Skip to content

Add series partner and user enrollment mapping functionality#827

Merged
tenkus47 merged 2 commits into
developfrom
update_token_author_group_id
Jun 27, 2026
Merged

Add series partner and user enrollment mapping functionality#827
tenkus47 merged 2 commits into
developfrom
update_token_author_group_id

Conversation

@tenkus47

Copy link
Copy Markdown
Member
  • Introduced get_series_partner_id_map_for_group and get_user_series_enrollment_partner_map functions to retrieve mappings for series partners and user enrollments.
  • Updated the GroupSeriesListItemDTO to include series_partner_id and is_enrolled fields.
  • Refactored the _series_to_dtos function to utilize the new mappings for enhanced series detail retrieval.
  • Modified the get_author_group_detail endpoint to support user authentication and pass user ID for enrollment checks.
  • Added tests for the new mapping functions and updated existing tests to cover new functionality.

tenkus47 and others added 2 commits June 27, 2026 16:48
- Introduced `get_series_partner_id_map_for_group` and `get_user_series_enrollment_partner_map` functions to retrieve mappings for series partners and user enrollments.
- Updated the `GroupSeriesListItemDTO` to include `series_partner_id` and `is_enrolled` fields.
- Refactored the `_series_to_dtos` function to utilize the new mappings for enhanced series detail retrieval.
- Modified the `get_author_group_detail` endpoint to support user authentication and pass user ID for enrollment checks.
- Added tests for the new mapping functions and updated existing tests to cover new functionality.
@Tech-lo Tech-lo self-requested a review June 27, 2026 11:57
@tenkus47 tenkus47 merged commit fa1521b into develop Jun 27, 2026
4 checks passed
@tenkus47 tenkus47 deleted the update_token_author_group_id branch June 27, 2026 11:58
@greptile-apps

greptile-apps Bot commented Jun 27, 2026

Copy link
Copy Markdown

Confidence Score: 4/5

The optional-auth group detail path needs a fix before merging.

  • Invalid or expired tokens can return a successful anonymous response.
  • The new DTO and repository mapping changes appear consistent with the inspected model fields and call sites.

pecha_api/plans/groups/groups_service.py

Security Review

Invalid bearer tokens on the public group detail endpoint are downgraded to anonymous responses, which can hide authentication failures and return incorrect user-specific enrollment state.

Reviews (1): Last reviewed commit: "Merge branch 'develop' into update_token..." | Re-trigger Greptile

Comment on lines +707 to +710
user = validate_and_extract_user_details(token=token)
user_id = user.id
except Exception:
pass

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 security Rejected Tokens Become Anonymous

When a client sends an expired or malformed bearer token, validate_and_extract_user_details raises an auth error, but this catch-all block discards it and continues with user_id=None. The public group response then returns 200 with is_enrolled=False for every series, so an authenticated client can receive anonymous enrollment state instead of an authentication failure.

@sonarqubecloud

Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants