Skip to content

Conversation

@jasukej
Copy link
Contributor

@jasukej jasukej commented May 31, 2025

User description

  • applications should be associated to user info by userId

PR Type

Bug fix


Description

  • Include userId in profile save operations

  • Include userId in application save operations


Changes walkthrough 📝

Relevant files
Bug fix
application_controller.ts
Add userId to saved data objects                                                 

functions/src/controllers/application_controller.ts

  • Added userId to data payload
  • Updated both PROFILE and application branches
  • +2/-0     

    Need help?
  • Type /help how to ... in the comments thread for any questions about PR-Agent usage.
  • Check out the documentation for more information.
  • @github-actions
    Copy link

    PR Reviewer Guide 🔍

    Here are some key observations to aid the review process:

    ⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪
    🧪 No relevant tests
    🔒 No security concerns identified
    ⚡ Recommended focus areas for review

    Document ID usage

    Using uid as the document ID for applications limits each user to a single application. Consider generating unique application IDs and retaining userId for association.

    else {
      const docRef = db.collection("applications").doc(uid);
      const doc = await docRef.get();
    
      const data: Record<string, string> = {
        ...dataToSave,
        userId: uid,
    Type consistency

    The data object is typed as Record<string, string>. Ensure all new fields (userId, updatedAt) are strings and align with your schema definitions.

    const data: Record<string, string> = {
      ...dataToSave,
      userId: uid,
      updatedAt: new Date().toISOString(),

    @github-actions
    Copy link

    PR Code Suggestions ✨

    Explore these optional code suggestions:

    CategorySuggestion                                                                                                                                    Impact
    Security
    Strip userId before merge

    Prevent clients from injecting or overriding the userId by removing it from
    dataToSave before merging, then explicitly assign the authenticated uid. This
    guarantees the stored user reference is always correct.

    functions/src/controllers/application_controller.ts [135-139]

    +const { userId: _, ...safeData } = dataToSave;
     const data: Record<string, string> = {
    -  ...dataToSave,
    +  ...safeData,
       userId: uid,
       updatedAt: new Date().toISOString(),
     };
    Suggestion importance[1-10]: 8

    __

    Why: This change prevents clients from injecting or overriding the userId by removing it from dataToSave and then explicitly assigning the authenticated uid, improving security.

    Medium
    General
    Use consistent uid field

    Rename the userId property to uid to match the function parameter and ensure
    consistency with the PR title and any queries expecting a uid field. You can
    leverage ES6 shorthand to keep the syntax concise.

    functions/src/controllers/application_controller.ts [118-120]

     ...dataToSave,
    -userId: uid,
    +uid,
     updatedAt: new Date().toISOString(),
    Suggestion importance[1-10]: 2

    __

    Why: The suggestion renames the userId field to uid, which alters the document schema and may break existing queries and data consistency.

    Low

    Copy link
    Member

    @hib4 hib4 left a comment

    Choose a reason for hiding this comment

    The reason will be displayed to describe this comment to others. Learn more.

    LGTM!!

    @hib4 hib4 merged commit 9b3c1ac into main May 31, 2025
    1 check passed
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

    Projects

    None yet

    Development

    Successfully merging this pull request may close these issues.

    3 participants