Feature: Public share links - #247
Conversation
- add reusable public-share links backed by opaque hashed credentials - extract structured test cases from generated QA documentation - repair generated documents that omit marked test scenarios - preserve full QA documents while sharing test-case preview links in Jira - render public preview URLs as Jira links and keep failed handoffs retryable - reconcile interrupted RAG jobs, project states, and revision locks - isolate recovery scheduling from optional alias reconciliation
- preserve all Jira QA sections while replacing only test scenarios with a share link - expose sanitized QA content after public-token validation - redirect authorized users to the project QA document - split environment notes into a separate response section - prevent N/A QA guide titles
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![codecrow-local[bot]](https://avatars.githubusercontent.com/u/85498741?s=60&v=4){kind=small}
- make stale lock and RAG recovery concurrency-safe - reuse persisted QA documents when preview or Jira handoff fails - validate marked test cases and trim Jira URL delimiters correctly - align public QA share contracts and include the frontend preview route
- prevent stale RAG jobs from overwriting newer indexing status - persist exact lock ownership for safe recovery and parallel branch indexing - regenerate QA documentation when a pending handoff belongs to another task - add migration and regression coverage
|
| Status | PASS WITH WARNINGS |
| Risk Level | MEDIUM |
| Review Coverage | 24 files analyzed in depth |
| Confidence | HIGH |
Executive Summary
This PR adds public share-link functionality, including public QA document previews, RAG operation tracking and recovery, locking, persistence changes, and related database migration updates. The implementation was reviewed across all 24 planned files, with particular attention to authorization boundaries, asynchronous operation ownership, transaction locking, recovery behavior, and migration compatibility. Overall risk is medium, with a security concern requiring attention in the public preview response surface.
Recommendation
Decision: PASS WITH WARNINGS
The PR may proceed, but the separately reported security finding should be addressed or explicitly accepted before release. No critical or high-severity blockers were identified, and the broader cross-file implementation review found no additional blocking inconsistencies.
Issues Overview
| Severity | Count | |
|---|---|---|
| 🟡 Medium | 1 | Issues that should be addressed |
| ✅ Resolved | 1 | Resolved issues |
Analysis completed on 2026-08-12 02:02:19 | View Full Report | Pull Request
📍 Findings not posted inline (1)
GitHub only accepts inline review comments on lines available in the current pull-request diff. These findings remain part of the complete review.
- 🟡 MEDIUM — Public preview exposes non-test-case content at
.../qadoc/QaDocTestCasesShareProvider.java:69- The reported line is outside the current pull-request diff.
📋 Detailed Issues (1)
🟡 Medium Severity Issues
Id on Platform: 4038
Category: 🔒 Security
File: .../qadoc/QaDocTestCasesShareProvider.java:69
Public preview exposes non-test-case content
getPublicPreview is the public-share path and toPublicPreview returns content.overviewMarkdown() and content.environmentMarkdown() in addition to the marked test cases. Consequently, an opaque public token issued for the qa-doc-test-cases resource can disclose the document overview and environment/setup notes, even though the caller is only requesting a test-case preview. Environment notes commonly contain internal URLs, credentials guidance, or deployment details and should not be included in an unauthenticated response unless explicitly intended and redacted.
💡 Suggested Fix
Build the public preview from the marked test-case section only, or explicitly redact and separately authorize any overview/environment fields before adding them to the public response.
Files Affected
- .../qadoc/QaDocTestCasesShareProvider.java: 1 issue
1 participant
No description provided.