Open mohamedsalem401 opened 1 week ago
Qovery can create a Preview Environment for this PR. To trigger its creation, please post a comment with one of the following command.
Command | Blueprint environment |
---|---|
/qovery []() preview 783d0240-ec38-4387-a9a9-8e225f1bd3e1 | dev |
/qovery []() preview {all|UUID1,UUID2,...} | To preview multiple environments |
This comment has been generated from Qovery AI :robot:. Below, a word from its wisdom :
Take rest sometimes
Latest commit: 96667fbdb2baa793639811b7c7c06becb6037da8
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
Click here to learn what changesets are, and how to add one.
Click here if you're a maintainer who wants to add a changeset to this PR
@mohamedsalem401 is attempting to deploy a commit to the Panora Team on Vercel.
A member of the Team first needs to authorize it.
[!IMPORTANT]
Review skipped
Auto reviews are disabled on this repository.
Please check the settings in the CodeRabbit UI or the
.coderabbit.yaml
file in this repository. To trigger a single review, invoke the@coderabbitai review
command.You can disable this status message by setting the
reviews.review_status
tofalse
in the CodeRabbit configuration file.
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media?
Hello @mohamedsalem401, actually I considered the first scenario and that is why I added the verifyUser method at the auth/profile endpoint. Could please double-check that? Thank you.
Hey @mit-27, Let me check and get back to you :D
The current implementation checks if the user associated with the JWT token exists in the database when calling the profile
endpoint. This endpoint is used in the useUser
hook.
useUser
hook will be removed even in cases of request errors to the profile endpoint, not just authorization errors. ( This's still not addressed in this PR )The current implementation checks if the user associated with the JWT token exists in the database when calling the
profile
endpoint. This endpoint is used in theuseUser
hook.
- The pull request (PR) proposes adding this check at the guard level, so it applies to all JWT-protected endpoints, not just the profile endpoint.
- Additionally, the JWT in the
useUser
hook will be removed even in cases of request errors to the profile endpoint, not just authorization errors.
Yes, you are right. we need to verify the user within the guard so that it can apply to all JWT-guarded endpoints. Thanks
This PR should handle two seperate issue
validateApiKey
service now returns a 401 Unauthorized error (instead of a500 Internal Server Error
) when an invalid or deleted API key is encountered.