Skip to content

Conversation

@anatolyshipitz
Copy link
Collaborator

  • Introduced multiple markdown files detailing the system's overview, financial metrics, data sources, report examples, FAQ, glossary, technical architecture, and interpretation guide.
  • Each section provides insights into the system's functionality, data processing, and report interpretation, aimed at project managers, financial analysts, and IT administrators.
  • This documentation enhances user understanding and facilitates better decision-making based on financial reports.

These additions significantly improve the clarity and usability of the Weekly Financial Summary system documentation.

- Updated `FinAppRepository` to include `contractType` in data retrieval for employees and projects.
- Introduced `getContractTypeByDate` utility function to fetch contract types based on date.
- Modified `WeeklyFinancialReportRepository` and formatter to incorporate contract type in report generation.
- Updated tests to reflect changes in data structure and report formatting.

These enhancements improve the accuracy and detail of financial reports, providing clearer insights into contract types alongside revenue metrics.
- Replace string date comparison with timestamp comparison
- Add validation to handle invalid dates gracefully
- Filter out invalid dates from contract type history
- Ensure reliable contract type determination using numeric timestamps
- Introduced comprehensive tests for the getContractTypeByDate utility function.
- Covered various scenarios including handling of undefined and empty inputs, invalid dates, and correct contract type retrieval based on date.
- Ensured robustness by testing edge cases and filtering out invalid entries in contractTypeHistory.

These tests enhance the reliability of the contract type determination logic and improve overall code quality.
…al packages

- Upgraded base image from n8nio/n8n:1.89.2 to n8nio/n8n:1.109.2.
- Added installation of showdown and slackify-markdown packages with specified versions.
- Combined package installations into a single layer for efficiency.
- Configured external modules allowlist for Code/Function nodes.

These changes enhance the n8n environment by ensuring compatibility with newer package versions and improving the installation process.
…ions

- Introduced a new `launchWeeklyReport.ts` file to initiate the weekly financial reports workflow using Temporal.
- Updated `types.ts` to include `effectiveMarginalityIndicator` in the `TargetUnit` interface.
- Added effective marginality thresholds in `weeklyFinancialReport.ts` for better categorization.
- Enhanced `MarginalityCalculator` with a new `EffectiveMarginalityCalculator` class to compute effective marginality levels and indicators.
- Modified `WeeklyFinancialReportFormatter` to incorporate effective marginality indicators in report formatting.
- Updated `WeeklyFinancialReportRepository` to aggregate effective marginality data and indicators.

These changes improve the financial reporting process by integrating effective marginality calculations and enhancing the overall report structure.
- Updated date comparison logic in `queries.ts` to use `DATE_FORMAT` for improved accuracy in date range filtering.
- Cleaned up comments in `WeeklyFinancialReportRepository.ts` for better code clarity.

These changes enhance the reliability of date handling in financial reports and improve code readability.
…to use effectiveMarginalityIndicator

- Updated the `MarginalityResult` and `EffectiveMarginalityResult` interfaces to replace the `indicator` property with `effectiveMarginalityIndicator` for clarity.
- Modified the `MarginalityCalculator` and `EffectiveMarginalityCalculator` classes to return the updated property in their results.

These changes enhance the consistency and clarity of marginality calculations in the financial reporting process.
…rt calculations

- Updated date range filtering logic in `queries.ts` for improved accuracy.
- Enhanced `WeeklyFinancialReportRepository` to track the latest date per project and resolve contract types more efficiently.
- Consolidated contract type determination to handle multiple projects within a group.

These changes improve the reliability of date handling and contract type resolution in financial reporting.
…nd eliminate unused services. This change simplifies the project setup by removing unnecessary tunnel services and associated configurations.
- Moved the creation of the Client and workflow start logic into the try block for better error handling.
- Updated the workflowId generation to use template literals for improved readability.
- Ensured the connection is closed in the finally block to prevent resource leaks.

