Remove deprecated Kafka topics

Author: jmgasper

.github/workflows/trivy.yaml

@@ -1,34 +1,44 @@
 name: Trivy Scanner
 
-permissions:
-  contents: read
-  security-events: write
 on:
   push:
     branches:
       - main
+      - master
       - dev
+      - develop
   pull_request:
+  workflow_dispatch:
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
 jobs:
   trivy-scan:
-    name: Use Trivy
+    name: Trivy SAST and SCA
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
       - name: Run Trivy scanner in repo mode
-        uses: aquasecurity/trivy-action@0.35.0
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
+          version: "v0.73.0"
           scan-type: "fs"
+          scan-ref: "."
           ignore-unfixed: true
           format: "sarif"
           output: "trivy-results.sarif"
           severity: "CRITICAL,HIGH,UNKNOWN"
+          limit-severities-for-sarif: true
           scanners: vuln,secret,misconfig,license
           github-pat: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        uses: github/codeql-action/upload-sarif@v4
         with:
           sarif_file: "trivy-results.sarif"

ReadMe.md

@@ -9,8 +9,9 @@
 - PostgreSQL
 - Docker and Docker Compose
 
-The service does not consume Kafka messages. It continues to publish events through
-the Bus API wrapper, so the existing Bus API and Auth0 configuration remains unchanged.
+The service does not consume Kafka messages. It uses the Bus API wrapper only for
+email-change verification events; profile and trait mutations do not publish events.
+The existing Bus API and Auth0 configuration remains required for email verification.
 
 ## Install, Build, and Run
 

app-constants.ts

@@ -11,14 +11,7 @@ const EVENT_ORIGINATOR = 'topcoder-member-api'
 const EVENT_MIME_TYPE = 'application/json'
 
 const TOPICS = {
-  MemberCreated: 'member.action.profile.create',
-  MemberUpdated: 'member.action.profile.update',
-  EmailChanged: 'member.action.email.profile.emailchange.verification',
-  MemberTraitCreated: 'member.action.profile.trait.create',
-  MemberTraitUpdated: 'member.action.profile.trait.update',
-  MemberTraitDeleted: 'member.action.profile.trait.delete',
-  MemberSkillsCreated: 'member.action.profile.skills.create',
-  MemberSkillsUpdated: 'member.action.profile.skills.update'
+  EmailChanged: 'member.action.email.profile.emailchange.verification'
 }
 
 const MAMBO_GET_REWARDS_ALLOWED_FIELDS = [

src/services/MemberService.ts

@@ -905,8 +905,6 @@ async function updateMember (currentUser, handle, query, data) {
 
   // convert prisma data to response format
   prismaHelper.convertMember(result)
-  // send data to event bus
-  await helper.postBusEvent(constants.TOPICS.MemberUpdated, result)
   if (emailChanged) {
     // send email verification to old email
     await helper.postBusEvent(constants.TOPICS.EmailChanged, {
@@ -1078,7 +1076,6 @@ async function updateHandle (currentUser, handle, query, data) {
   }
 
   prismaHelper.convertMember(updatedMember)
-  await helper.postBusEvent(constants.TOPICS.MemberUpdated, updatedMember)
   return cleanMember(currentUser, updatedMember, selectFields)
 }
 
@@ -1142,7 +1139,6 @@ async function verifyEmail (currentUser, handle, query) {
     data: _.omit(member, ['maxRating', 'phones'])
   })
   prismaHelper.convertMember(result)
-  await helper.postBusEvent(constants.TOPICS.MemberUpdated, result)
   return { emailChangeCompleted, verifiedEmail }
 }
 
@@ -1221,8 +1217,6 @@ async function uploadPhoto (currentUser, handle, files) {
     }
   })
   prismaHelper.convertMember(result)
-  // post bus event
-  await helper.postBusEvent(constants.TOPICS.MemberUpdated, result)
   return { photoURL }
 }
 
@@ -1343,7 +1337,6 @@ async function deleteMember (currentUser, handle, data) {
   }
 
   prismaHelper.convertMember(updatedMember)
-  await helper.postBusEvent(constants.TOPICS.MemberUpdated, updatedMember)
 
   return {
     handle: deletedHandle,

src/services/MemberTraitService.ts

@@ -9,7 +9,6 @@ const moment = require('moment')
 const helper = require('../common/helper')
 const logger = require('../common/logger')
 const errors = require('../common/errors')
-const constants = require('../../app-constants')
 const prisma = require('../common/prisma').getClient()
 const prismaManager = require('../common/prisma')
 const skillsPrisma = prismaManager.getSkillsClient()
@@ -479,22 +478,6 @@ async function createTraits (currentUser, handle, data) {
       data: prismaData
     })
   }
-  // send data to event bus
-  for (let item of data) {
-    const trait = { ...item }
-    trait.userId = helper.bigIntToNumber(member.userId)
-    trait.createdBy = Number(currentUser.userId || config.TC_WEBSERVICE_USERID)
-    if (trait.traits) {
-      trait.traits = { 'traitId': trait.traitId, 'data': trait.traits.data }
-    } else {
-      trait.traits = { 'traitId': trait.traitId, 'data': [] }
-    }
-    // convert date time
-    trait.createdAt = new Date().getTime()
-    // post bus event
-    await helper.postBusEvent(constants.TOPICS.MemberTraitCreated, trait)
-  }
-
   // merge result
   existingTraits = _.concat(existingTraits, data)
 
@@ -575,24 +558,6 @@ async function updateTraits (currentUser, handle, data) {
     await prisma.memberTraits.create({ data: createData })
   }
 
-  // post bus events: created for new traits, updated for existing ones
-  const existingIds = new Set((existingTraits || []).map(t => t.traitId))
-  for (let r of result) {
-    if (!existingIds.has(r.traitId)) {
-      const trait = { ...r }
-      trait.userId = helper.bigIntToNumber(member.userId)
-      trait.createdBy = Number(currentUser.userId || config.TC_WEBSERVICE_USERID)
-      if (trait.traits) {
-        trait.traits = { traitId: trait.traitId, data: trait.traits.data }
-      } else {
-        trait.traits = { traitId: trait.traitId, data: [] }
-      }
-      trait.createdAt = new Date().getTime()
-      await helper.postBusEvent(constants.TOPICS.MemberTraitCreated, trait)
-    } else {
-      await helper.postBusEvent(constants.TOPICS.MemberTraitUpdated, r)
-    }
-  }
   return result
 }
 
@@ -632,26 +597,10 @@ async function removeTraits (currentUser, handle, query) {
       })))
     })
   }
-  // remove existingTraits data
-  const memberProfileTraitIds = []
-  _.forEach(existingTraits, t => {
-    if (!traitIds || _.includes(traitIds, t.traitId)) {
-      memberProfileTraitIds.push(t.traitId)
-    }
-  })
-
+  // remove deleted traits from the data used to recalculate skill-score deductions
   existingTraits = _.filter(existingTraits, t => !traitIds.includes(t.traitId))
 
   await updateSkillScoreDeduction(currentUser, member, existingTraits)
-  // post bus event
-  if (memberProfileTraitIds.length > 0) {
-    await helper.postBusEvent(constants.TOPICS.MemberTraitDeleted, {
-      userId: helper.bigIntToNumber(member.userId),
-      memberProfileTraitIds,
-      updatedAt: new Date(),
-      updatedBy: currentUser.userId || currentUser.sub
-    })
-  }
 }
 
 removeTraits.schema = {

src/services/SearchService.ts

@@ -64,33 +64,56 @@ const MEMBER_SELECT_EXCLUDED_FIELDS = ['addresses', 'maxRating', 'skills', 'stat
 const BULK_IDENTIFIER_MAX_LENGTH = 256
 const BULK_EMAIL_REGEX = /^[+_A-Za-z0-9-]+(\.[+_A-Za-z0-9-]+)*@[A-Za-z0-9-]+(\.[A-Za-z0-9]+)*(\.[A-Za-z]{2,}$)/
 const BULK_HANDLE_REGEX = /^[-A-Za-z0-9_.`{}[\]]+$/
+const MAX_USER_ID = BigInt('9223372036854775807')
+const USER_ID_QUERY_ITEM_SCHEMA = Joi.alternatives().try(
+  Joi.string().pattern(/^\d+$/).custom((value, helpers) => (
+    BigInt(value) <= MAX_USER_ID ? value : helpers.error('string.userIdRange')
+  )).messages({
+    'string.userIdRange': '{{#label}} must not exceed the maximum 64-bit user ID'
+  }),
+  Joi.number().integer().min(0).strict()
+)
 
 /**
  * Accept arrays parsed by `qs` as well as the JSON-array query format documented
  * by this API. Joi 14 coerced JSON array strings automatically, while Joi 18
  * no longer coerces them.
+ * @param {Object} [itemSchema] optional Joi schema used to validate and normalize items
  * @returns {Object} Joi schema for a query-string array
  */
-function queryArraySchema () {
+function queryArraySchema (itemSchema = null) {
+  const itemArraySchema = itemSchema && Joi.array().items(itemSchema)
+
   return Joi.any().custom((value, helpers) => {
-    if (_.isArray(value)) {
-      return value
-    }
+    let parsed = value
 
