PM-3329 member data #41

vas3a · 2026-01-26T10:47:03Z

Add new endpoint that returns "Activity" for a skill: where, & when it was earned.

Related PRs:

challenge api: Generate prisma client challenge-api-v6#65
academy: Generate academy prisma client learning-paths-api#259
platform UI (profile): PM-3329 show skills activity details platform-ui#1419

… returns the skill data + activity for the skill

…into PM-3329_member-data

github-actions · 2026-01-26T10:47:22Z

docs/swagger.yaml

+      description: |-
+        Get a specific member skill by skill ID.
+
+        Authorization:


[💡 readability]
The description for the endpoint mentions 'secure and communication fields' but does not specify what these fields are. Consider clarifying which fields are considered secure and communication fields to avoid ambiguity.

github-actions · 2026-01-26T10:47:22Z

docs/swagger.yaml

+          - Public: Without a token responses omit secure and communication fields.
+          - JWT roles: The profile owner or `administrator`/`admin` roles may view secure fields.
+          - M2M scopes: `read:user_profiles` or `all:user_profiles`.
+      security:


[⚠️ security]
The security definition uses 'bearer' which is typically associated with JWT tokens. Ensure that this aligns with the intended authentication mechanism and that the necessary scopes are properly documented and enforced.

github-actions · 2026-01-26T10:47:22Z

docs/swagger.yaml

+        '200':
+          description: OK
+          schema:
+            $ref: '#/definitions/MemberSkillsWithActivity'


[❗❗ correctness]
The response schema references 'MemberSkillsWithActivity'. Ensure that this definition is correctly implemented and includes all necessary fields to avoid runtime errors.

github-actions · 2026-01-26T10:47:22Z

docs/swagger.yaml

              example: 'Skill verified by proof of capability'

+  MemberSkillsWithActivity:
+    allOf:


[❗❗ correctness]
The 'MemberSkillsWithActivity' definition extends 'MemberSkills'. Verify that all required fields in 'MemberSkills' are included and correctly mapped in 'MemberSkillsWithActivity' to prevent data inconsistencies.

github-actions · 2026-01-26T10:47:22Z

docs/swagger.yaml

+      - type: object
+        properties:
+          activity:
+            type: object


[⚠️ design]
The 'activity' object includes nested objects for 'challenge', 'certification', and 'course'. Consider adding validation rules to ensure that these objects are populated with valid data to maintain data integrity.

github-actions · 2026-01-26T10:47:25Z

src/common/prisma.js

+const getChallengesClient = () => {
+  if (!challengesClient) {
+    if (!challengesDbUrl) {
+      throw new Error('CHALLENGES_DB_URL must be set for skills Prisma client')


[⚠️ correctness]
The error message here states 'CHALLENGES_DB_URL must be set for skills Prisma client', which seems incorrect. It should refer to the challenges Prisma client instead.

github-actions · 2026-01-26T10:47:25Z

src/common/prisma.js

+const getAcademyClient = () => {
+  if (!academyClient) {
+    if (!academyDbUrl) {
+      throw new Error('ACADEMY_DB_URL must be set for skills Prisma client')


[⚠️ correctness]
The error message here states 'ACADEMY_DB_URL must be set for skills Prisma client', which seems incorrect. It should refer to the academy Prisma client instead.

@vas3a please update typo. Should be academy client.

github-actions · 2026-01-26T10:47:29Z

src/common/prismaHelper.js

+    if (first.skill && first.skill.skillEvents) {
+      const events = _.orderBy(first.skill.skillEvents || [], 'createdAt', 'desc')
+      const grouped = _.groupBy(events, 'sourceType.name')
+      ret.lastUsedDate = events[0].createdAt


[❗❗ correctness]
Accessing events[0] without checking if events is non-empty could lead to a runtime error. Consider adding a check to ensure events has at least one element before accessing it.

github-actions · 2026-01-26T10:47:31Z

src/controllers/MemberController.js

+ * @param {Object} res the response
+ */
+async function getMemberSkill (req, res) {
+  const result = await service.getMemberSkill(req.authUser, req.params.handle, req.params.skillid)


[❗❗ correctness]
Consider adding error handling for the getMemberSkill function. If service.getMemberSkill throws an error, it will not be caught, potentially leading to unhandled promise rejections and server crashes.

github-actions · 2026-01-26T10:47:34Z

src/routes.js

+      controller: 'MemberController',
+      method: 'getMemberSkill',
+      auth: 'jwt',
+      allowNoToken: true,


[❗❗ security]
The allowNoToken: true setting allows access without authentication. Ensure this is intentional and aligns with security requirements, as it could expose sensitive data.

