Add VerifiedGuard#218
Conversation
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughA new ChangesVerifiedGuard implementation and controller wiring
Estimated code review effort: 2 (Simple) | ~10 minutes Sequence Diagram(s)sequenceDiagram
participant Client
participant Controller
participant ApprovedGuard
participant VerifiedGuard
Client->>Controller: HTTP request
Controller->>ApprovedGuard: canActivate(context)
ApprovedGuard-->>Controller: allow/deny
Controller->>VerifiedGuard: canActivate(context)
VerifiedGuard->>VerifiedGuard: check request.user.emailVerified
alt not verified
VerifiedGuard-->>Controller: throw ForbiddenException
Controller-->>Client: 403 Forbidden
else verified or no user
VerifiedGuard-->>Controller: allow
Controller-->>Client: proceed to handler
end
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@backend/src/auth/guards/verified.guard.ts`:
- Around line 11-21: The VerifiedGuard logic is checking a property that is not
present on the authenticated user payload. Update JwtStrategy.validate() and the
TokenUser/request.user shape so `emailVerified` is included, or change
`VerifiedGuard.canActivate()` to fetch the full User entity before checking
verification status; use the `VerifiedGuard` and `JwtStrategy.validate` symbols
to keep the auth payload and guard in sync.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: f12623af-6920-4de5-a32f-ff574ee445b6
📒 Files selected for processing (8)
backend/src/appointments/appointments.controller.tsbackend/src/auth/guards/verified.guard.tsbackend/src/diagnosis/diagnosis.controller.tsbackend/src/doctors/doctors.controller.tsbackend/src/patients/patients.controller.tsbackend/src/scans/scans.controller.tsbackend/src/schedules/schedules.controller.tsbackend/src/users/users.controller.ts
| canActivate(context: ExecutionContext): boolean { | ||
| const request = context.switchToHttp().getRequest<RequestWithUser>(); | ||
| const user = request.user; | ||
| if (!user) return true; | ||
|
|
||
| if (!user.emailVerified) { | ||
| throw new ForbiddenException('Email is not verified'); | ||
| } | ||
|
|
||
| return true; | ||
| } |
There was a problem hiding this comment.
🔒 Security & Privacy | 🔴 Critical | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# What does the JWT/auth strategy assign to request.user?
fd -e ts . backend/src/auth --exec rg -nP 'validate\s*\(|request\.user\s*=|return\s' {} \; 2>/dev/null
echo "----- TokenUser interface -----"
fd 'token-user.interface.ts' backend/src --exec cat -n {}
echo "----- CurrentUser decorator -----"
fd 'current-user.decorator.ts' backend/src --exec cat -n {}
echo "----- emailVerified occurrences -----"
rg -nP '\bemailVerified\b' backend/srcRepository: MedAI-MU/medai
Length of output: 3667
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "----- auth tree -----"
fd -t f . backend/src/auth | sort
echo "----- jwt strategy outline -----"
ast-grep outline backend/src/auth/strategies/jwt.strategy.ts --view expanded
echo "----- verified guard usages -----"
rg -n "VerifiedGuard" backend/src
echo "----- auth strategy file -----"
cat -n backend/src/auth/strategies/jwt.strategy.ts
echo "----- relevant auth service snippets -----"
sed -n '1,220p' backend/src/auth/auth.service.tsRepository: MedAI-MU/medai
Length of output: 11370
request.user never carries emailVerified
JwtStrategy.validate() returns a TokenUser with only id, email, role, and status, so VerifiedGuard will treat every authenticated request as unverified and throw ForbiddenException. Add emailVerified to the JWT user payload, or load the full User entity before this check.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@backend/src/auth/guards/verified.guard.ts` around lines 11 - 21, The
VerifiedGuard logic is checking a property that is not present on the
authenticated user payload. Update JwtStrategy.validate() and the
TokenUser/request.user shape so `emailVerified` is included, or change
`VerifiedGuard.canActivate()` to fetch the full User entity before checking
verification status; use the `VerifiedGuard` and `JwtStrategy.validate` symbols
to keep the auth payload and guard in sync.
2 participants
Summary by CodeRabbit
New Features
Bug Fixes