feat: add structured logger and replace server-side console usage#5023
feat: add structured logger and replace server-side console usage#5023chavanGaneshDatta wants to merge 187 commits into
Conversation
…s and touch propagation (JhaSourav07#4681)
… Screen Reader Aria Compliance (Variation 4)
…earch-empty-fallback
|
@chavanGaneshDatta is attempting to deploy a commit to the jhasourav07's projects Team on Vercel. A member of the Team first needs to authorize it. |
|
🚨 Hey @chavanGaneshDatta, the CI Pipeline is failing on this PR and it has been marked as Please fix the issues before this can be reviewed. Here's how: 1. Run checks locally before pushing: npm run format:check # Check Prettier formatting
npm run lint # Run ESLint
npm run typecheck # TypeScript type check
npm run test # Run unit tests (Vitest)
npm run build # Verify production build passes2. Auto-fix common issues: npm run format # Auto-fix formatting with Prettier
npm run lint -- --fix # Auto-fix lint errors where possible3. Check the full failure log here: Once you push a fix and the CI passes, the |
1e698e8 to
9757d76
Compare
Aamod-Dev
left a comment
There was a problem hiding this comment.
Great initiative! A structured logger is much more scalable and easier to index in production environments than raw console usage. Approving!
…urav07#5488) ## Description Fixes JhaSourav07#5484 Added a **README Completion Score + Suggestions Panel** to the Generator section. The new panel analyzes README content and calculates a completion score based on key documentation sections. It also provides actionable suggestions to help users improve the quality and completeness of their project README. ### Features Added * README completion score calculation * Visual score display panel * Smart suggestions for missing sections * Real-time updates based on README content * Unit tests for score calculation and rendering behavior ## Pillar * [ ] 🎨 Pillar 1 — New Theme Design * [ ] 📐 Pillar 2 — Geometric SVG Improvement * [ ] 🕐 Pillar 3 — Timezone Logic Optimization * [x] 🛠️ Other (Bug fix, refactoring, docs) ## Visual Preview <img width="1808" height="646" alt="Screenshot 2026-06-13 125349" src="https://github.com/user-attachments/assets/db3efd17-4867-48af-b702-054a9651b0cf" /> ## Checklist before requesting a review: * [x] I have read the `CONTRIBUTING.md` file. * [x] I have tested these changes locally (`localhost:3000/api/streak?user=YOUR_USERNAME`). * [x] I have run `npm run format` and `npm run lint` locally and resolved all errors (CI will fail otherwise). * [x] My commits follow the Conventional Commits format (e.g., `feat(themes): ...`, `fix(calculate): ...`). * [ ] I have updated `README.md` if I added a new theme or URL parameter. * [x] I have started the repo. * [x] I have made sure that i have only one commit to merge in this PR. * [x] The SVG output matches the CommitPulse "premium quality" aesthetic standard (no raw elements, smooth animations, correct fonts). * [x] (Recommended) I joined the CommitPulse Discord community for contributor discussions, mentorship, and faster PR support.
…JhaSourav07#5487) close JhaSourav07#5480 Description This PR addresses a critical security vulnerability in the GitHub webhook authentication flow. Previously, the webhook endpoint used a hardcoded fallback secret (development_secret) whenever the GITHUB_WEBHOOK_SECRET environment variable was not configured. This created a fail-open authentication mechanism where an attacker could generate valid webhook signatures if the application was deployed without the required secret. Additionally, webhook signature verification relied on direct string comparison instead of a timing-safe comparison, potentially exposing the endpoint to timing attacks. Changes Made 1. Removed Hardcoded Fallback Secret Before const secret = process.env.GITHUB_WEBHOOK_SECRET || "development_secret"; After const secret = process.env.GITHUB_WEBHOOK_SECRET; Webhook requests are now rejected when the secret is not configured. 2. Fail Closed When Secret Is Missing Added validation to ensure the webhook endpoint refuses to process requests when GITHUB_WEBHOOK_SECRET is not configured. Behavior: Returns HTTP 500 in production environments. Logs configuration errors for easier debugging. Prevents accidental insecure deployments. 3. Added Timing-Safe Signature Verification Replaced direct string comparison: signature !== digest with: crypto.timingSafeEqual( Buffer.from(signature), Buffer.from(digest) ) Additional length validation was added before comparison to avoid runtime exceptions. 4. Improved Security Logging Added explicit logging for: Missing webhook secret configuration Invalid signatures Failed verification attempts This improves observability while avoiding leakage of sensitive information. Security Impact This PR mitigates the following risks: Forged GitHub webhook events Authentication bypass due to missing configuration Abuse of publicly known fallback secrets Timing attacks against signature verification Future exploitation when webhook-triggered actions are added Testing Verified Scenarios ✅ Valid webhook requests are accepted ✅ Invalid signatures are rejected ✅ Missing signatures are rejected ✅ Missing webhook secret causes request failure ✅ Timing-safe comparison works correctly ✅ Signature length mismatch handled safely Manual Testing Configure a valid GITHUB_WEBHOOK_SECRET. Send a correctly signed webhook request. Verify the request is accepted. Send a request with an invalid signature. Verify the request is rejected. Remove the environment variable. Verify the endpoint refuses processing. Additional Notes This change follows the security principle of fail closed by default, ensuring that webhook authentication cannot silently degrade into an insecure state due to deployment misconfiguration. GSSoC 2026 Program: GSSoC 2026 Type: Security Fix Priority: Critical Category: Authentication & Webhook Security
…tability (JhaSourav07#5485) ## Description Fixes JhaSourav07#4328 Added a dedicated massive-scaling test suite for `app/components/CustomizeCTA.tsx`. ### Coverage Added - Verifies component stability during repeated render and unmount cycles. - Tests rendering of many CustomizeCTA instances simultaneously without layout degradation. - Validates CTA link integrity and navigation behavior under high interaction volume. - Confirms decorative visual elements render consistently across large numbers of instances. - Checks render performance remains stable under repeated mount cycles. The test suite focuses on realistic scaling scenarios aligned with the actual responsibilities of the CustomizeCTA component, validating rendering stability, interaction reliability, layout preservation, and performance characteristics under heavy usage conditions. ## Pillar - [x] 🛠️ Other (Bug fix, refactoring, docs) ## Visual Preview - N/A – Test-only changes. ## Checklist before requesting a review: - [x] I have read the `CONTRIBUTING.md` file. - [x] I have tested these changes locally (`localhost:3000/api/streak?user=YOUR_USERNAME`). - [x] I have run `npm run format` and `npm run lint` locally and resolved all errors (CI will fail otherwise). - [x] My commits follow the Conventional Commits format (e.g., `feat(themes): ...`, `fix(calculate): ...`). - [x] I have started the repo. - [x] I have made sure that i have only one commit to merge in this PR. - [x] The SVG output matches the CommitPulse "premium quality" aesthetic standard (no raw elements, smooth animations, correct fonts). - [x] (Recommended) I joined the CommitPulse Discord community for contributor discussions, mentorship, and faster PR support.
…ation Preferences (JhaSourav07#5482) close JhaSourav07#5479 Description This PR addresses a critical security vulnerability in the notification management API that allowed arbitrary users to modify or delete notification preferences for any GitHub username without proving ownership. Previously: POST /api/notify allowed notification records to be created or updated based solely on the provided username. DELETE /api/notify?user=<username> allowed deletion of notification preferences using only a username parameter. No authentication, ownership verification, or signed management token was required. API responses exposed stored email addresses. Changes Made 1. Ownership Verification Added verification checks before updating existing notification records. Prevents unauthorized users from modifying another user's notification settings. 2. Secure Unsubscribe Flow Replaced username-only deletion with signed unsubscribe token validation. Notification records can now only be deleted through valid management links. 