fix: use @eggjs/security and @eggjs/session #5384
Conversation
|
Warning Rate limit exceeded@fengmk2 has exceeded the limit for the number of commits or files that can be reviewed per hour. Please wait 0 minutes and 21 seconds before requesting another review. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. 📒 Files selected for processing (2)
WalkthroughThis pull request represents a significant update to the Egg.js framework's security and plugin management. The primary change involves migrating from the Changes
Sequence DiagramsequenceDiagram
participant App as Egg Application
participant Core as EggCore
participant Security as @eggjs/security
App->>Core: addSingleton('security', createMethod)
Core->>Security: Initialize security plugin
Security-->>Core: Return security configuration
Core-->>App: Provide secure application context
Possibly related PRs
Poem
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
|
New, updated, and removed dependencies detected. Learn more about Socket for GitHub ↗︎
🚮 Removed packages: npm/egg-security@3.7.0, npm/egg-session@3.3.0, npm/formstream@1.5.1, npm/graceful@2.0.0, npm/is-type-of@2.2.0, npm/koa-bodyparser@4.4.1, npm/koa-override@4.0.0, npm/koa-static@5.0.0, npm/mm@3.4.0, npm/onelogger@1.0.1, npm/pedding@2.0.1, npm/performance-ms@1.1.0, npm/prettier@2.8.8, npm/runscript@2.0.1, npm/sdk-base@4.2.1, npm/sendmessage@3.0.1, npm/spy@1.0.0, npm/tsd@0.31.2, npm/tshy-after@1.4.0, npm/tshy@3.0.2, npm/typescript@5.7.3, npm/urllib@4.6.11, npm/utility@2.5.0, npm/ylru@1.4.0 |
fengmk2
changed the title
fengmk2
changed the title
![coderabbitai[bot]](/~https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🔭 Outside diff range comments (1)
src/lib/types.ts (1)
Documentation needed for security configuration migration
The removal of the
securityproperty fromEggAppConfigis a breaking change that lacks proper migration documentation. While the@eggjs/securityplugin is mentioned in the documentation as being "built into the framework", there are no clear instructions for users on:
- How to migrate from the old configuration format
- The new configuration structure with
@eggjs/security- Examples of the new configuration format
This could lead to confusion and potential security misconfigurations during upgrades.
🔗 Analysis chain
Line range hint
1-1: Verify migration path for security configurations.The removal of the
securityproperty fromEggAppConfigis a breaking change. Users will need guidance on how to migrate their existing security configurations to the new@eggjs/securityplugin format.Please ensure that:
- Migration documentation exists for users to transition from the old configuration format to the new one
- The README or migration guide includes examples of the new configuration format
- Any automated migration tools or codemods are provided if possible
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Check for migration documentation and examples # Look for migration guides or documentation updates rg -l --type md "migration|upgrade|breaking.+change" docs/ # Check for examples of the new security configuration rg -l --type md "@eggjs/security" docs/Length of output: 192
Script:
#!/bin/bash # Find all markdown files and search for relevant content echo "=== Markdown files ===" fd -e md echo -e "\n=== Security migration content ===" rg -l "security|@eggjs/security" -g "*.md" echo -e "\n=== Breaking changes content ===" rg -l "breaking.+changes?|migration|upgrade" -g "*.md" echo -e "\n=== Package.json content ===" cat package.json | jq -r '.homepage,.repository,.documentation'Length of output: 5239
Script:
#!/bin/bash echo "=== Security documentation content ===" rg -A 5 -B 5 "@eggjs/security" "site/docs/core/security.md" || true echo -e "\n=== Migration guide content ===" rg -A 5 -B 5 "security|@eggjs/security" "site/docs/intro/migration.md" || true echo -e "\n=== Recent changelog entries ===" head -n 50 CHANGELOG.mdLength of output: 3257
🧹 Nitpick comments (3)
test/index.test-d.ts (3)
53-54: Enhance security plugin type tests.The current test only covers
csrf.headerName. Consider adding type tests for other critical CSRF configurations:
security.csrf.enablesecurity.csrf.ignoreJSONsecurity.csrf.useSessionsecurity.csrf.cookieNamesecurity.csrf.sessionName// security plugin types expectType<string>(app.config.security.csrf.headerName); +expectType<boolean>(app.config.security.csrf.enable); +expectType<boolean>(app.config.security.csrf.ignoreJSON); +expectType<boolean>(app.config.security.csrf.useSession); +expectType<string>(app.config.security.csrf.cookieName); +expectType<string>(app.config.security.csrf.sessionName);
56-57: Enhance session plugin type tests.The current test only covers
httpOnly. Consider adding type tests for other important session configurations:
session.maxAgesession.keysession.encryptsession.signedsession.sameSite// session plugin types expectType<boolean>(app.config.session.httpOnly); +expectType<number>(app.config.session.maxAge); +expectType<string>(app.config.session.key); +expectType<boolean>(app.config.session.encrypt); +expectType<boolean>(app.config.session.signed); +expectType<boolean | 'lax' | 'strict' | 'none'>(app.config.session.sameSite);
161-171: Consider documenting the commented type test and enhancing type safety.
