Tool: Retire.js (Static Analysis - Security)#127
Closed
maxwelljhuang wants to merge 68 commits into
Closed
Conversation
Feature/answer status system
Feature/answer status system
Updated require statements in test/topic-resolution.js to use '../src/' instead of '../' to correctly resolve module imports for database, topics, posts, privileges, user, and categories modules.
Feature/topic resolution impl
- Add PUT /api/v3/topics/:tid/resolve endpoint (admin/mod only) to mark topics as resolved, with idempotent behavior to preserve timestamps - Add DELETE /api/v3/topics/:tid/resolve endpoint (admin/mod only) to mark topics as unresolved, clearing resolution metadata - Add ?resolved=true/false query parameter to category topic listings for filtering by resolution status - Resolution metadata (isResolved, resolvedAt, resolvedBy) is returned in GET /api/v3/topics/:tid responses via existing topic data fields - Add comprehensive tests covering endpoint auth, resolve/unresolve behavior, metadata in GET responses, and category filtering Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add PUT/DELETE /api/v3/topics/:tid/resolve endpoints for marking topics as resolved/unresolved (admin/mod only, with idempotent resolve) - Add ?resolved=true/false query parameter to category topic listings - Add isResolved, resolvedAt, resolvedBy to OpenAPI TopicObject schema to fix test/api.js schema validation - Add tests for endpoint auth, resolve/unresolve, metadata in GET responses, and category filtering
- Add PUT/DELETE /api/v3/topics/:tid/resolve endpoints for marking topics as resolved/unresolved (admin/mod only, with idempotent resolve) - Add ?resolved=true/false query parameter to category topic listings - Add isResolved, resolvedAt, resolvedBy to OpenAPI TopicObject schema to fix test/api.js schema validation - Fix test setup: use groups.join for admin, 'moderate' privilege for mod - Add tests for endpoint auth, resolve/unresolve, metadata in GET responses, and category filtering
resolvedAt is listed in intFields (src/topics/data.js), so db.parseIntFields converts null values to 0. Updated 4 assertions in test/topic-resolution.js to match this behavior.
- Add missing resolve.yaml write endpoint spec to prevent test/api.js "not defined in schema docs" failure - Register resolve path in write.yaml - Fix resolvedBy test to use value assertion instead of hasOwnProperty (string fields absent from hash until set) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Redis db.setObject silently drops null values, so setting resolvedAt: null and resolvedBy: null had no effect. Use db.deleteObjectFields to properly remove the fields instead.
Add REST API endpoints for topic resolution and category filtering
Feature/filter questions
receives a popup notification and refactored the reply notification code in create
- Create assignment_tags table with id, name, color, category - Create post_tags junction table for post-tag relationships - Add indexes for performance and foreign key constraints with cascade delete
- Implement tag CRUD operations with PostgreSQL - Add post-tag relationship management - Restrict modifications to instructors/admins
- Posts accept optional tags array on creation - Post responses include assignmentTags field - Category topics filterable by ?assignmentTags query param
- Admin page for creating/editing/deleting tags with color picker - Reusable tag selector module for post composer - Tag display module with colored badges
- Add tag chips display on posts with colored badges and hover effects - Make tag chips clickable to filter topic lists by selected tags - Add multi-select dropdown filter in category/topic list views - Auto-load assignment tags module on relevant pages (category, topic, recent, etc.) - Include responsive styles for mobile devices - Support clearing filters to show all posts