3. Email Privacy Improvements Removed full email addresses from unauthenticated API responses. Added email masking for user-facing responses where appropriate. 4. Validation Hardening Added stricter request validation. Improved error handling for invalid modification attempts. Added safeguards against account takeover through notification endpoints. Security Impact This PR mitigates: Unauthorized notification preference modification Unauthorized notification deletion Email disclosure through API responses Notification account hijacking Testing Verified Scenarios ✅ Create notification subscription with valid data ✅ Update own notification settings successfully ✅ Reject unauthorized modification attempts ✅ Reject invalid unsubscribe tokens ✅ Allow deletion using valid signed token ✅ Email addresses are no longer exposed in responses Screenshots N/A GSSoC 2026 Program: GSSoC 2026 Type: Security Fix
## Description Fixes JhaSourav07#3951 This PR resolves a DOM-based Cross-Site Scripting (XSS) vulnerability in the README generator preview panel. ### Changes Made * added security-focused test coverage for PreviewPanel * verified malicious `<script>` tags are removed * verified inline event handlers such as `onerror` are sanitized * ensured safe markdown content continues rendering correctly * added isolated XSS sanitization regression tests ## Pillar * [ ] 🎨 Pillar 1 — New Theme Design * [ ] 📐 Pillar 2 — Geometric SVG Improvement * [ ] 🕐 Pillar 3 — Timezone Logic Optimization * [x] 🛠️ Other (Bug fix, refactoring, docs) ## Visual Preview N/A (Security + test coverage changes only) ## Checklist before requesting a review: * [x] I have read the `CONTRIBUTING.md` file. * [x] I have tested these changes locally (`localhost:3000/api/streak?user=YOUR_USERNAME`). * [x] I have run `npm run format` and `npm run lint` locally and resolved all errors (CI will fail otherwise). * [x] My commits follow the Conventional Commits format (e.g., `feat(themes): ...`, `fix(calculate): ...`). * [ ] I have updated `README.md` if I added a new theme or URL parameter. * [x] I have started the repo. * [x] I have made sure that i have only one commit to merge in this PR. * [x] The SVG output matches the CommitPulse "premium quality" aesthetic standard (no raw elements, smooth animations, correct fonts). * [x] (Recommended) I joined the CommitPulse Discord community for contributor discussions, mentorship, and faster PR support.
…s and Extreme High Bounds Scaling (Variation 2) (JhaSourav07#5475) ## Description Fixes JhaSourav07#4405 Added isolated massive-scaling coverage for `lib/svg/layoutConstants.ts`. The new test file verifies: - projected isometric coordinates stay unique across thousands of activity cells - extreme contribution counts clamp to stable linear/log height maximums - massive calendars render through `computeTowers` into the bounded 14-week visible grid - LoC mode remains bounded under extremely high metrics - fixed grid spacing constants keep SVG layout bounds finite and predictable ## Pillar - [ ] 🎨 Pillar 1 — New Theme Design - [ ] 📐 Pillar 2 — Geometric SVG Improvement - [ ] 🕐 Pillar 3 — Timezone Logic Optimization - [x] 🛠️ Other (Bug fix, refactoring, docs) ## Visual Preview Not applicable. This PR adds test coverage only and does not change the UI. ## Checklist before requesting a review: - [x] I have read the `CONTRIBUTING.md` file. - [x] I have tested these changes locally (`localhost:3000/api/streak?user=YOUR_USERNAME`). - [x] I have run `npm run format` and `npm run lint` locally and resolved all errors (CI will fail otherwise). - [x] My commits follow the Conventional Commits format (e.g., `feat(themes): ...`, `fix(calculate): ...`). - [ ] I have updated `README.md` if I added a new theme or URL parameter. - [x] I have started the repo. - [x] I have made sure that i have only one commit to merge in this PR. - [ ] The SVG output matches the CommitPulse "premium quality" aesthetic standard (no raw elements, smooth animations, correct fonts). - [x] (Recommended) I joined the CommitPulse Discord community for contributor discussions, mentorship, and faster PR support. ## Testing - [x] `npx vitest run lib/svg/layoutConstants.massive-scaling.test.ts` *(via temporary config because massive-scaling suites are excluded by default)* - [x] `npm run typecheck` - [x] `npx prettier --check lib/svg/layoutConstants.massive-scaling.test.ts` - [x] `npx vitest run`
…urav07#5473) ## Description Fixes JhaSourav07#4353 ## Pillar - [ ] 🎨 Pillar 1 — New Theme Design - [ ] 📐 Pillar 2 — Geometric SVG Improvement - [ ] 🕐 Pillar 3 — Timezone Logic Optimization - [x] 🛠️ Other (Bug fix, refactoring, docs) ## Visual Preview N/A ## Checklist before requesting a review: - [x] I have read the `CONTRIBUTING.md` file. - [ ] I have tested these changes locally (`localhost:3000/api/streak?user=YOUR_USERNAME`). - [x] I have run `npm run format` and `npm run lint` locally and resolved all errors (CI will fail otherwise). - [x] My commits follow the Conventional Commits format (e.g., `feat(themes): ...`, `fix(calculate): ...`). - [ ] I have updated `README.md` if I added a new theme or URL parameter. - [ ] I have started the repo. - [x] I have made sure that i have only one commit to merge in this PR. - [ ] The SVG output matches the CommitPulse "premium quality" aesthetic standard (no raw elements, smooth animations, correct fonts). - [x] (Recommended) I joined the CommitPulse Discord community for contributor discussions, mentorship, and faster PR support.