@vas3a please remove public access. Any user role could fetch but annonymous should be excluded.

src/services/MemberService.js

github-actions · 2026-01-26T10:47:39Z

src/services/MemberService.js

+      if (certificationIds.length > 0) {
+        fetchPromises.push(
+          academyPrisma.CertificationEnrollments.findMany({
+            where: { completionEventId: { in: certificationIds.slice(0, 3) } },


[💡 maintainability]
Consider limiting the number of certification IDs fetched to a configurable constant instead of hardcoding 3. This will make the code more flexible and easier to maintain.

src/services/MemberService.js

kkartunov

Few minors.

kkartunov · 2026-01-26T15:35:56Z

src/routes.js

+      controller: 'MemberController',
+      method: 'getMemberSkill',
+      auth: 'jwt',
+      allowNoToken: true,


@vas3a please remove public access. Any user role could fetch but annonymous should be excluded.

kkartunov · 2026-01-26T15:38:03Z

src/common/prisma.js

+const getAcademyClient = () => {
+  if (!academyClient) {
+    if (!academyDbUrl) {
+      throw new Error('ACADEMY_DB_URL must be set for skills Prisma client')


@vas3a please update typo. Should be academy client.

kkartunov · 2026-01-26T15:38:20Z

src/common/prisma.js

+const getChallengesClient = () => {
+  if (!challengesClient) {
+    if (!challengesDbUrl) {
+      throw new Error('CHALLENGES_DB_URL must be set for skills Prisma client')


…into PM-3329_member-data

kkartunov

Just a minor tweak.

kkartunov · 2026-01-27T10:30:20Z

src/services/MemberService.js

+  const dbSkill = await skillsPrisma.userSkill.findFirst({
+    where: {
+      userId: helper.bigIntToNumber(member.userId),
+      skillId: skillId


Let's ensure skillsId is UUID before passing this to prisma query for security concerns and SQL injections.

github-actions · 2026-01-27T11:26:32Z

src/services/MemberService.js

+getMemberSkill.schema = {
+  currentUser: Joi.any(),
+  handle: Joi.string().required(),
+  skillId: Joi.string().uuid().required()


[⚠️ correctness]
Changing skillId to be validated as a UUID is a good improvement for ensuring data integrity. However, ensure that all parts of the system that interact with this endpoint are updated to provide skillId in UUID format to prevent any unexpected errors.

…into PM-3329_member-data

github-actions · 2026-01-27T19:01:36Z

src/common/prisma.js

 const skillsDbUrl = process.env.SKILLS_DB_URL
+const challengesDbUrl = process.env.CHALLENGES_DB_URL
+const academyDbUrl = process.env.ACADEMY_DB_URL
 const resourcesDbUrl = config.RESOURCES_DB_URL


[⚠️ maintainability]
Consider using process.env.RESOURCES_DB_URL instead of config.RESOURCES_DB_URL for consistency with other database URL configurations. This will also ensure that the URL can be easily configured via environment variables, which is a common practice for managing sensitive information like database connection strings.

vas3a added 3 commits January 26, 2026 11:18

PM-3329 - expose new endpoint: members/{handle}/skill/{skillId} which…

7353ac9

… returns the skill data + activity for the skill

PM-3329 - Update documentation and route

9ae9d67

Merge branch 'develop' of github.com:topcoder-platform/member-api-v6 …

2ab0f0e

…into PM-3329_member-data

vas3a mentioned this pull request Jan 26, 2026

PM-3329 show skills activity details topcoder-platform/platform-ui#1419

Merged

github-actions bot reviewed Jan 26, 2026

View reviewed changes

kkartunov requested changes Jan 26, 2026

View reviewed changes

vas3a added 3 commits January 27, 2026 09:29

Typo fix & remove public access to skill details endpoint

eb21504

update prisma clients for challenges & skills

deedc4e

Merge branch 'develop' of github.com:topcoder-platform/member-api-v6 …

3c0256d

…into PM-3329_member-data

kkartunov requested changes Jan 27, 2026

View reviewed changes

Make sure skillId is uuid

222c95c

github-actions bot reviewed Jan 27, 2026

View reviewed changes

kkartunov self-requested a review January 27, 2026 14:38

kkartunov approved these changes Jan 27, 2026

View reviewed changes

Merge branch 'develop' of github.com:topcoder-platform/member-api-v6 …

872922f

…into PM-3329_member-data

github-actions bot reviewed Jan 27, 2026

View reviewed changes

vas3a merged commit 12a787f into develop Jan 27, 2026
5 of 6 checks passed

vas3a deleted the PM-3329_member-data branch January 27, 2026 19:13

PM-3329 member data #41

PM-3329 member data #41

Uh oh!

Conversation

vas3a commented Jan 26, 2026

Uh oh!

github-actions bot Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

kkartunov Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

kkartunov Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

kkartunov Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions bot Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

kkartunov left a comment

Choose a reason for hiding this comment

Uh oh!

kkartunov Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

kkartunov Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

kkartunov Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

kkartunov left a comment

Choose a reason for hiding this comment

Uh oh!

kkartunov Jan 27, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jan 27, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jan 27, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects