✨ app: scan pix qr codes - #1283
Conversation
🦋 Changeset detectedLatest commit: 9138bd0 The changes in this PR will be included in the next version bump. This PR includes changesets to release 2 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Team Run ID: 📒 Files selected for processing (15)
WalkthroughThe server now supports separate ChangesDirectional PIX endorsement handling
PIX QR and BR Code recipient flow
Estimated code review effort: 4 (Complex) | ~45 minutes Merge Risk: 🟡 Moderate · up to This PR changes workspace dependency resolution and suppresses a high-severity denial-of-service advisory affecting the mobile dependency graph. The pinned versions reduce the immediate concern, but an independent audit suppression could hide a vulnerable version if the override is later reverted or drifts, so merge requires explicit owner acceptance or tighter coupling between the exception and remediation. Sequence Diagram(s)sequenceDiagram
participant Recipient
participant Recipients
participant Scanner
participant NewRecipient
participant PIXParser
participant SendAmount
Recipient->>Recipients: Select BRL QR scanning
Recipients->>Scanner: Open scanner
Scanner->>NewRecipient: Return scanned payload
NewRecipient->>PIXParser: Parse BR Code
PIXParser-->>NewRecipient: Return recipient data and optional amount
NewRecipient->>SendAmount: Navigate with recipient and amount
🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
📝 Generate docstrings
🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Team
Run ID: d3f82996-86b2-4a3a-8287-91fb7f227e66
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (2)
package.jsonpnpm-workspace.yaml
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.
| - GHSA-mh99-v99m-4gvg | ||
| - GHSA-r28c-9q8g-f849 | ||
| - GHSA-rgw5-rvv9-x895 | ||
| - GHSA-vcc3-ghjq-m6fr # cspell:ignore ghjq |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
rg -n -C 4 'decode-uri-component' pnpm-lock.yaml
pnpm why decode-uri-componentRepository: exactly/exa
Length of output: 7501
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- repository review conventions ---'
find /tmp/coderabbit-repo-knowledge/exactly-exa-f26ca19b -type f -name '*.md' -maxdepth 3 -print
printf '%s\n' '--- workspace configuration ---'
cat -n pnpm-workspace.yaml | sed -n '1,35p'
printf '%s\n' '--- declared package-manager and CI references ---'
rg -n -C 2 '"packageManager"|"pnpm|corepack' package.json .github 2>/dev/null | head -120Repository: exactly/exa
Length of output: 9836
Denial of Service (CWE-400): Uncontrolled Resource Consumption
Update the dependency or document the exception.
pnpm-lock.yaml resolves vulnerable decode-uri-component@0.2.2 through query-string@7.1.3 in the mobile/Expo dependency tree. Upgrade to 0.5.0 or later, or document why this path cannot process attacker-controlled input before suppressing GHSA-vcc3-ghjq-m6fr.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #1283 +/- ##
==========================================
+ Coverage 72.51% 73.04% +0.53%
==========================================
Files 275 276 +1
Lines 13254 13257 +3
Branches 4610 4613 +3
==========================================
+ Hits 9611 9684 +73
+ Misses 3306 3236 -70
Partials 337 337
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
nfmelendez
changed the title
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9138bd0051
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| const input = code ? ( | ||
| <BRCodeField value={value} name={code.ownerName} /> |
There was a problem hiding this comment.
When a user pastes or scans any syntactically valid BR Code, this branch replaces the editable FieldInput with BRCodeField, which only reveals or hides the value and provides no edit or clear action. If the user scanned the wrong code or needs to correct it, they cannot do so within the form and must abandon the recipient flow and start over; retain an editable control or provide a way to clear/rescan the code.
Useful? React with 👍 / 👎.
| if (field.kind === "option" || field.path === "account_pixKey") form.resetField("reference"); | ||
| if (field.path === "account_pixKey") setAmount(undefined); |
There was a problem hiding this comment.
When the user pastes a static BR Code containing a fixed amount, this text-change path clears amount and never replaces it with the parsed code's value; setAmount(code.value...) is only called by the camera callback. The pasted code is still accepted and saved, but the amount screen opens blank and allows a value different from the charge encoded in the QR, so parse next here and preserve its fixed amount just as the scanner path does.
Useful? React with 👍 / 👎.
| </Text> | ||
| ); | ||
| } | ||
| if (code.type !== "dynamic" || !code.oneTime) return null; |
There was a problem hiding this comment.
Static BR Codes can also carry the one-time point-of-initiation method, but parseBRCode only exposes oneTime for dynamic codes and this condition therefore suppresses the warning for every static code. A scanned single-use static charge is converted into a saved PIX-key contact and appears reusable even though its transaction ID may stop working after the first payment; propagate the initiation method for static codes and show the same warning.
Useful? React with 👍 / 👎.
3 participants
Summary by CodeRabbit