…eme High Bounds Scaling (JhaSourav07#5472) ## Description Closes JhaSourav07#4412 ## What changed - Created new file `proxy.massive-scaling.test.ts` with 5 test cases ## Test cases 1. Processes 1000 requests from distinct IPs successfully within the rate limit 2. Returns 429 with correct rate limit headers after exceeding the 60-request limit for a single IP 3. Handles 3000 distinct IPs exceeding the internal cache capacity (maxSize 2000) without throwing or breaking rate limit tracking 4. Extracts only the first IP from an extremely long x-forwarded-for chain of 100 proxies 5. Correctly tracks remaining count across 60 sequential requests from the same IP ## Tests All 5 new tests pass. All existing tests pass. ## Pillar - [ ] 🎨 Pillar 1 — New Theme Design - [ ] 📐 Pillar 2 — Geometric SVG Improvement - [ ] 🕐 Pillar 3 — Timezone Logic Optimization - [x] 🛠️ Other (Bug fix, refactoring, docs) ## Visual Preview ## Checklist before requesting a review: - [x] I have read the `CONTRIBUTING.md` file. - [x] I have tested these changes locally (`localhost:3000/api/streak?user=YOUR_USERNAME`). - [x] I have run `npm run format` and `npm run lint` locally and resolved all errors (CI will fail otherwise). - [x] My commits follow the Conventional Commits format (e.g., `feat(themes): ...`, `fix(calculate): ...`). - [ ] I have updated `README.md` if I added a new theme or URL parameter. - [ ] I have started the repo. - [x] I have made sure that i have only one commit to merge in this PR. - [ ] The SVG output matches the CommitPulse "premium quality" aesthetic standard (no raw elements, smooth animations, correct fonts). - [x] (Recommended) I joined the CommitPulse Discord community for contributor discussions, mentorship, and faster PR support.
…rkdown rendering (JhaSourav07#5470) ## Description Fixes JhaSourav07#4347 Added a dedicated massive-scaling test suite for `app/generator/components/PreviewPanel.tsx`. ### Coverage Added - Verifies rendering stability with extremely large markdown documents. - Tests preview generation and HTML rendering under high-volume markdown content. - Validates raw markdown tab behavior with large payloads. - Confirms copy functionality works correctly with large markdown strings. - Checks component performance and stability during repeated render cycles. The test suite focuses on realistic large-scale markdown scenarios that align with the actual responsibilities of the PreviewPanel component, ensuring rendering accuracy, interaction reliability, and layout stability under heavy content loads. ## Pillar - [x] 🛠️ Other (Bug fix, refactoring, docs) ## Visual Preview - N/A – Test-only changes. ## Checklist before requesting a review: - [x] I have read the `CONTRIBUTING.md` file. - [x] I have tested these changes locally (`localhost:3000/api/streak?user=YOUR_USERNAME`). - [x] I have run `npm run format` and `npm run lint` locally and resolved all errors (CI will fail otherwise). - [x] My commits follow the Conventional Commits format (e.g., `feat(themes): ...`, `fix(calculate): ...`). - [x] I have started the repo. - [x] I have made sure that i have only one commit to merge in this PR. - [x] The SVG output matches the CommitPulse "premium quality" aesthetic standard (no raw elements, smooth animations, correct fonts). - [x] (Recommended) I joined the CommitPulse Discord community for contributor discussions, mentorship, and faster PR support.