These changes enhance the robustness and clarity of the weekly financial report workflow execution.
…ial report processing

- Introduced a new `WeeklyFinancialReportCalculations` class to encapsulate financial calculations related to weekly reports.
- Refactored `WeeklyFinancialReportRepository` to utilize the new class for calculating group totals, resolving contract types, and determining effective marginality.
- Enhanced error handling and code clarity by consolidating calculation logic into dedicated methods.

These changes streamline the financial report calculations and improve maintainability of the codebase.
…ialReportRepository.ts to streamline code and improve clarity.
- Introduced beforeEach and afterEach hooks to mock process.exit, preventing actual termination during tests.
- Improved test reliability and clarity by ensuring process.exit is properly restored after each test.

These changes enhance the robustness of the testing suite for error handling in the application.
… remove outdated references in tests

- Adjusted the notes section in `WeeklyFinancialReportFormatter` to enhance clarity by removing the mention of unimplemented features.
- Updated tests in `WeeklyFinancialReportRepository.test.ts` to reflect the changes in the notes, ensuring accuracy in expected output.

These modifications streamline the report formatting and maintain the integrity of the testing suite.
- Introduced multiple markdown files detailing the system's overview, financial metrics, data sources, report examples, FAQ, glossary, technical architecture, and interpretation guide.
- Each section provides insights into the system's functionality, data processing, and report interpretation, aimed at project managers, financial analysts, and IT administrators.
- This documentation enhances user understanding and facilitates better decision-making based on financial reports.

These additions significantly improve the clarity and usability of the Weekly Financial Summary system documentation.
@coderabbitai
Copy link

coderabbitai bot commented Sep 5, 2025

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

✨ Finishing touches
🧪 Generate unit tests
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch feature/64652-add-docs

Tip

👮 Agentic pre-merge checks are now available in preview!

Pro plan users can now enable pre-merge checks in their settings to enforce checklists before merging PRs.

  • Built-in checks – Quickly apply ready-made checks to enforce title conventions, require pull request descriptions that follow templates, validate linked issues for compliance, and more.
  • Custom agentic checks – Define your own rules using CodeRabbit’s advanced agentic capabilities to enforce organization-specific policies and workflows. For example, you can instruct CodeRabbit’s agent to verify that API documentation is updated whenever API schema files are modified in a PR. Note: Upto 5 custom checks are currently allowed during the preview period. Pricing for this feature will be announced in a few weeks.

Please see the documentation for more information.

Example:

reviews:
  pre_merge_checks:
    custom_checks:
      - name: "Undocumented Breaking Changes"
        mode: "warning"
        instructions: |
          Pass/fail criteria: All breaking changes to public APIs, CLI flags, environment variables, configuration keys, database schemas, or HTTP/GraphQL endpoints must be documented in the "Breaking Change" section of the PR description and in CHANGELOG.md. Exclude purely internal or private changes (e.g., code not exported from package entry points or explicitly marked as internal).

Please share your feedback with us on this Discord post.


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@github-actions
Copy link

github-actions bot commented Sep 5, 2025

🔍 Vulnerabilities of temporal-test:latest

📦 Image Reference temporal-test:latest
digestsha256:3470d9c5e5ecb4c96f9217af7695245a8697bb0ec8dc151bfdcef85a4f5eab5c
vulnerabilitiescritical: 2 high: 8 medium: 0 low: 0
platformlinux/amd64
size218 MB
packages358
📦 Base Image alpine:3
also known as
  • 3.21
  • 3.21.3
  • latest
digestsha256:1c4eef651f65e2f7daee7ee785882ac164b02b78fb74503052a26dc061c90474
vulnerabilitiescritical: 0 high: 0 medium: 0 low: 2
critical: 1 high: 0 medium: 0 low: 0 stdlib 1.23.2 (golang)

pkg:golang/stdlib@1.23.2

critical : CVE--2025--22871

Affected range<1.23.8
Fixed version1.23.8
EPSS Score0.017%
EPSS Percentile3rd percentile
Description

