chore: Log application result in graphql resolver #1524
Conversation
|
Caution Review failedThe pull request is closed. 📝 Walkthrough📝 WalkthroughWalkthroughThe pull request introduces modifications to the Changes
Possibly related PRs
Suggested reviewers
Warning Rate limit exceeded@oskogstad has exceeded the limit for the number of commits or files that can be reviewed per hour. Please wait 22 minutes and 47 seconds before requesting another review. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Inline review comments failed to post. This is likely due to GitHub's limits when posting large numbers of comments.
Actionable comments posted: 2
🧹 Outside diff range and nitpick comments (1)
src/Digdir.Domain.Dialogporten.GraphQL/appsettings.test.json (1)
Line range hint
1-61: Document the local secrets management process.There are multiple TODO comments indicating secrets that need to be added locally. Consider adding a comment block or reference to documentation that explains:
- The recommended way to manage these secrets locally
- The process for developers to obtain these values
- Any specific tools or practices to use (e.g., user secrets, environment variables)
🧰 Tools
🪛 Biome (1.9.4)
[error] 62-62: End of file expected
Use an array for a sequence of values:
[1, 2](parse)
[error] 63-63: End of file expected
Use an array for a sequence of values:
[1, 2](parse)
[error] 63-63: End of file expected
Use an array for a sequence of values:
[1, 2](parse)
[error] 63-70: End of file expected
Use an array for a sequence of values:
[1, 2](parse)
[error] 70-71: End of file expected
Use an array for a sequence of values:
[1, 2](parse)
🛑 Comments failed to post (2)
src/Digdir.Domain.Dialogporten.GraphQL/EndUser/PartyQueries.cs (1)
30-32:
⚠️ Potential issueAddress potential null PID and PII concerns
Several issues to consider:
- The
TryGetPid()result is not checked, which could lead to logging null PIDs- Consider whether logging PIDs is compliant with your logging policies regarding PII
Consider this safer implementation:
- user.GetPrincipal().TryGetPid(out var pid); - logger.LogInformation("GraphQL handler, app result for party {Party}: {AuthorizedParties}", - pid, JsonSerializer.Serialize(result, SerializerOptions)); + if (user.GetPrincipal().TryGetPid(out var pid)) + { + // Consider masking or hashing the PID if required by compliance + logger.LogInformation("GraphQL handler, app result for party {Party}: {AuthorizedParties}", + pid, JsonSerializer.Serialize(result, SerializerOptions)); + } + else + { + logger.LogWarning("GraphQL handler called without valid PID"); + }📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.if (user.GetPrincipal().TryGetPid(out var pid)) { // Consider masking or hashing the PID if required by compliance logger.LogInformation("GraphQL handler, app result for party {Party}: {AuthorizedParties}", pid, JsonSerializer.Serialize(result, SerializerOptions)); } else { logger.LogWarning("GraphQL handler called without valid PID"); }src/Digdir.Domain.Dialogporten.Infrastructure/Altinn/Authorization/AltinnAuthorizationClient.cs (1)
88-89:
⚠️ Potential issueReview logging implementation for security and performance.
The current logging implementation has potential security and performance implications:
Security:
- Logging the entire authorized parties object might expose sensitive information.
- Consider logging only necessary fields or masking sensitive data.
Performance:
- Serializing large objects can impact performance.
- Consider adding a log level check before serialization.
Consider this safer implementation:
- _logger.LogInformation("Authorized parties for {Party}: {AuthorizedParties}", authenticatedParty, JsonSerializer.Serialize(authorizedParties, SerializerOptions)); + if (_logger.IsEnabled(LogLevel.Information)) + { + var safeAuthorizedParties = authorizedParties.AuthorizedParties.Select(p => new + { + Party = p.Party, + ResourceCount = p.AuthorizedResources.Count, + RoleCount = p.AuthorizedRoles.Count, + HasSubParties = p.SubParties?.Any() == true + }).ToList(); + _logger.LogInformation("Authorized parties for {Party}: {AuthorizedParties}", authenticatedParty, JsonSerializer.Serialize(safeAuthorizedParties, SerializerOptions)); + }Committable suggestion skipped: line range outside the PR's diff.
|
Summary by CodeRabbit
New Features
Bug Fixes
Documentation