-    if (_.isString(value)) {
+    if (_.isArray(value)) {
+      parsed = value
+    } else if (_.isString(value)) {
       try {
-        const parsed = JSON.parse(value)
-        if (_.isArray(parsed)) {
-          return parsed
-        }
+        parsed = JSON.parse(value)
       } catch (err) {
         // Fall through to the same validation error as a non-array value.
       }
     }
 
-    return helpers.error('array.base')
+    if (!_.isArray(parsed)) {
+      return helpers.error('array.base')
+    }
+
+    if (!itemSchema) {
+      return parsed
+    }
+
+    const validation = itemArraySchema.validate(parsed, { abortEarly: false })
+    if (validation.error) {
+      return helpers.error('queryArray.items', { details: validation.error.message })
+    }
+
+    return validation.value
   }).messages({
-    'array.base': '{{#label}} must be an array'
+    'array.base': '{{#label}} must be an array',
+    'queryArray.items': '{{#label}} contains invalid values: {{#details}}'
   })
 }
 
@@ -442,7 +465,7 @@ searchMembers.schema = {
     handles: queryArraySchema(),
     email: Joi.string(),
     userId: Joi.number(),
-    userIds: queryArraySchema(),
+    userIds: queryArraySchema(USER_ID_QUERY_ITEM_SCHEMA),
     term: Joi.string(),
     fields: Joi.string(),
     includeStats: Joi.string(),

test/unit/SearchService.test.js

@@ -54,6 +54,102 @@ describe('search service unit tests', () => {
     }
   })
 
+  it('searchMembers should accept qs decimal-string userIds without losing precision', async () => {
+    const prisma = prismaManager.getClient()
+    const originalMemberCount = prisma.member.count
+    let memberFilter
+
+    try {
+      prisma.member.count = async (filter) => {
+        memberFilter = filter
+        return 0
+      }
+
+      await service.searchMembers(
+        { isMachine: true },
+        {
+          userIds: ['100000013', '9223372036854775807'],
+          fields: 'handle,userId'
+        }
+      )
+
+      memberFilter.where.AND.should.deep.equal([
+        { userId: { in: ['100000013', '9223372036854775807'] } }
+      ])
+    } finally {
+      prisma.member.count = originalMemberCount
+    }
+  })
+
+  it('searchMembers should preserve an empty userIds array', async () => {
+    const prisma = prismaManager.getClient()
+    const originalMemberCount = prisma.member.count
+    let memberFilter
+
+    try {
+      prisma.member.count = async (filter) => {
+        memberFilter = filter
+        return 0
+      }
+
+      await service.searchMembers(
+        { isMachine: true },
+        {
+          userIds: [],
+          fields: 'handle,userId'
+        }
+      )
+
+      memberFilter.where.AND.should.deep.equal([])
+    } finally {
+      prisma.member.count = originalMemberCount
+    }
+  })
+
+  it('searchMembers should reject invalid userIds before querying Prisma', async () => {
+    const prisma = prismaManager.getClient()
+    const originalMemberCount = prisma.member.count
+    let memberCountCalled = false
+    let validationError
+
+    try {
+      prisma.member.count = async () => {
+        memberCountCalled = true
+        return 0
+      }
+
+      for (const userIds of [
+        ['TCConnCopilot'],
+        [Number.MAX_SAFE_INTEGER + 1],
+        ['9223372036854775808'],
+        ['']
+      ]) {
+        validationError = undefined
+
+        try {
+          await service.searchMembers(
+            { isMachine: true },
+            {
+              userIds,
+              fields: 'handle,userId'
+            }
+          )
+        } catch (err) {
+          validationError = err
+        }
+
+        should.exist(validationError)
+        validationError.isJoi.should.equal(true)
+        validationError.details[0].path.should.deep.equal(['query', 'userIds'])
+        validationError.details[0].type.should.equal('queryArray.items')
+      }
+
+      memberCountCalled.should.equal(false)
+    } finally {
+      prisma.member.count = originalMemberCount
+    }
+  })
+
   it('searchMembers should skip stats and skills hydration for explicit field-limited lookups', async () => {
     const prisma = prismaManager.getClient()
     const skillsPrisma = prismaManager.getSkillsClient()