The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.

critical: 1 high: 0 medium: 0 low: 0 stdlib 1.23.6 (golang)

pkg:golang/stdlib@1.23.6

critical : CVE--2025--22871

Affected range<1.23.8
Fixed version1.23.8
EPSS Score0.017%
EPSS Percentile3rd percentile
Description

The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.

critical: 0 high: 1 medium: 0 low: 0 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc 0.36.4 (golang)

pkg:golang/go.opentelemetry.io/contrib/instrumentation@0.36.4#google.golang.org/grpc/otelgrpc

high 7.5: CVE--2023--47108 Allocation of Resources Without Limits or Throttling

Affected range<0.46.0
Fixed version0.46.0
CVSS Score7.5
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score2.678%
EPSS Percentile85th percentile
Description

Summary

The grpc Unary Server Interceptor opentelemetry-go-contrib/instrumentation/google.golang.org/grpc/otelgrpc/interceptor.go

// UnaryServerInterceptor returns a grpc.UnaryServerInterceptor suitable
// for use in a grpc.NewServer call.
func UnaryServerInterceptor(opts ...Option) grpc.UnaryServerInterceptor {

out of the box adds labels

  • net.peer.sock.addr
  • net.peer.sock.port

that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent.

Details

An attacker can easily flood the peer address and port for requests.

PoC

Apply the attached patch to the example and run the client multiple times. Observe how each request will create a unique histogram and how the memory consumption increases during it.

Impact

In order to be affected, the program has to configure a metrics pipeline, use UnaryServerInterceptor, and does not filter any client IP address and ports via middleware or proxies, etc.

Others

It is similar to already reported vulnerabilities.

Workaround for affected versions

As a workaround to stop being affected, a view removing the attributes can be used.

The other possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider.

Solution provided by upgrading

In PR #4322, to be released with v0.46.0, the attributes were removed.

References

critical: 0 high: 1 medium: 0 low: 0 golang.org/x/crypto 0.32.0 (golang)

pkg:golang/golang.org/x/crypto@0.32.0

high : CVE--2025--22869

Affected range<0.35.0
Fixed version0.35.0
EPSS Score0.216%
EPSS Percentile44th percentile
Description

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

critical: 0 high: 1 medium: 0 low: 0 golang.org/x/oauth2 0.7.0 (golang)

pkg:golang/golang.org/x/oauth2@0.7.0

high 7.5: CVE--2025--22868 Improper Validation of Syntactic Correctness of Input

Affected range<0.27.0
Fixed version0.27.0
CVSS Score7.5
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score0.081%
EPSS Percentile25th percentile
Description

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

critical: 0 high: 1 medium: 0 low: 0 golang.org/x/oauth2 0.26.0 (golang)

pkg:golang/golang.org/x/oauth2@0.26.0

high 7.5: CVE--2025--22868 Improper Validation of Syntactic Correctness of Input

Affected range<0.27.0
Fixed version0.27.0
CVSS Score7.5
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score0.081%
EPSS Percentile25th percentile
Description

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

critical: 0 high: 1 medium: 0 low: 0 github.com/golang-jwt/jwt 3.2.2+incompatible (golang)

pkg:golang/github.com/golang-jwt/jwt@3.2.2%2Bincompatible

high 8.7: CVE--2025--30204 Asymmetric Resource Consumption (Amplification)

Affected range>=3.2.0
<=3.2.2
Fixed versionNot Fixed
CVSS Score8.7
CVSS VectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS Score0.043%
EPSS Percentile12th percentile
Description

Summary

Function parse.ParseUnverified currently splits (via a call to strings.Split) its argument (which is untrusted data) on periods.