Testing: - Create comprehensive test suite (600+ lines) covering: * Tag CRUD operations with authorization guards * Tag assignment and removal on posts * Single and multiple tag filtering with pagination * Full integration workflow tests * Edge cases: cascade deletes, invalid IDs, concurrent operations - Test file: test/assignment-tags.js - All tests verify instructor/admin permissions correctly Documentation: - API documentation with request/response schemas (docs/assignment-tags-api.md) * 15+ endpoints fully documented * TypeScript-style data models * Error codes and examples * Rate limiting information - Database schema documentation (docs/assignment-tags-database-schema.md) * ER diagrams using Mermaid * Table schemas with indexes * Common query patterns * Performance optimization tips * Backup/restore procedures - User guide for instructors (docs/assignment-tags-user-guide.md) * Step-by-step instructions * Best practices and examples * Troubleshooting guide * Quick reference card - Developer onboarding guide (docs/assignment-tags-developer-guide.md) * Architecture overview with diagrams * Complete file structure walkthrough * Development setup and debugging * Extension patterns and examples * Contributing guidelines CHANGELOG: - Add v1.20.0 entry documenting all features, tests, and documentation
… support Replace raw PostgreSQL queries with NodeBB's database abstraction layer (db.setObject, db.sortedSetAdd, etc.) so assignment tags work on any supported database (MongoDB, Redis, PostgreSQL). Also add assignment-tags route to admin privilege map to fix Access Denied on
Add filter:composer.submit hook to send selected assignment tags with post creation. Add Edit Assignment Tags modal in post tools menu. Fix module loading by requiring forum/assignment-tags from app.load() instead of dead loader IIFE. Fix route ordering, hook name (composer.enhanced not composer.enhance), and field name (data.assignmentTags not data.tags) in posts/create.js
- Remove unused variable in admin assignment-tags - Replace undefined with jQuery API - Remove unused import in modules/assignment-tags - Fix function-paren-newline style violation in categories/topics - Remove unused function in posts/data - Replace await-in-loop with single Promise.all in topic resolution upgrade
- Remove unused currentEditingId variable in admin assignment-tags - Replace undefined bootstrap.Modal with jQuery .modal() API - Remove unused alerts import in modules/assignment-tags - Fix function-paren-newline style violation in categories/topics - Remove unused addAssignmentTagsToPost function in posts/data - Replace await-in-loop with single Promise.all in topic resolution upgrade - Add assignmentTags field to PostDataObject OpenAPI schema
- Remove unused currentEditingId variable in admin assignment-tags - Replace undefined bootstrap.Modal with jQuery .modal() API - Remove unused alerts import in modules/assignment-tags - Fix function-paren-newline style violation in categories/topics - Remove unused addAssignmentTagsToPost function in posts/data - Replace await-in-loop with single Promise.all in topic resolution upgrade - Add assignmentTags to PostDataObject, TopicObject, and replies schemas
… docs for assignment-tags routes - Remove unused currentEditingId variable in admin assignment-tags - Replace undefined bootstrap.Modal with jQuery .modal() API - Remove unused alerts import in modules/assignment-tags - Fix function-paren-newline style violation in categories/topics - Remove unused addAssignmentTagsToPost function in posts/data - Replace await-in-loop with single Promise.all in topic resolution upgrade - Add assignmentTags field to PostDataObject, TopicObject, replies, and category schemas - Add OpenAPI schema definitions for all assignment-tags write API routes
Assignment tag system for organizing course posts
Implemented popup notifications when someone responds to your message
Code Review(completed by Alexandra)-Popup Notifications Feature
I think this was a very well implemented feature and adds a lot of value to the platform.
Done well:
Correct trigger point: notification logic runs after post save and only for replies
Self-reply prevention: explicit isSelfReply check before emitting.
Clickable popup: includes topicId + postId so the client can navigate to the exact reply.
Suggestions:
Avoid using the global alert()
In public/src/sockets.js, alerts.alert(params) is called and then call alert({ ... }) again. I’d recommend using NodeBB’s alerts module for consistency or one or the other.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
Retire.js scans JS projects for dependencies with known vulnerabilities and checks node_modules against a maintained db of CVEs (common vulnerabilities and exposures).
Installation
npm install retire
Running the tool on the repo
The tool successfully scanned the project and reported no known vulnerabilities in our dependencies
Pros
Cons