COS301-SE-2024 / TuneIn

Introducing TuneIn, where music becomes a shared experience that connects people, transcending distances and creating lasting bonds through the power of music.
4 stars 0 forks source link

Feature/chatroom implementation #81

Closed thabisomatau closed 5 days ago

gitguardian[bot] commented 1 week ago

⚠️ GitGuardian has uncovered 4 secrets following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secrets in your pull request
| GitGuardian id | GitGuardian status | Secret | Commit | Filename | | | -------------- | ------------------ | ------------------------------ | ---------------- | --------------- | -------------------- | | [11683612](https://dashboard.gitguardian.com/workspace/301252/incidents/11683612?occurrence=146341586) | Triggered | Generic High Entropy Secret | 23f00cad520242c4ab762231c15c64ebe1b3988c | backend/tools/simulate-auth.js | [View secret](https://github.com/COS301-SE-2024/TuneIn/commit/23f00cad520242c4ab762231c15c64ebe1b3988c#diff-6b784f911043fa5986dce294ce3100458650a1de36a2c924bd5b0566b2d33022R53) | | [11683613](https://dashboard.gitguardian.com/workspace/301252/incidents/11683613?occurrence=146341585) | Triggered | Bearer Token | 23f00cad520242c4ab762231c15c64ebe1b3988c | backend/tools/simulate-auth.js | [View secret](https://github.com/COS301-SE-2024/TuneIn/commit/23f00cad520242c4ab762231c15c64ebe1b3988c#diff-6b784f911043fa5986dce294ce3100458650a1de36a2c924bd5b0566b2d33022R50) | | [11683612](https://dashboard.gitguardian.com/workspace/301252/incidents/11683612?occurrence=146621340) | Triggered | Generic High Entropy Secret | d95974a1553d18fdc1cfa150f1bd674697b395e6 | backend/tools/simulate-auth.js | [View secret](https://github.com/COS301-SE-2024/TuneIn/commit/d95974a1553d18fdc1cfa150f1bd674697b395e6#diff-6b784f911043fa5986dce294ce3100458650a1de36a2c924bd5b0566b2d33022L53) | | [11683613](https://dashboard.gitguardian.com/workspace/301252/incidents/11683613?occurrence=146621339) | Triggered | Bearer Token | d95974a1553d18fdc1cfa150f1bd674697b395e6 | backend/tools/simulate-auth.js | [View secret](https://github.com/COS301-SE-2024/TuneIn/commit/d95974a1553d18fdc1cfa150f1bd674697b395e6#diff-6b784f911043fa5986dce294ce3100458650a1de36a2c924bd5b0566b2d33022L50) |
🛠 Guidelines to remediate hardcoded secrets
1. Understand the implications of revoking this secret by investigating where it is used in your code. 2. Replace and store your secrets safely. [Learn here](https://blog.gitguardian.com/secrets-api-management?utm_source=product&utm_medium=GitHub_checks&utm_campaign=check_run_comment) the best practices. 3. Revoke and [rotate these secrets](https://docs.gitguardian.com/secrets-detection/secrets-detection-engine/detectors/generics/generic_high_entropy_secret#revoke-the-secret?utm_source=product&utm_medium=GitHub_checks&utm_campaign=check_run_comment). 4. If possible, [rewrite git history](https://blog.gitguardian.com/rewriting-git-history-cheatsheet?utm_source=product&utm_medium=GitHub_checks&utm_campaign=check_run_comment). Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data. To avoid such incidents in the future consider - following these [best practices](https://blog.gitguardian.com/secrets-api-management/?utm_source=product&utm_medium=GitHub_checks&utm_campaign=check_run_comment) for managing and storing secrets including API keys and other credentials - install [secret detection on pre-commit](https://docs.gitguardian.com/ggshield-docs/integrations/git-hooks/pre-commit?utm_source=product&utm_medium=GitHub_checks&utm_campaign=check_run_comment) to catch secret before it leaves your machine and ease remediation.

🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.

lkekana commented 1 week ago

Summary

the changes to the rooms in backend look good but your PR primarily changes frontend files? if you didn't make changes to frontend, can you fix your branch's frontend folder so it doesn't change anything that's already fine. a couple files are about to be deleted and some changes seemingly reverted in this PR

Changes needed

  1. in the rooms controller, can you get the userId like i did for the /users endpoints, for example,

    const userInfo: JWTPayload = this.auth.getUserInfo(req);
    return await this.usersService.createRoom(createRoomDto, userInfo.id);

    where userInfo.id is the user ID. so that it gets the user info and sends the appropriate errors (for validation purposes)

  2. and for each path in the controller, can you add the appropriate decorators for the documentation and for readability, eg.

    @ApiBearerAuth()
    @UseGuards(JwtAuthGuard)
    @Post(":username/follow")
    @ApiTags("profile")
    @ApiOperation({ summary: "Follow the given user" })
    @ApiParam({ name: "username" })
    @ApiOkResponse({
    description: "Successfully followed the user.",
    type: Boolean,
    })
    @ApiBadRequestResponse({
    description: "Error following the user.",
    type: Boolean,
    })
    async followUser(
    @Request() req: any,
    @Param("username") username: string,
    ): Promise<boolean> {
    const userInfo: JWTPayload = this.auth.getUserInfo(req);
    return await this.profileService.followUser(userInfo.id, username);
    }

    the decorators should have hints in VSCode as you type them and Copilot should assist too

  3. can you add Dockerfile to gitignore for now

lkekana commented 1 week ago

@thabisomatau yo, so your branch still changes 31 files in the frontend folder?

Linda-Masia commented 6 days ago

MERGE CONFLICTS!