Add early validation for receipt ID format - #219
Conversation
|
@Jighnesh-Py13 is attempting to deploy a commit to the ankanmisra's projects Team on Vercel. A member of the Team first needs to authorize it. |
|
Warning Review limit reached
More reviews will be available in 50 minutes and 17 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (6)
📝 WalkthroughWalkthroughAdds an ChangesReceipt ID Validation
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Hi @Jighnesh-Py13, thanks for opening this PR. Every contribution helps MicroAI-Paygate grow. If you find the project useful, consider starring the repository — it helps others discover it. Star MicroAI-Paygate on GitHub Looking forward to reviewing this PR. |
github-actions
Bot
added
go
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@gateway/main_test.go`:
- Around line 619-632: Replace the single-case TestHandleGetReceipt_InvalidID
with a table-driven test that iterates cases for empty ID (""), prefix-only
("rcpt_"), too-long ID (>128 chars), malformed ("foo"), and a valid ID
("rcpt_a1b2c3d4e5f6"); for each case use httptest.NewRecorder and
gin.CreateTestContext, set c.Params with the case id, call handleGetReceipt, and
assert both the expected HTTP status and that the response body contains the
expected error message (for invalid cases) or proceeds to store lookup for the
valid case; for the valid-case path mock or initialize the receipt store used by
handleGetReceipt so the handler reaches the lookup and you can assert the
successful path.
In `@gateway/main.go`:
- Around line 951-958: The handler rejects malformed receipt IDs using
isValidReceiptID in GET /api/receipts/{id} and returns 400 with
{"error":"invalid receipt id format","message":"receipt id must start with rcpt_
and contain an id"}; update gateway/openapi.yaml to add a 400 response for the
GET /api/receipts/{id} operation that documents this response (status 400) and
its response schema (error and message string properties and an example matching
the handler) so the OpenAPI spec matches the runtime behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 39cc227a-fcfd-41f0-ade5-697706e3bcab
📒 Files selected for processing (2)
gateway/main.gogateway/main_test.go
github-actions
Bot
added
documentation
There was a problem hiding this comment.
🧹 Nitpick comments (1)
gateway/openapi.yaml (1)
243-255: ⚡ Quick winConsider marking response fields as required.
The handler always returns both
errorandmessagefields (verified in gateway/main.go:952-955), so the schema should reflect that guarantee withrequired: [error, message].📋 Proposed schema improvement
"400": description: Invalid receipt ID format. content: application/json: schema: type: object + required: [error, message] properties: error:🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@gateway/openapi.yaml` around lines 243 - 255, Update the OpenAPI 400 response schema for the receipt endpoint so it marks the returned fields as required: add required: [error, message] to the schema under the "400" response; this aligns the spec with the handler behavior that always returns both fields (see gateway/main.go handler that sets error and message) and ensures clients treat those properties as mandatory.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@gateway/openapi.yaml`:
- Around line 243-255: Update the OpenAPI 400 response schema for the receipt
endpoint so it marks the returned fields as required: add required: [error,
message] to the schema under the "400" response; this aligns the spec with the
handler behavior that always returns both fields (see gateway/main.go handler
that sets error and message) and ensures clients treat those properties as
mandatory.
|
@codex review |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
AnkanMisra
added
enhancement
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6933da374c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
gateway/main.go (1)
936-942:⚠️ Potential issue | 🟡 MinorRun
gofmtonmain_test.goandratelimit.gobefore committing.The receipt-id validation logic returning a 400 for malformed IDs is fine.
go vet ./...reports no issues, butgofmt -lshows formatting still needed in:
main_test.goratelimit.go🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@gateway/main.go` around lines 936 - 942, Run gofmt on the unformatted Go files reported by gofmt: reformat main_test.go and ratelimit.go (e.g. run `gofmt -w main_test.go ratelimit.go`) and re-run `gofmt -l` to verify no files remain; then stage and commit the formatted files so the repository passes formatting checks—no functional changes needed to functions like isValidReceiptID.Source: Coding guidelines
🧹 Nitpick comments (1)
gateway/main.go (1)
926-929: ⚡ Quick winPre-compile the regex for better performance.
regexp.MatchStringcompiles the pattern on every call. Since the pattern is constant, compile it once at package level to avoid repeated compilation overhead on every receipt lookup.⚡ Proposed optimization
Add a package-level compiled regex:
+var receiptIDPattern = regexp.MustCompile(`^rcpt_[a-f0-9]{12}$`) + func isValidReceiptID(id string) bool { - matched, _ := regexp.MatchString(`^rcpt_[a-f0-9]{12}$`, id) - return matched + return receiptIDPattern.MatchString(id) }Note:
MustCompilepanics at startup if the pattern is invalid, which is appropriate for a constant pattern and provides earlier failure detection.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@gateway/main.go` around lines 926 - 929, isValidReceiptID currently calls regexp.MatchString which recompiles the pattern on every invocation; define a package-level compiled regex (e.g., var receiptIDRe = regexp.MustCompile(`^rcpt_[a-f0-9]{12}$`)) and update isValidReceiptID to use receiptIDRe.MatchString(id) so the pattern is compiled once at startup and reused.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@gateway/main.go`:
- Around line 936-942: Run gofmt on the unformatted Go files reported by gofmt:
reformat main_test.go and ratelimit.go (e.g. run `gofmt -w main_test.go
ratelimit.go`) and re-run `gofmt -l` to verify no files remain; then stage and
commit the formatted files so the repository passes formatting checks—no
functional changes needed to functions like isValidReceiptID.
---
Nitpick comments:
In `@gateway/main.go`:
- Around line 926-929: isValidReceiptID currently calls regexp.MatchString which
recompiles the pattern on every invocation; define a package-level compiled
regex (e.g., var receiptIDRe = regexp.MustCompile(`^rcpt_[a-f0-9]{12}$`)) and
update isValidReceiptID to use receiptIDRe.MatchString(id) so the pattern is
compiled once at startup and reused.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 29976426-9ac9-4ea8-94c7-0c4535839a5d
📒 Files selected for processing (2)
gateway/main.gogateway/openapi.yaml
🚧 Files skipped from review as they are similar to previous changes (1)
- gateway/openapi.yaml
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a7b4b92056
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5d155251b5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Codex Review: Didn't find any major issues. Breezy! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ecffb9c50a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
AnkanMisra
left a comment
AnkanMisra
left a comment
There was a problem hiding this comment.
This PR is 2 commits behind main. Please rebase or merge main into your branch.
a52aad1 to
171ca3f
Compare
|
Hi @AnkanMisra |
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: codex <codex@users.noreply.github.com>
171ca3f to
71f8171
Compare
|
@codex review the pr |
|
Codex Review: Didn't find any major issues. Can't wait for the next one! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
2 participants
Closes #210
Summary
Adds early validation for receipt IDs in handleGetReceipt to reject malformed IDs before hitting the store layer.
Changes
Behavior
Testing
Non-breaking
No changes to receipt generation or x402 verification logic.
Summary by CodeRabbit
rcpt_+ 12 lowercase-hex format before any lookup, returning HTTP 400 witherrorandmessagefor invalid inputs.