…acks (JhaSourav07#5506) ## Description Fixes JhaSourav07#4213 This PR introduces comprehensive unit and integration test coverage for the `Footer` component to verify its behavior under edge cases and empty/missing inputs. Specifically, the tests assert: * **Fallback Translation Keys**: Ensures that if the translation helper `t` returns raw path keys (like `footer.tagline`), the component falls back safely to displaying those keys without throwing errors. * **Empty/Null Translation Strings**: Confirms that when translation values return empty strings, the layout spans and links render cleanly as blank slots rather than crashing the component. * **Missing Copyright Params**: Validates that copyright translations still show static layout text gracefully if parameters (e.g., the dynamic calendar year) are missing or ignored. * **Optional Link Parameters**: Tests custom internal links with missing parameters (such as `ariaLabel` or target attributes) to ensure they do not produce exceptions, while verifying that external links receive the correct fallback attributes (`target="_blank"`, `rel="noopener noreferrer"`, etc.). * **Dynamic System Date**: Verifies that the copyright year is updated and localized dynamically using the current calendar year. ## Pillar - [ ] 🎨 Pillar 1 — New Theme Design - [ ] 📐 Pillar 2 — Geometric SVG Improvement - [ ] 🕐 Pillar 3 — Timezone Logic Optimization - [x] 🛠️ Other (Bug fix, refactoring, docs) ## Visual Preview N/A (Unit testing additions) ## Checklist before requesting a review: - [x] I have read the `CONTRIBUTING.md` file. - [x] I have tested these changes locally (`localhost:3000/api/streak?user=YOUR_USERNAME`). - [x] I have run `npm run format` and `npm run lint` locally and resolved all errors (CI will fail otherwise). - [x] My commits follow the Conventional Commits format (e.g., `feat(themes): ...`, `fix(calculate): ...`). - [ ] I have updated `README.md` if I added a new theme or URL parameter. - [x] I have starred the repo. - [x] I have made sure that I have only one commit to merge in this PR. - [x] The SVG output matches the CommitPulse "premium quality" aesthetic standard (no raw elements, smooth curves, correct colors).
…av07#5497) ## Description Fixes JhaSourav07#4450 Added isolated theme contrast tests for `ContributorsClient`. ### Coverage * Verifies root container light and dark theme classes. * Verifies hero badge theme-aware contrast styling. * Verifies statistics cards maintain dark/light contrast variants. * Verifies CTA buttons use readable foreground/background color combinations. * Verifies foreground content remains layered above visual overlays. ### Result * Added 5 theme contrast test cases. * Vitest tests pass successfully. ## Pillar * [ ] 🎨 Pillar 1 — New Theme Design * [ ] 📐 Pillar 2 — Geometric SVG Improvement * [ ] 🕐 Pillar 3 — Timezone Logic Optimization * [x] 🛠️ Other (Bug fix, refactoring, docs) ## Visual Preview N/A (test-only change) ## Checklist before requesting a review: * [x] I have read the `CONTRIBUTING.md` file. * [ ] I have tested these changes locally (`localhost:3000/api/streak?user=YOUR_USERNAME`). * [x] I have run `npm run format` and `npm run lint` locally and resolved all errors (CI will fail otherwise). * [x] My commits follow the Conventional Commits format (e.g., `feat(themes): ...`, `fix(calculate): ...`). * [ ] I have updated `README.md` if I added a new theme or URL parameter. * [x] I have started the repo. * [x] I have made sure that i have only one commit to merge in this PR. * [ ] The SVG output matches the CommitPulse "premium quality" aesthetic standard (no raw elements, smooth animations, correct fonts). * [x] (Recommended) I joined the CommitPulse Discord community for contributor discussions, mentorship, and faster PR support.
