-
-
Notifications
You must be signed in to change notification settings - Fork 79
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
commit #977
commit #977
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,71 @@ | ||
"""OWASP snapshot GraphQL node.""" | ||
|
||
import graphene | ||
|
||
from apps.github.graphql.nodes.issue import IssueNode | ||
from apps.github.graphql.nodes.release import ReleaseNode | ||
from apps.github.graphql.nodes.user import UserNode | ||
from apps.owasp.graphql.nodes.chapter import ChapterNode | ||
from apps.owasp.graphql.nodes.common import GenericEntityNode | ||
from apps.owasp.graphql.nodes.project import ProjectNode | ||
from apps.owasp.models.snapshot import Snapshot | ||
|
||
RECENT_ISSUES_LIMIT = 10 | ||
RECENT_RELEASES_LIMIT = 10 | ||
RECENT_PROJECTS_LIMIT = 10 | ||
RECENT_USERS_LIMIT = 10 | ||
|
||
|
||
class SnapshotNode(GenericEntityNode): | ||
"""Snapshot node.""" | ||
|
||
key = graphene.String() | ||
status = graphene.String() | ||
error_message = graphene.String() | ||
new_chapters = graphene.List(ChapterNode) | ||
new_issues = graphene.List(IssueNode) | ||
new_projects = graphene.List(ProjectNode) | ||
new_releases = graphene.List(ReleaseNode) | ||
new_users = graphene.List(UserNode) | ||
|
||
class Meta: | ||
model = Snapshot | ||
fields = ( | ||
"title", | ||
"created_at", | ||
"updated_at", | ||
"start_at", | ||
"end_at", | ||
) | ||
|
||
def resolve_key(self, info): | ||
"""Resolve key.""" | ||
return self.key | ||
|
||
def resolve_status(self, info): | ||
"""Resolve status.""" | ||
return self.status | ||
|
||
def resolve_error_message(self, info): | ||
"""Resolve error message.""" | ||
return self.error_message | ||
|
||
def resolve_new_chapters(self, info): | ||
"""Resolve new chapters.""" | ||
return self.new_chapters.all() | ||
|
||
def resolve_new_issues(self, info): | ||
"""Resolve recent new issues.""" | ||
return self.new_issues.order_by("-created_at")[:RECENT_ISSUES_LIMIT] | ||
|
||
def resolve_new_projects(self, info): | ||
"""Resolve recent new projects.""" | ||
return self.new_projects.order_by("-created_at")[:RECENT_PROJECTS_LIMIT] | ||
|
||
def resolve_new_releases(self, info): | ||
"""Resolve recent new releases.""" | ||
return self.new_releases.order_by("-published_at")[:RECENT_RELEASES_LIMIT] | ||
Comment on lines
+61
to
+67
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 💡 Verification agent 🧩 Analysis chainConsider adding tests for field resolvers Implement unit tests for these resolver methods to ensure they correctly handle edge cases like empty collections. 🏁 Script executed: #!/bin/bash
# Check if there are existing tests for resolver methods
echo "Looking for existing resolver tests..."
rg -A 5 "test.*resolve" --type py backend/tests/ Length of output: 11189 Add Unit Tests for Snapshot Field Resolvers The implementation of the
Making these additions will ensure consistent behavior with the resolver patterns implemented and tested in other parts of the project. |
||
|
||
def resolve_new_users(self, info): | ||
"""Resolve recent new users.""" | ||
return self.new_users.order_by("-created_at")[:RECENT_USERS_LIMIT] |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,32 @@ | ||
"""OWASP snapshot GraphQL queries.""" | ||
|
||
import graphene | ||
|
||
from apps.common.graphql.queries import BaseQuery | ||
from apps.owasp.graphql.nodes.snapshot import SnapshotNode | ||
from apps.owasp.models.snapshot import Snapshot | ||
|
||
|
||
class SnapshotQuery(BaseQuery): | ||
"""Snapshot queries.""" | ||
|
||
snapshot = graphene.Field( | ||
SnapshotNode, | ||
key=graphene.String(required=True), | ||
) | ||
|
||
recent_snapshots = graphene.List( | ||
SnapshotNode, | ||
limit=graphene.Int(default_value=8), | ||
) | ||
|
||
def resolve_snapshot(root, info, key): | ||
"""Resolve snapshot by key.""" | ||
try: | ||
return Snapshot.objects.get(key=key) | ||
except Snapshot.DoesNotExist: | ||
return None | ||
|
||
def resolve_recent_snapshots(root, info, limit): | ||
"""Resolve recent snapshots.""" | ||
return Snapshot.objects.order_by("-created_at")[:limit] |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,40 @@ | ||
import { gql } from '@apollo/client' | ||
|
||
export const GET_SNAPSHOT_DETAILS = gql` | ||
query GetSnapshotDetails($key: String!) { | ||
snapshot(key: $key) { | ||
title | ||
key | ||
createdAt | ||
updatedAt | ||
startAt | ||
endAt | ||
newReleases { | ||
name | ||
version | ||
releaseDate | ||
} | ||
newProjects { | ||
key | ||
name | ||
summary | ||
starsCount | ||
forksCount | ||
repositoriesCount | ||
topContributors { | ||
name | ||
login | ||
contributionsCount | ||
} | ||
} | ||
newChapters { | ||
key | ||
name | ||
geoLocation { | ||
lat | ||
lng | ||
} | ||
} | ||
} | ||
} | ||
` |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
💡 Verification agent
🧩 Analysis chain
Security consideration: consider adding access control checks
The resolvers don't include access control checks. Consider adding authorization logic to ensure users can only access snapshots they have permission to view.
🏁 Script executed:
Length of output: 681
Security: Add Authorization Checks in Snapshot Resolver
At
backend/apps/owasp/graphql/nodes/snapshot.py
(lines 57-59), theresolve_new_issues
method currently returns data without verifying if the requesting user has appropriate permissions. There are no existing access control checks in this resolver, and similar patterns elsewhere in the codebase (e.g., inproject.py
) also lack explicit authorization logic, while the common base (BaseQuery
inbackend/apps/common/graphql/queries.py
) does not seem to enforce such permissions either.