PROD RELEASE #16

kkartunov · 2025-09-16T10:31:56Z

TC MCP to production.

DIsable auth

PM-1437 - Use canActivate for tools

PM-1437 Feat/auth

update pnpm-lock

Feat/tc agent

logger level

…nges test log

…nges add more logs

…nges Use axios for fetching challenges

…nges package updated - add axios

github-actions · 2025-09-16T10:34:41Z

src/core/auth/guards/guards.utils.ts

+export const decodeAuthToken = async (
+  authHeader: string,
+): Promise<boolean | jwt.JwtPayload | string> => {
+  const [type, idToken] = authHeader?.split(' ') ?? [];


high
correctness
The use of optional chaining with authHeader?.split(' ') can lead to undefined being destructured into type and idToken, which might not be the intended behavior. Consider explicitly checking if authHeader is defined before splitting.

github-actions · 2025-09-16T10:34:42Z

src/core/auth/guards/guards.utils.ts

+  let decoded: jwt.JwtPayload | string;
+  try {
+    const signingKey = await getSigningKey(idToken);
+    decoded = jwt.verify(idToken, signingKey);


medium
performance
The jwt.verify method can throw an error if the token is invalid. While this is caught and handled, consider using jwt.verify's callback form to avoid using try-catch for flow control, which can improve readability and performance.

github-actions · 2025-09-16T10:34:45Z

src/core/auth/guards/m2m-scope.guard.ts

+export const checkM2MScope =
+  (...requiredM2mScopes: M2mScope[]) =>
+  async (req: Request) => {
+    const decodedAuth = await decodeAuthToken(req.headers.authorization ?? '');


high
correctness
Consider handling the case where decodeAuthToken might throw an error, which could lead to unhandled promise rejections or unexpected behavior.

github-actions · 2025-09-16T10:34:46Z

src/core/auth/guards/m2m-scope.guard.ts

+  async (req: Request) => {
+    const decodedAuth = await decodeAuthToken(req.headers.authorization ?? '');
+
+    const authorizedScopes = ((decodedAuth as JwtPayload).scope ?? '').split(


medium
correctness
The use of split(' ') assumes that scopes are space-separated. Ensure that this assumption aligns with the token structure, or consider making it configurable.

github-actions · 2025-09-16T10:34:49Z

src/core/auth/guards/role.guard.ts

+export const checkHasUserRole =
+  (...requiredUserRoles: Role[]) =>
+  async (req: Request) => {
+    const decodedAuth = await decodeAuthToken(req.headers.authorization ?? '');


high
correctness
Consider handling the case where decodeAuthToken might throw an error due to invalid or malformed tokens. This could prevent potential runtime exceptions and improve robustness.

github-actions · 2025-09-16T10:34:49Z

src/core/auth/guards/role.guard.ts

+  async (req: Request) => {
+    const decodedAuth = await decodeAuthToken(req.headers.authorization ?? '');
+
+    const decodedUserRoles = Object.keys(decodedAuth).reduce((roles, key) => {


medium
maintainability
The use of Object.keys(decodedAuth).reduce(...) assumes that the roles are stored in a specific key format. If the structure of decodedAuth changes, this could lead to incorrect behavior. Consider validating the structure of decodedAuth or using a more explicit approach to extract roles.

github-actions · 2025-09-16T10:34:49Z

src/core/auth/guards/role.guard.ts

+
+    const decodedUserRoles = Object.keys(decodedAuth).reduce((roles, key) => {
+      if (key.match(/claims\/roles$/gi)) {
+        return decodedAuth[key] as string[];


high
correctness
The type assertion as string[] could lead to runtime errors if the value is not actually an array of strings. Consider adding type checks or validation to ensure the expected format.

github-actions · 2025-09-16T10:34:53Z

src/main.ts

 async function bootstrap() {
-  const app = await NestFactory.create(AppModule);
+  const app = await NestFactory.create(AppModule, {
+    logger: ['error', 'warn', 'log', 'debug'],


high
security
Consider restricting the logger levels in production to avoid potentially sensitive information being logged. For example, you might want to exclude 'debug' and 'log' levels in a production environment.

github-actions · 2025-09-16T10:34:53Z

src/main.ts

  const logger = new Logger('bootstrap()');

+  // Global prefix for all routes
+  app.setGlobalPrefix(ENV_CONFIG.API_BASE);


high
security
Ensure that ENV_CONFIG.API_BASE is validated and sanitized to prevent any potential security vulnerabilities, such as path traversal attacks.

github-actions · 2025-09-16T10:34:57Z

src/mcp/resources/swagger/challenges.resource.ts

+  async getChallengesApiSwagger() {
+    this.logger.debug('Fetching Challenges V6 API Swagger');
+    // Fetch the content from the URI and return it.
+    const rawContent = await axios.get(SPEC_URL);


high
correctness
Consider adding error handling for the axios.get request to manage potential network errors or invalid responses. This will improve the robustness of the method.

github-actions · 2025-09-16T10:35:00Z

src/mcp/resources/swagger/identity.resource.ts

+import { Logger } from 'src/shared/global';
+import { LogTime } from 'src/shared/global/logTime.decorator';
+
+const SPEC_URL =


medium
maintainability
Consider moving SPEC_URL to a configuration file or environment variable to allow easier updates and avoid hardcoding URLs directly in the code.

github-actions · 2025-09-16T10:35:00Z

src/mcp/resources/swagger/identity.resource.ts

+  async getIdentityApiSwagger() {
+    this.logger.debug('Fetching Identity V6 API Swagger');
+    // Fetch the content from the URI and return it.
+    const rawContent = await axios.get(SPEC_URL);


high
correctness
Add error handling for the axios.get(SPEC_URL) call to manage potential network errors or invalid responses gracefully.

github-actions · 2025-09-16T10:35:02Z

src/mcp/resources/swagger/member.resource.ts

+  async getMemberApiSwagger() {
+    this.logger.debug('Fetching Member V6 API Swagger');
+    // Fetch the content from the URI and return it.
+    const rawContent = await axios.get(SPEC_URL);


high
correctness
Consider adding error handling for the axios.get call to manage potential network errors or invalid responses. This will improve the robustness of the method.

github-actions · 2025-09-16T10:35:04Z

src/mcp/resources/swagger/review.resource.ts

+  async getReviewApiSwagger() {
+    this.logger.debug('Fetching Review V6 API Swagger');
+    // Fetch the content from the URI and return it.
+    const rawContent = await axios.get(SPEC_URL);


high
correctness
Consider adding error handling for the axios.get(SPEC_URL) call to manage potential network errors or unexpected responses. This will improve the robustness of the function.

github-actions · 2025-09-16T10:35:07Z