✨ server: process business onboarding approvals - #1209
Conversation
🦋 Changeset detectedLatest commit: 2841376 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. WalkthroughChangesBusiness onboarding and Panda operations
Estimated code review effort: 4 (Complex) | ~60 minutes Merge Risk: 🟠 High · up to The PR adds business onboarding approval and card issuance flows, but the current implementation can fail startup when a configured secret is missing, permanently issue a card with the maximum default limit after an upstream error, create duplicate provider cards during concurrent requests, trust spoofable onboarding IP headers, and return server errors for malformed webhook signatures. These create material availability, financial, security, and correctness risks, so the change is not ready to merge without fixes or explicit owner acceptance. Sequence Diagram(s)sequenceDiagram
participant PandaAPI as Panda API
participant Hook as Panda webhook hook
participant KYC as KYC route
participant Finalizer as finalizeBusinessApproval
participant Database
PandaAPI->>Hook: Send approved company event
Hook->>Finalizer: Finalize approval under account mutex
KYC->>Finalizer: Finalize approved business application
Finalizer->>Database: Persist Panda user and signature card
Database-->>Finalizer: Return persisted approval state
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
14fbd8c to
9e408b8
Compare
9e408b8 to
146f4d1
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 7
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 3c48c2d8-ea42-4d42-ae0d-110eb98c518e
📒 Files selected for processing (10)
.changeset/brown-heads-vanish.mdserver/api/card.tsserver/api/kyc.tsserver/hooks/panda.tsserver/hooks/persona.tsserver/test/api/card.test.tsserver/test/api/kyc.test.tsserver/test/hooks/panda.test.tsserver/test/hooks/persona.test.tsserver/utils/panda.ts
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c9da4361e5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
c9da436 to
fcef25b
Compare
There was a problem hiding this comment.
Actionable comments posted: 6
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 625bcc87-6945-4e39-9145-8f706b3638f8
📒 Files selected for processing (13)
infra/utils/modules.tsserver/api/card.tsserver/api/index.tsserver/api/kyc.tsserver/hooks/bin/panda.tsserver/hooks/panda.tsserver/index.tsserver/test/api/card.test.tsserver/test/api/kyc.test.tsserver/test/hooks/bin.test.tsserver/test/hooks/panda.test.tsserver/test/utils/panda.test.tsserver/utils/panda.ts
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fcef25b6c8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
fcef25b to
183c53c
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 183c53c6a2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
183c53c to
07e66f6
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 07e66f6b13
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
server/utils/panda.ts (1)
253-260: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winTreat a malformed
signatureheader as invalid instead of throwing.
verifySignaturecallstimingSafeEqual(Buffer.from(signature, "hex"), Buffer.from(expectedSignature, "hex"))(server/utils/verifySignature.ts:9-13). Node throwsRangeErrorwhen the buffers have different lengths. Any request whosesignatureheader is not a 32-byte hex string therefore throws inside the validator, and the endpoint answers 500 instead of 401. An unauthenticated caller controls this header, so it can force error responses and Sentry noise on the webhook route. The new test at server/test/utils/panda.test.ts lines 111-119 sends a correctly sized HMAC, so it does not cover this input.🛡️ Proposed fix
function headerValidator() { return vValidator("header", object({ signature: string() }), async (r, c) => { if (!r.success) return c.text("bad request", 400); const payload = await c.req.arrayBuffer(); - if (verifySignature({ signature: r.output.signature, signingKey: key, payload })) return; + try { + if (verifySignature({ signature: r.output.signature, signingKey: key, payload })) return; + } catch {} // eslint-disable-line no-empty -- malformed signature is unauthorized return c.text("unauthorized", 401); }); }
♻️ Duplicate comments (1)
server/utils/panda.ts (1)
936-942: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winLook up the conflicting card row by
cards.id.
onConflictDoNothingmatches when the row forcard.idalready exists. The fallback query filters onstatusinACTIVEorFROZEN. If the stored row has any other status, the query returns nothing, the function returnsundefined, andcredit.enqueue,segment.track, andsardine.customernever run for the new card. The webhook caller treats that result as a completed finalization, so no retry occurs.♻️ Proposed fix
if (!inserted) return database.query.cards - .findFirst({ - columns: { id: true }, - where: and(eq(cards.credentialId, credentialId), inArray(cards.status, ["ACTIVE", "FROZEN"])), - }) + .findFirst({ columns: { id: true }, where: eq(cards.id, card.id) }) .then((existing) => (existing ? { userId, cardId: existing.id } : undefined));
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: fce76f4d-f286-4e29-81de-71e04b828284
📒 Files selected for processing (7)
infra/utils/modules.tsserver/hooks/bin/panda.tsserver/index.tsserver/test/hooks/bin.test.tsserver/test/hooks/persona.test.tsserver/test/utils/panda.test.tsserver/utils/panda.ts
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.
07e66f6 to
e9e4d14
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e9e4d14936
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ea79a2e2e4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c55eb3522d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1bfab111b2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a352a63ebf
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d5fa653c1f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0921500ef1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 73de6f6cf8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cd1ff9d16a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 84c3c1e5a4
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 91b310ff5c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
2 participants
summary
process panda business onboarding approvals.
stacked on #1203.
changes
test plan
notes
panda-b2bas its baseSummary by CodeRabbit
New Features
Bug Fixes