Repository navigation
fix: resolve 13 codebase bugs and enrich README with Studio visual screenshots - #11
Merged
Merged
Conversation
## Critical Fixes
### Silent error swallowing in postHook.js
- Import log utility and replace empty catch block with actual error logging
- Birdwatch failures are now visible in APM and server logs
### Cache poisoned with null before null-check in authMiddleware.js
- Move cacheClient.set() call to after the null-check in verifyIfStaticTokenIsValidOrNot
- Prevents null from being stored in the app token cache, avoiding repeated unnecessary DB queries
### Disabled auth blacklist — documented intent clearly
- Add explanatory TODO comment explaining why full-header blacklist check is disabled
- Clarify that per-token validation still occurs downstream
## Moderate Fixes
### async forEach anti-pattern in birdwatch/index.js
- Replace both the outer birdWatchConfig.forEach and inner listener.do.forEach with for...of loops
- await is now valid and each async task is properly sequenced with errors caught per-task
### Plural query resolver using wrong hook name in resolvers/index.js
- Both prehook() and posthook() in the list (plural) resolver were passing modelSingular
- Changed to modelPlural so list-level hooks fire under the correct operation name
### Outbox worker breaking on first webhook failure in outbox/worker.js
- Remove the break statement that was stopping dispatch after the first failed webhook
- All webhooks in remainingWebhooks are now attempted; failure messages are joined and reported together
### validate() returning false for valid operations in validate.js
- Add explicit return true inside the SINGULAR / PLURAL / DELETE branch
- Function no longer falls through to return false after successful validation
## Minor / Security Fixes
### Insecure default webhook secret in dispatcher.js and manager.js
- Log a prominent error-level warning when default_secret is used instead of a configured secret
- Warning is suppressed in test environments (NODE_ENV=test)
### Broken fetch timeout in dispatcher.js
- Replace the unsupported node-fetch v3 timeout option with AbortController + setTimeout
- Timeout errors are now reported with a clear message (Webhook timed out after Xms)
- clearTimeout in finally block prevents timer leaks
### Redundant condition in eventUtils.js
- Remove startsWith('addUser') from the add detection guard (already matched by startsWith('add'))
### Unbounded MongoDB reconnect loop in connectDB.js
- Add MAX_RECONNECT_ATTEMPTS = 10 cap with exponential backoff (2^n * 1000ms, capped at 30s)
- Log a critical error and halt retries once the limit is reached
### Empty pickDependency.js file
- Add module docstring and export default {} to prevent silent undefined imports
## Test Results
- All 91 tests pass (npm test)
namanmukund
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR resolves 13 bugs across authentication, Birdwatch event loops, GraphQL resolvers, validation, webhook infrastructure, and database resilience, and optimizes the README and documentation with high-resolution visual screenshots of AutoGraphQL Studio to significantly improve developer onboarding.
---\n
🎨 Visual Studio Screenshots & Documentation Enhancements
docs/assets/studio/) showcasing the most significant developer capabilities:@relationforeign keys across MongoDB & PostgreSQL./studio?tab=<tab-id>) in the Studio Single-Page Application.README.mdwith a hero showcase banner and dedicated visual feature cards.docs/studio-user-guide.mdwith rich screenshots embedded in each section.---\n
🐛 13 Resolved Bugs
postHook.js: Silent error swallowing in empty catch block — addedlog.error.authMiddleware.js: Cache poisoning withnullbefore null-check — fixed order.authMiddleware.js: Disabled auth blacklist — documented security model.birdwatch/index.js: AsyncforEachrace conditions — replaced withfor...ofloops.resolvers/index.js: Plural query resolver passingmodelSingularinstead ofmodelPluralto pre/post hooks.validate.js: Missing returntruefor unvalidated operations (SINGULAR,PLURAL,DELETE).outbox/worker.js: Batch loop break on single webhook delivery failure — changed tocontinue.dispatcher.js: DeprecatedsetTimeoutcontroller replaced withAbortSignal.timeout(timeoutMs).dispatcher.js: Added warning log when falling back to default HMAC secret.manager.js: Added warning log when registering webhook with default secret.eventUtils.js: Removed redundant regex startsWith check.connectDB.js: Added bounded retry cap (max 10) with exponential backoff.pickDependency.js: Exported utility function placeholder instead of empty file.---\n
🧪 Test Verification
npm test: 91 / 91 passed across all suites with 0 regressions.