
|
|
||
| export const ALL_OPERATION_KINDS: PolicyOperationKind[] = ['create', 'update', 'postUpdate', 'read', 'delete']; | ||
|
|
There was a problem hiding this comment.
📝 NOTE
This review was outside the diff hunks, and no overlapping diff hunk was found. Original lines [17-17]
Detected possible user input going into path.join or path.resolve functions in several places within getNodeModulesFolder, ensureDefaultOutputFolder, and getDefaultOutputFolder functions. This could potentially lead to a path traversal vulnerability. Ensure that any user input or variable paths are sanitized or validated before use to prevent unauthorized file system access.
Also applies to: 18-18, 20-20, 31-31, 64-64, 77-77
| /* eslint-disable @typescript-eslint/no-explicit-any */ | ||
| import type { DMMF } from '@prisma/generator-helper'; | ||
| import type { Model } from '@zenstackhq/language/ast'; | ||
| import type { AuthUser, CrudContract, EnhancementKind, EnhancementOptions } from '@zenstackhq/runtime'; | ||
| import { | ||
| DEFAULT_RUNTIME_LOAD_PATH, | ||
| type AuthUser, | ||
| type CrudContract, | ||
| type EnhancementKind, | ||
| type EnhancementOptions, | ||
| } from '@zenstackhq/runtime'; | ||
| import { getDMMF } from '@zenstackhq/sdk'; | ||
| import { execSync } from 'child_process'; | ||
| import * as fs from 'fs'; |
There was a problem hiding this comment.
📝 NOTE
This review was outside the diff hunks, and no overlapping diff hunk was found. Original lines [46-46]
Detected a call to child_process from a function argument cmd in the run function. This could lead to a command injection if the input is user-controllable. Ensure that user input is correctly sanitized or sandboxed to prevent security vulnerabilities.
📝 NOTE
This review was outside the diff hunks, and no overlapping diff hunk was found. Original lines [70-70]
Detected possible user input going into path.join or path.resolve functions in getWorkspaceRoot and getWorkspaceNpmCacheFolder. This could potentially lead to a path traversal vulnerability. Ensure that any user input or variable paths are sanitized or validated before use to prevent unauthorized file system access.
Also applies to: 81-81
Summary by CodeRabbit
node_modulesfolder with a fallback mechanism for runtime package paths.