The commented out
expectType<Redis>(redis.get('client1'))appears intentional. Consider adding a comment explaining why this type check is expected to fail, or remove it if no longer needed.Consider enhancing type safety:
class Redis { + private constructor() {} // Ensure singleton pattern + get(key: string) { + if (!key) throw new TypeError('key is required'); return key; } + + static create(): Redis & Singleton<Redis> { + return {} as Redis & Singleton<Redis>; + } } -const redis = {} as Redis & Singleton<Redis>; +const redis = Redis.create();
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (11)
index-old.d.ts(0 hunks)package.json(1 hunks)site/docs/basics/controller.md(1 hunks)site/docs/basics/controller.zh-CN.md(2 hunks)site/docs/basics/plugin.md(1 hunks)site/docs/basics/plugin.zh-CN.md(1 hunks)site/docs/core/cookie-and-session.md(1 hunks)site/docs/core/cookie-and-session.zh-CN.md(1 hunks)src/config/plugin.ts(2 hunks)src/lib/types.ts(1 hunks)test/index.test-d.ts(3 hunks)
💤 Files with no reviewable changes (1)
- index-old.d.ts
✅ Files skipped from review due to trivial changes (4)
- site/docs/core/cookie-and-session.md
- site/docs/basics/controller.md
- site/docs/basics/controller.zh-CN.md
- site/docs/core/cookie-and-session.zh-CN.md
🚧 Files skipped from review as they are similar to previous changes (4)
- site/docs/basics/plugin.zh-CN.md
- site/docs/basics/plugin.md
- src/config/plugin.ts
- package.json
⏰ Context from checks skipped due to timeout of 90000ms (13)
- GitHub Check: Node.js / Test (windows-latest, 22)
- GitHub Check: Node.js / Test (windows-latest, 20)
- GitHub Check: Node.js / Test (windows-latest, 18.19.0)
- GitHub Check: Node.js / Test (windows-latest, 18)
- GitHub Check: Node.js / Test (ubuntu-latest, 22)
- GitHub Check: Node.js / Test (ubuntu-latest, 20)
- GitHub Check: Node.js / Test (ubuntu-latest, 18.19.0)
- GitHub Check: Node.js / Test (ubuntu-latest, 18)
- GitHub Check: Node.js / Test (macos-latest, 22)
- GitHub Check: Node.js / Test (macos-latest, 20)
- GitHub Check: Node.js / Test (macos-latest, 18)
- GitHub Check: Node.js / Test (macos-latest, 18.19.0)
- GitHub Check: Deploy-Preview
🔇 Additional comments (2)
test/index.test-d.ts (1)
9-9: LGTM!The
Singletonimport is correctly added and properly used later in the file.src/lib/types.ts (1)
25-27: Verify package dependencies for the new imports.The imports look good and align with the migration to scoped packages. Let's verify that these dependencies are properly declared in package.json.
✅ Verification successful
Dependencies are properly configured for the new imports
All three packages (
@eggjs/security,@eggjs/schedule, and@eggjs/session) are correctly declared in package.json, and no references to the legacy packages were found.🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Verify that the imported packages are declared as dependencies # Check if the packages are declared in package.json jq -r '.dependencies | select(has("@eggjs/security") and has("@eggjs/schedule") and has("@eggjs/session"))' package.json # Check if there are any remaining references to the old packages rg -l "egg-security|egg-schedule|egg-session" --type jsonLength of output: 1076
[skip ci] ## [4.0.2](v4.0.1...v4.0.2) (2025-01-19) ### Bug Fixes * use @eggjs/security and @eggjs/session ([#5384](#5384)) ([d11ecd3](d11ecd3))
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## next #5384 +/- ##
==========================================
- Coverage 95.17% 95.15% -0.02%
==========================================
Files 41 41
Lines 3915 3903 -12
Branches 434 433 -1
==========================================
- Hits 3726 3714 -12
Misses 189 189 ☔ View full report in Codecov by Sentry. |
export Singleton
Summary by CodeRabbit
Dependencies
egg-securitywith@eggjs/securitypackageegg-sessionwith@eggjs/sessionpackageDocumentation
Configuration
@eggjs/securityand@eggjs/sessionpackagesCore Functionality