… crash (JhaSourav07#5477) ## Description Fixes JhaSourav07#5474 `generateRecommendationsWithGemini` in `services/github/burnout-analyzer.ts` called `JSON.parse(text)` on the Gemini API response with no try/catch. If Gemini returned malformed JSON, the parse threw an unhandled exception that crashed the entire burnout analysis even though rules-based recommendations were already fully computed and ready to return. ### Changes - Wrapped `JSON.parse` in try/catch inside `generateRecommendationsWithGemini` - On parse failure, logs a warning and returns `[]` so the caller falls back to rules-based recommendations gracefully - Added a test to verify fallback behavior when Gemini returns malformed JSON ## Pillar - [ ] 🎨 Pillar 1 — New Theme Design - [ ] 📐 Pillar 2 — Geometric SVG Improvement - [ ] 🕐 Pillar 3 — Timezone Logic Optimization - [X] 🛠️ Other (Bug fix, refactoring, docs) ## Visual Preview ## Checklist before requesting a review: - [X] I have read the `CONTRIBUTING.md` file. - [X] I have tested these changes locally (`localhost:3000/api/streak?user=YOUR_USERNAME`). - [X] I have run `npm run format` and `npm run lint` locally and resolved all errors (CI will fail otherwise). - [X] My commits follow the Conventional Commits format (e.g., `feat(themes): ...`, `fix(calculate): ...`). - [ ] I have updated `README.md` if I added a new theme or URL parameter. - [ ] I have started the repo. - [X] I have made sure that i have only one commit to merge in this PR. - [ ] The SVG output matches the CommitPulse "premium quality" aesthetic standard (no raw elements, smooth animations, correct fonts). - [X] (Recommended) I joined the CommitPulse Discord community for contributor discussions, mentorship, and faster PR support.
…or test suites with explicit mocks
…id API rate limiting
…rence JSON test case
…ourav07#5366) ## Description Fixes JhaSourav07#4196 Adds `app/(root)/dashboard/error.empty-fallback.test.tsx` with 5 isolated tests focusing on edge cases, empty strings, and missing inputs in the `DashboardError` component: - Verifies that a generic `⚠️ ` emoji is rendered when `error.message` is an empty string. - Verifies that the default fallback description string is used when `error.message` is an empty string. - Verifies that the generic `'Something went wrong'` heading is displayed. - Verifies that the component renders without throwing runtime errors when the optional `digest` field is absent on the error object. - Verifies that both the `Try again` button and `Go back home` link are present in the DOM when displaying the fallback UI. ## Pillar - [ ] 🎨 Pillar 1 — New Theme Design - [ ] 📐 Pillar 2 — Geometric SVG Improvement - [ ] 🕐 Pillar 3 — Timezone Logic Optimization - [x] 🛠️ Other (Bug fix, refactoring, docs) ## Visual Preview *(N/A - This PR only introduces test suite coverage and does not modify the visual layout or codebase components.)* ## Checklist before requesting a review: - [x] I have read the `CONTRIBUTING.md` file. - [x] I have tested these changes locally. - [x] I have run `npm run format` and `npm run lint` locally and resolved all errors (CI will fail otherwise). - [x] My commits follow the Conventional Commits format. - [ ] I have updated `README.md` if I added a new theme or URL parameter. - [x] I have starred the repo. - [x] I have made sure that i have only one commit to merge in this PR. - [x] The SVG output matches the CommitPulse "premium quality" aesthetic standard (no raw elements, smooth animations, correct fonts). - [ ] (Recommended) I joined the CommitPulse Discord community for contributor discussions, mentorship, and faster PR support.
Aamod-Dev
left a comment
There was a problem hiding this comment.
Excellent telemetry refactor! I went through the changes and replacing raw console logs with a structured JSON logger provides massive observability improvements for production monitoring.
Labels applied:
- level:advanced: Custom structured logger implementation.
- quality:clean: Perfect environment fallbacks.
- ype:feature, ype:refactor: Modernizes the architecture.
Description
Fixes #4915
Summary
Implemented a structured logging system for server-side runtime services.
Changes Made
Added
lib/logger.tswith:debug()info()warn()error()Added environment-aware logging behavior:
Suppressed
debugandinfologs in production.Replaced server-side
console.warn()andconsole.error()usages with structured logger methods across:Added
lib/logger.test.tscovering:Updated affected tests to match the new logging implementation.
Example Production Output
{ "level": "error", "msg": "Failed to fetch notification preferences", "route": "/api/notify", "timestamp": "2026-06-09T12:00:00.000Z" }Pillar
Visual Preview
N/A (logging infrastructure change)
Checklist before requesting a review:
CONTRIBUTING.mdfile.npm run formatandnpm run lintlocally and resolved all errors.README.mdif I added a new theme or URL parameter.