As a result, in the face of a malicious request whose Authorization header consists of Bearer followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. Relevant weakness: CWE-405: Asymmetric Resource Consumption (Amplification)

Details

See parse.ParseUnverified

Impact

Excessive memory allocation

critical: 0 high: 1 medium: 0 low: 0 curl 8.12.1-r0 (apk)

pkg:apk/alpine/curl@8.12.1-r0?os_name=alpine&os_version=3.21

high : CVE--2025--5399

Affected range<=8.12.1-r0
Fixed versionNot Fixed
EPSS Score0.050%
EPSS Percentile15th percentile
Description
critical: 0 high: 1 medium: 0 low: 0 c-ares 1.34.3-r0 (apk)

pkg:apk/alpine/c-ares@1.34.3-r0?os_name=alpine&os_version=3.21

high : CVE--2025--31498

Affected range<1.34.5-r0
Fixed version1.34.5-r0
EPSS Score0.123%
EPSS Percentile32nd percentile
Description
critical: 0 high: 1 medium: 0 low: 0 github.com/golang-jwt/jwt/v4 4.5.1 (golang)

pkg:golang/github.com/golang-jwt/jwt@4.5.1#v4

high 8.7: CVE--2025--30204 Asymmetric Resource Consumption (Amplification)

Affected range<4.5.2
Fixed version4.5.2
CVSS Score8.7
CVSS VectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS Score0.043%
EPSS Percentile12th percentile
Description

Summary

Function parse.ParseUnverified currently splits (via a call to strings.Split) its argument (which is untrusted data) on periods.

As a result, in the face of a malicious request whose Authorization header consists of Bearer followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. Relevant weakness: CWE-405: Asymmetric Resource Consumption (Amplification)

Details

See parse.ParseUnverified

Impact

Excessive memory allocation

anatolyshipitz and others added 8 commits September 21, 2025 19:51
- Introduced a new `project_hours` field in the `TargetUnit` and `TargetUnitRow` interfaces to enhance data tracking.
- Updated the `TargetUnitRepository` to handle the new `project_hours` field during data mapping.
- Modified financial calculations in `WeeklyFinancialReportCalculations` to utilize `project_hours` for revenue calculations.
- Adjusted the `WeeklyFinancialReportFormatter` to remove outdated references to total hours and improve report clarity.

These changes improve the accuracy of financial reporting and enhance the data model for better project tracking.
…t tests

- Updated test data in `TargetUnitRepository.test.ts` and `WeeklyFinancialReportRepository.test.ts` to include the new `project_hours` field for improved accuracy in testing.
- Adjusted employee and project data in `WeeklyFinancialReportSorting.test.ts` to reflect changes in project hours and effective revenue calculations.

These modifications enhance the test coverage and ensure alignment with recent data model updates.
…on/automatization into feature/add-contract-type
- Removed the `project_hours` field from test data to simplify the structure.
- Updated employee rates to a uniform value for consistency in testing.
- Adjusted project revenue rates and added comments to clarify marginality levels.
- Enhanced sorting tests to verify group order based on marginality and alphabetical criteria.

These changes improve the clarity and reliability of the test suite for weekly financial report sorting.
- Simplified group presence verification by consolidating checks into a single assertion function.
- Enhanced order verification logic to ensure correct sequence of groups based on marginality.
- Removed redundant checks and improved test clarity, making it easier to understand the expected output order.

These changes improve the maintainability and reliability of the sorting tests for weekly financial reports.
…s handling

- Made the `project_hours` field optional in the `TargetUnit` and `TargetUnitRow` interfaces to allow for more flexible data handling.
- Refactored the `mapRowToTargetUnit` method in `TargetUnitRepository` to include defensive parsing for numeric values, ensuring that `project_hours` and `total_hours` are correctly processed even if they are null or strings.
- Updated the mapping logic to improve robustness against potential data inconsistencies from the database.

These changes enhance the data model's flexibility and improve the reliability of data processing in the repository.
Base automatically changed from feature/add-contract-type to main October 22, 2025 13:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants