Develop

[ucswift]

No description provided.

[request-info]

Thanks for opening this, but we'd appreciate a little more information. Could you update it with more details?

[coderabbitai]

Walkthrough

Warning

Review details and warnings were omitted to fit the comment limit.

[Resgrid-Bot]

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

⚠️ Note: some checks couldn't be completed in this run, so auto-approval (when enabled) was skipped. Check the details at http://localhost:3000/pull-requests and then comment @kody review on this PR to retry once the issue is resolved.

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the @kody start-review command at the root of your PR.

• Validate Business Logic: Ask Kody to validate your code against business rules by adding a comment with the @kody -v business-logic command.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	❌
Security	✅
Business Logic	❌

Access your configuration settings here.

​

[github-advanced-security]

CodeQL found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.

[Resgrid-Bot]

BrokerLegacySharedKeyEnabled enables a full-authority legacy shared credential by default, violating deny-by-default and least-privilege principles during migration. Disable it by default and require an explicit, scoped authorization path.

Kody rule violation: Implement RBAC with least privilege and deny-by-default

public static bool BrokerLegacySharedKeyEnabled = false;

Prompt for LLM

File Core/Resgrid.Config/DataProtectionConfig.cs:

Line 67:

`BrokerLegacySharedKeyEnabled` enables a full-authority legacy shared credential by default, violating deny-by-default and least-privilege principles during migration. Disable it by default and require an explicit, scoped authorization path.

Suggested Code:

public static bool BrokerLegacySharedKeyEnabled = false;

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

The documented shared-session absolute timeout permits up to 24 hours, exceeding the required maximum of 12 hours. Change the documentation and corresponding limits in Core/Resgrid.Config/PasskeyConfig.cs:89 and Core/Resgrid.Model/DepartmentSecurityPolicy.cs:131 to a maximum of 12 hours.

Kody rule violation: Harden session management with idle and absolute timeouts

<value>Nombre d'heures après la connexion au bout desquelles une session partagée se termine, quelle que soit l'activité, de 1 à 12. Une valeur plus courte termine plus tôt les sessions en cours ; une valeur plus longue ne les prolonge jamais. Membre gestionnaire uniquement.</value>

Prompt for LLM

File Core/Resgrid.Localization/Areas/User/AdminAssist/AdminAssist.fr.resx:

Line 5521:

The documented shared-session absolute timeout permits up to 24 hours, exceeding the required maximum of 12 hours. Change the documentation and corresponding limits in `Core/Resgrid.Config/PasskeyConfig.cs:89` and `Core/Resgrid.Model/DepartmentSecurityPolicy.cs:131` to a maximum of 12 hours.

Suggested Code:

    <value>Nombre d'heures après la connexion au bout desquelles une session partagée se termine, quelle que soit l'activité, de 1 à 12. Une valeur plus courte termine plus tôt les sessions en cours ; une valeur plus longue ne les prolonge jamais. Membre gestionnaire uniquement.</value>

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

RegisterForSessionEvents lacks an explicit error handler and deterministic unsubscribe mechanism, so session-event failures and cleanup cannot be managed reliably. Accept an error callback and return an IDisposable cleanup handle.

Kody rule violation: Provide error handlers to subscription/listener APIs

IDisposable RegisterForSessionEvents(Func<string, string, Task> sessionEvent, Func<Exception, Task> errorHandler);

Prompt for LLM

File Core/Resgrid.Model/Providers/IRabbitInboundEventProvider.cs:

Line 34:

RegisterForSessionEvents lacks an explicit error handler and deterministic unsubscribe mechanism, so session-event failures and cleanup cannot be managed reliably. Accept an error callback and return an IDisposable cleanup handle.

Suggested Code:

		IDisposable RegisterForSessionEvents(Func<string, string, Task> sessionEvent, Func<Exception, Task> errorHandler);

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

The awaited ProtectedGrantBinding.CheckAsync call in AdpReleaseService and the listed call sites can reject without guarded handling, propagating unhandled exceptions. Wrap the call in try/catch or apply an equivalent error-handling strategy that maps or logs the failure appropriately.

Kody rule violation: Handle async operations with proper error handling

Prompt for LLM

File Core/Resgrid.Services/AdpReleaseService.cs:

Line 30:

The awaited `ProtectedGrantBinding.CheckAsync` call in AdpReleaseService and the listed call sites can reject without guarded handling, propagating unhandled exceptions. Wrap the call in try/catch or apply an equivalent error-handling strategy that maps or logs the failure appropriately.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

AuthenticationChallengeService returns null from a Task-returning method, which can cause callers to receive a null Task and fail before awaiting a result. Return an explicit Task result, or change the contract to a nullable result type with a completed Task.

Kody rule violation: Avoid Returning Null in Non-Async Task Methods

return Task.FromResult<AuthenticationChallenge>(null);

Prompt for LLM

File Core/Resgrid.Services/AuthenticationChallengeService.cs:

Line 34:

AuthenticationChallengeService returns null from a Task-returning method, which can cause callers to receive a null Task and fail before awaiting a result. Return an explicit Task result, or change the contract to a nullable result type with a completed Task.

Suggested Code:

return Task.FromResult<AuthenticationChallenge>(null);

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

AuthenticationChallengeService catches every exception and converts it to AuthenticationChallengeOutcome.Unavailable, masking non-transient database failures and preventing them from surfacing for remediation. Catch only exceptions identified by IsTransientDatabaseException and rethrow non-transient failures after logging them.

Kody rule violation: Implement proper database error checking

catch (Exception ex) when (IsTransientDatabaseException(ex))
{
	Logging.LogException(ex, "Transient authentication challenge lookup failure.");
	return AuthenticationChallengeResult.Of(AuthenticationChallengeOutcome.Unavailable);
}
catch (Exception ex)
{
	Logging.LogException(ex, "Non-transient authentication challenge lookup failure.");
	throw;
}

Prompt for LLM

File Core/Resgrid.Services/AuthenticationChallengeService.cs:

Line 70 to 74:

AuthenticationChallengeService catches every exception and converts it to AuthenticationChallengeOutcome.Unavailable, masking non-transient database failures and preventing them from surfacing for remediation. Catch only exceptions identified by IsTransientDatabaseException and rethrow non-transient failures after logging them.

Suggested Code:

catch (Exception ex) when (IsTransientDatabaseException(ex))
{
	Logging.LogException(ex, "Transient authentication challenge lookup failure.");
	return AuthenticationChallengeResult.Of(AuthenticationChallengeOutcome.Unavailable);
}
catch (Exception ex)
{
	Logging.LogException(ex, "Non-transient authentication challenge lookup failure.");
	throw;
}

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

RecordFailedAttemptAsync swallows every non-cancellation repository failure and returns success, so FactorRecoveryController continues using the same pending transaction when the attempt counter cannot be persisted, allowing unlimited replacement-authenticator guesses during a storage outage. Propagate a refusal or failure result and stop the recovery endpoint until the guarded attempt update succeeds.

public async Task RecordFailedAttemptAsync(FactorRecoveryTransaction transaction, CancellationToken cancellationToken = default)
{
	await _transactions.RecordFailedAttemptAsync(transaction.FactorRecoveryTransactionId, cancellationToken);
}

Prompt for LLM

File Core/Resgrid.Services/FactorRecoveryService.cs:

Line 99 to 109:

RecordFailedAttemptAsync swallows every non-cancellation repository failure and returns success, so FactorRecoveryController continues using the same pending transaction when the attempt counter cannot be persisted, allowing unlimited replacement-authenticator guesses during a storage outage. Propagate a refusal or failure result and stop the recovery endpoint until the guarded attempt update succeeds.

Suggested Code:

		public async Task RecordFailedAttemptAsync(FactorRecoveryTransaction transaction, CancellationToken cancellationToken = default)
		{
			await _transactions.RecordFailedAttemptAsync(transaction.FactorRecoveryTransactionId, cancellationToken);
		}

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

MfaActivityService issues a repository query when userId or mfaActivityId is missing, allowing invalid identifiers to reach the data layer. Validate both identifiers first and return MfaActivityReportOutcome.NotFound without querying when either is blank.

Kody rule violation: Order validations before database queries

if (string.IsNullOrWhiteSpace(userId) || string.IsNullOrWhiteSpace(mfaActivityId))
				return new MfaActivityReport { Outcome = MfaActivityReportOutcome.NotFound };
			var activity = await _rows.GetAsync(mfaActivityId, cancellationToken);

Prompt for LLM

File Core/Resgrid.Services/MfaActivityService.cs:

Line 68:

MfaActivityService issues a repository query when userId or mfaActivityId is missing, allowing invalid identifiers to reach the data layer. Validate both identifiers first and return MfaActivityReportOutcome.NotFound without querying when either is blank.

Suggested Code:

if (string.IsNullOrWhiteSpace(userId) || string.IsNullOrWhiteSpace(mfaActivityId))
				return new MfaActivityReport { Outcome = MfaActivityReportOutcome.NotFound };
			var activity = await _rows.GetAsync(mfaActivityId, cancellationToken);

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

NamesCredential dereferences the potentially null grant before validating it, which can cause a null reference failure in the protected-grant flow. Check grant before accessing its properties and use GrantVersionWithCredential for the version comparison.

Kody rule violation: Add null checks to prevent NullReferenceException

private static bool NamesCredential(ProtectedDataGrant grant) =>
			grant != null && grant.Version >= GrantVersionWithCredential && grant.MfaMethod != ProtectedDataGrantMfaMethods.Totp && grant.MfaMethod != ProtectedDataGrantMfaMethods.None;

Prompt for LLM

File Core/Resgrid.Services/ProtectedGrantBinding.cs:

Line 64 to 65:

`NamesCredential` dereferences the potentially null `grant` before validating it, which can cause a null reference failure in the protected-grant flow. Check `grant` before accessing its properties and use `GrantVersionWithCredential` for the version comparison.

Suggested Code:

private static bool NamesCredential(ProtectedDataGrant grant) =>
			grant != null && grant.Version >= GrantVersionWithCredential && grant.MfaMethod != ProtectedDataGrantMfaMethods.Totp && grant.MfaMethod != ProtectedDataGrantMfaMethods.None;

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

Android origins are accepted solely because they match a 43-character shape, without checking an allowlisted signing-certificate hash, so any Android application with its own signing key can present an android:apk-key-hash: origin and bypass per-application passkey binding. Require Android origins to be explicitly configured and validate the normalized origin against the configured per-client allowlist instead of returning true for every regex match.

private static bool IsAllowedOrigin(string origin, string rpId, IReadOnlySet<string> allowedAndroidOrigins)
{
	if (AndroidOriginPattern.IsMatch(origin))
		return allowedAndroidOrigins.Contains(origin);
	// validate HTTPS web origins as before
}

Prompt for LLM

File Core/Resgrid.Services/RelyingPartyRegistry.cs:

Line 131 to 134:

Android origins are accepted solely because they match a 43-character shape, without checking an allowlisted signing-certificate hash, so any Android application with its own signing key can present an `android:apk-key-hash:` origin and bypass per-application passkey binding. Require Android origins to be explicitly configured and validate the normalized origin against the configured per-client allowlist instead of returning true for every regex match.

Suggested Code:

private static bool IsAllowedOrigin(string origin, string rpId, IReadOnlySet<string> allowedAndroidOrigins)
{
	if (AndroidOriginPattern.IsMatch(origin))
		return allowedAndroidOrigins.Contains(origin);
	// validate HTTPS web origins as before
}

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

SecurityNoticeService performs delivery and related I/O once per notice inside a loop, serializing independent operations and increasing latency. Batch the work or safely parallelize it with Task.WhenAll, or add an aggregate delivery API.

Kody rule violation: Detect N+1 style queries and suggest batching

var deliveries = due.Select(notice => DeliverAsync(notice, cancellationToken));
foreach (var delivered in await Task.WhenAll(deliveries))
{
	if (delivered)
		sent++;
}

Prompt for LLM

File Core/Resgrid.Services/SecurityNoticeService.cs:

Line 120:

SecurityNoticeService performs delivery and related I/O once per notice inside a loop, serializing independent operations and increasing latency. Batch the work or safely parallelize it with Task.WhenAll, or add an aggregate delivery API.

Suggested Code:

			var deliveries = due.Select(notice => DeliverAsync(notice, cancellationToken));
			foreach (var delivered in await Task.WhenAll(deliveries))
			{
				if (delivered)
					sent++;
			}

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

The loop uses an equality-based termination expression and does not explicitly access the nullable value, reducing termination clarity. Use pattern matching with entries is null || i < entries.Value for deterministic relational termination.

Kody rule violation: Avoid equality operators in loop termination conditions

for (int i = 0; entries is null || i < entries.Value; i++)

Prompt for LLM

File Providers/Resgrid.Providers.Authentication/Fido2PasskeyProvider.cs:

Line 221:

The loop uses an equality-based termination expression and does not explicitly access the nullable value, reducing termination clarity. Use pattern matching with `entries is null || i < entries.Value` for deterministic relational termination.

Suggested Code:

for (int i = 0; entries is null || i < entries.Value; i++)

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

The CBOR algorithm value is converted from Int64 to int without checked arithmetic, so an out-of-range value can silently overflow. Use checked((int)reader.ReadInt64()).

Kody rule violation: Prevent Numeric Overflow in Calculations

return checked((int)reader.ReadInt64());

Prompt for LLM

File Providers/Resgrid.Providers.Authentication/Fido2PasskeyProvider.cs:

Line 230:

The CBOR algorithm value is converted from Int64 to int without checked arithmetic, so an out-of-range value can silently overflow. Use `checked((int)reader.ReadInt64())`.

Suggested Code:

return checked((int)reader.ReadInt64());

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

The Rabbit/message-bus publish operation in RabbitTopicProvider and the listed call sites lacks guarded failure context, making session-event delivery failures difficult to diagnose. Wrap the operation in try/catch, log the operation and session identifier with structured fields, and rethrow or map the error appropriately.

Kody rule violation: Add try-catch blocks for external calls

public async Task<bool> SessionEvent(string sessionId, string payload)
{
	try
	{
		return await SendMessage(Topics.EventingTopic, new EventingMessage
		{
			Id = Guid.NewGuid(), Type = (int)EventingTypes.SessionEvent, TimeStamp = DateTime.UtcNow, ItemId = sessionId, Payload = payload
		}.SerializeJson());
	}
	catch (Exception exception)
	{
		_logger.Error(exception, "Failed to publish session event for session {SessionId}", sessionId);
		throw;
	}
}

Prompt for LLM

File Providers/Resgrid.Providers.Bus.Rabbit/RabbitTopicProvider.cs:

Line 90 to 93:

The Rabbit/message-bus publish operation in RabbitTopicProvider and the listed call sites lacks guarded failure context, making session-event delivery failures difficult to diagnose. Wrap the operation in try/catch, log the operation and session identifier with structured fields, and rethrow or map the error appropriately.

Suggested Code:

public async Task<bool> SessionEvent(string sessionId, string payload)
{
	try
	{
		return await SendMessage(Topics.EventingTopic, new EventingMessage
		{
			Id = Guid.NewGuid(), Type = (int)EventingTypes.SessionEvent, TimeStamp = DateTime.UtcNow, ItemId = sessionId, Payload = payload
		}.SerializeJson());
	}
	catch (Exception exception)
	{
		_logger.Error(exception, "Failed to publish session event for session {SessionId}", sessionId);
		throw;
	}
}

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

Adding a non-null column with a default in one migration can lock or rewrite a large table, creating deployment risk across the listed migrations. Use an expand/contract strategy: add the column nullable, backfill existing rows in batches, add the default for new writes, and enforce NOT NULL later with an online migration and documented rollback plan.

Kody rule violation: Block risky database migrations (locking ops, downtime risk)

Prompt for LLM

File Providers/Resgrid.Providers.Migrations/Migrations/M0251_AddFederatedMfaMapping.cs:

Line 19:

Adding a non-null column with a default in one migration can lock or rewrite a large table, creating deployment risk across the listed migrations. Use an expand/contract strategy: add the column nullable, backfill existing rows in batches, add the default for new writes, and enforce NOT NULL later with an online migration and documented rollback plan.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

The _postgres field is initialized once and never reassigned, so its declaration should remain readonly to enforce immutability. Keep private readonly bool _postgres; or verify that the field is intentionally mutable throughout the type.

Kody rule violation: Use `readonly` or `const` for Immutable Data

Prompt for LLM

File Repositories/Resgrid.Repositories.DataRepository/AuthenticationChallengeRepository.cs:

Line 25:

The `_postgres` field is initialized once and never reassigned, so its declaration should remain readonly to enforce immutability. Keep `private readonly bool _postgres;` or verify that the field is intentionally mutable throughout the type.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

CurrentTimeStep rounds Unix seconds before integer division, advancing the TOTP step by up to 0.5 seconds and allowing the server to consume a future step before the actual 30-second boundary, which causes intermittent valid-code failures. Use floor/integer division of elapsed Unix seconds, such as (long)(utcNow - UnixEpoch).TotalSeconds / StepSeconds, to match RFC 6238 and Identity's time-step calculation.

public static long CurrentTimeStep(DateTime utcNow)
	=> (long)(utcNow - UnixEpoch).TotalSeconds / StepSeconds;

Prompt for LLM

File Repositories/Resgrid.Repositories.DataRepository/Stores/TotpCalculator.cs:

Line 23 to 25:

`CurrentTimeStep` rounds Unix seconds before integer division, advancing the TOTP step by up to 0.5 seconds and allowing the server to consume a future step before the actual 30-second boundary, which causes intermittent valid-code failures. Use floor/integer division of elapsed Unix seconds, such as `(long)(utcNow - UnixEpoch).TotalSeconds / StepSeconds`, to match RFC 6238 and Identity's time-step calculation.

Suggested Code:

public static long CurrentTimeStep(DateTime utcNow)
	=> (long)(utcNow - UnixEpoch).TotalSeconds / StepSeconds;

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

The related database inserts execute without a transaction, so a failure can leave the test database partially seeded. Enclose the inserts in a transaction, commit only after all succeed, and roll back on failure.

Kody rule violation: Handle transaction rollbacks properly

using var transaction = db.BeginTransaction();
try
{
    await db.ExecuteAsync($"INSERT INTO {Q("AspNetUsers")} (...) VALUES (...); INSERT INTO {Q("DepartmentSsoConfigs")} VALUES (...); INSERT INTO {Q("DepartmentSecurityPolicies")} VALUES (...)", args, transaction);
    transaction.Commit();
}
catch
{
    transaction.Rollback();
    throw;
}

Prompt for LLM

File Tests/Resgrid.Tests/AdminAssist/AdminAssistDatabaseTests.cs:

Line 355:

The related database inserts execute without a transaction, so a failure can leave the test database partially seeded. Enclose the inserts in a transaction, commit only after all succeed, and roll back on failure.

Suggested Code:

using var transaction = db.BeginTransaction();
try
{
    await db.ExecuteAsync($"INSERT INTO {Q("AspNetUsers")} (...) VALUES (...); INSERT INTO {Q("DepartmentSsoConfigs")} VALUES (...); INSERT INTO {Q("DepartmentSecurityPolicies")} VALUES (...)", args, transaction);
    transaction.Commit();
}
catch
{
    transaction.Rollback();
    throw;
}

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

The listed Regex instances, including LocalizerInject in Tests/Resgrid.Tests/Localization/RazorOutputEncodingTests.cs, omit a timeout and can be exposed to regular-expression denial-of-service attacks. Define an explicit timeout for every regex that processes untrusted or externally sourced input.

Kody rule violation: Specify Timeout for Regular Expressions

Prompt for LLM

File Tests/Resgrid.Tests/Localization/RazorOutputEncodingTests.cs:

Line 45:

The listed Regex instances, including `LocalizerInject` in `Tests/Resgrid.Tests/Localization/RazorOutputEncodingTests.cs`, omit a timeout and can be exposed to regular-expression denial-of-service attacks. Define an explicit timeout for every regex that processes untrusted or externally sourced input.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

The listed tests use int.Parse to convert string input, which can throw on invalid or unexpected formats. Use a TryParse-style API and validate the culture and format where applicable.

Kody rule violation: Use TryParse for string conversions

Prompt for LLM

File Tests/Resgrid.Tests/Localization/ResourceKeyParityTests.cs:

Line 64:

The listed tests use `int.Parse` to convert string input, which can throw on invalid or unexpected formats. Use a TryParse-style API and validate the culture and format where applicable.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

The listed database tests build SQL with unsanitized _database input, allowing SQL injection through the concatenated CREATE DATABASE statement. Use parameterized queries or a validated identifier-quoting mechanism for database names.

Kody rule violation: Prevent SQL Injection in Queries

Prompt for LLM

File Tests/Resgrid.Tests/Security/BrokerReplayDatabaseTests.cs:

Line 70:

The listed database tests build SQL with unsanitized `_database` input, allowing SQL injection through the concatenated `CREATE DATABASE` statement. Use parameterized queries or a validated identifier-quoting mechanism for database names.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

The async setup method calls the migration runner's synchronous MigrateUp() API, blocking the execution thread during database work. Use the asynchronous MigrateUpAsync() API.

Kody rule violation: Use Awaitable Methods in Async Code

await _runner.GetRequiredService<IMigrationRunner>().MigrateUpAsync();

Prompt for LLM

File Tests/Resgrid.Tests/Security/BrokerReplayDatabaseTests.cs:

Line 85:

The async setup method calls the migration runner's synchronous `MigrateUp()` API, blocking the execution thread during database work. Use the asynchronous `MigrateUpAsync()` API.

Suggested Code:

await _runner.GetRequiredService<IMigrationRunner>().MigrateUpAsync();

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

BrokerReplayDatabaseTests uses an async-capable primary-constructor pattern for lifecycle initialization, which obscures synchronous construction and setup ordering. Keep the constructor synchronous and move asynchronous initialization into the setup method.

Kody rule violation: Avoid asynchronous operations in constructors

public class BrokerReplayDatabaseTests
	{
		public BrokerReplayDatabaseTests(DatabaseTypes type) { ... }

Prompt for LLM

File Tests/Resgrid.Tests/Security/BrokerReplayDatabaseTests.cs:

Line 32:

BrokerReplayDatabaseTests uses an async-capable primary-constructor pattern for lifecycle initialization, which obscures synchronous construction and setup ordering. Keep the constructor synchronous and move asynchronous initialization into the setup method.

Suggested Code:

public class BrokerReplayDatabaseTests
	{
		public BrokerReplayDatabaseTests(DatabaseTypes type) { ... }

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

The listed tests block asynchronous operations with .Result or .Wait(), which can cause deadlocks and prevent efficient asynchronous execution. Convert the call paths to async and use await instead of blocking.

Kody rule violation: Avoid Blocking Calls to Async Methods

Prompt for LLM

File Tests/Resgrid.Tests/Security/DepartmentLockAuthFlowsTests.cs:

Line 63:

The listed tests block asynchronous operations with `.Result` or `.Wait()`, which can cause deadlocks and prevent efficient asynchronous execution. Convert the call paths to async and use `await` instead of blocking.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

The LegacyAppCallbacksTests.cs expression uses an inline lambda in a call chain, although the cited JSX-prop rule is not applicable to this C# test code. If the intended concern is allocation or readability, extract the predicate into a named method; otherwise remove this finding.

Kody rule violation: Avoid using .bind() or arrow functions in JSX props

Prompt for LLM

File Tests/Resgrid.Tests/Security/LegacyAppCallbacksTests.cs:

Line 122:

The LegacyAppCallbacksTests.cs expression uses an inline lambda in a call chain, although the cited JSX-prop rule is not applicable to this C# test code. If the intended concern is allocation or readability, extract the predicate into a named method; otherwise remove this finding.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

LoginMfaTransactionApiTests disables the transport security requirement for token endpoints, allowing tests to pass without verifying TLS enforcement. Remove DisableTransportSecurityRequirement and require TLS 1.2 or later while testing HTTPS behavior.

Kody rule violation: Enforce TLS 1.2+ and HSTS on all external endpoints

options.UseAspNetCore().EnableTokenEndpointPassthrough();

Prompt for LLM

File Tests/Resgrid.Tests/Security/LoginMfaTransactionApiTests.cs:

Line 192:

LoginMfaTransactionApiTests disables the transport security requirement for token endpoints, allowing tests to pass without verifying TLS enforcement. Remove DisableTransportSecurityRequirement and require TLS 1.2 or later while testing HTTPS behavior.

Suggested Code:

options.UseAspNetCore().EnableTokenEndpointPassthrough();

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

MfaApprovalRequestDatabaseTests uses a primary-constructor form that can encourage asynchronous initialization in the constructor. Keep the constructor synchronous and move asynchronous setup into a separate setup method.

Kody rule violation: Avoid asynchronous operations in constructors

public class MfaApprovalRequestDatabaseTests
{
    public MfaApprovalRequestDatabaseTests(DatabaseTypes type) { ... }
}

Prompt for LLM

File Tests/Resgrid.Tests/Security/MfaApprovalRequestDatabaseTests.cs:

Line 35:

MfaApprovalRequestDatabaseTests uses a primary-constructor form that can encourage asynchronous initialization in the constructor. Keep the constructor synchronous and move asynchronous setup into a separate setup method.

Suggested Code:

public class MfaApprovalRequestDatabaseTests
{
    public MfaApprovalRequestDatabaseTests(DatabaseTypes type) { ... }
}

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

PasskeyDatabaseTests and the listed database test setup methods perform synchronous migration I/O from asynchronous initialization code. Call the migration runner’s asynchronous API with MigrateUpAsync().

Kody rule violation: Use Awaitable Methods in Async Code

await _runner.GetRequiredService<IMigrationRunner>().MigrateUpAsync();

Prompt for LLM

File Tests/Resgrid.Tests/Security/PasskeyDatabaseTests.cs:

Line 88:

PasskeyDatabaseTests and the listed database test setup methods perform synchronous migration I/O from asynchronous initialization code. Call the migration runner’s asynchronous API with MigrateUpAsync().

Suggested Code:

await _runner.GetRequiredService<IMigrationRunner>().MigrateUpAsync();

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

RelyingPartyRegistryTests.cs accesses Origins on the potentially absent result of registry.Get(UserSessionClientApplication.Responder), which can cause a NullReferenceException. Assert the result is non-null before accessing Origins or use a null-safe access pattern.

Kody rule violation: Add null checks before accessing properties

registry.Get(UserSessionClientApplication.Responder)?.Origins.Should().BeEquivalentTo("https://responder.resgrid.com", AndroidOrigin);

Prompt for LLM

File Tests/Resgrid.Tests/Security/RelyingPartyRegistryTests.cs:

Line 54:

RelyingPartyRegistryTests.cs accesses Origins on the potentially absent result of registry.Get(UserSessionClientApplication.Responder), which can cause a NullReferenceException. Assert the result is non-null before accessing Origins or use a null-safe access pattern.

Suggested Code:

registry.Get(UserSessionClientApplication.Responder)?.Origins.Should().BeEquivalentTo("https://responder.resgrid.com", AndroidOrigin);

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

SsoBrokerTestDoubles retains an RSA instance in _key without deterministic disposal, and the listed locations contain similar disposable-resource lifetimes. Implement IDisposable on the provider or wrap the resource in a using or await using scope.

Kody rule violation: Use using statements for disposable resources

private readonly RSA _key = RSA.Create(2048); public void Dispose() => _key.Dispose();

Prompt for LLM

File Tests/Resgrid.Tests/Security/SsoBrokerTestDoubles.cs:

Line 105:

SsoBrokerTestDoubles retains an RSA instance in _key without deterministic disposal, and the listed locations contain similar disposable-resource lifetimes. Implement IDisposable on the provider or wrap the resource in a using or await using scope.

Suggested Code:

private readonly RSA _key = RSA.Create(2048); public void Dispose() => _key.Dispose();

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

ContactsIndexEncodingTests.cs contains an HTML payload string, and the listed Razor views contain plain img elements; the Next.js next/image rule does not apply to these C# tests or ASP.NET Razor views. Apply the project’s equivalent image component or explicit dimensions and alt text only where the relevant frontend framework supports it.

Kody rule violation: Use next/image with explicit dimensions and alt

Prompt for LLM

File Tests/Resgrid.Tests/Web/User/ContactsIndexEncodingTests.cs:

Line 41:

ContactsIndexEncodingTests.cs contains an HTML payload string, and the listed Razor views contain plain img elements; the Next.js next/image rule does not apply to these C# tests or ASP.NET Razor views. Apply the project’s equivalent image component or explicit dimensions and alt text only where the relevant frontend framework supports it.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

resgrid-shared-session.test.cjs logs only the raw error object, which omits structured operation context needed to diagnose failures. Log the operation name, test file, and error object, such as logger.error('shared session test failed', { operation: 'shared-session-test', err: error }).

Kody rule violation: Include error context in structured logs

Prompt for LLM

File Tests/Resgrid.Tests/Web/resgrid-shared-session.test.cjs:

Line 266:

resgrid-shared-session.test.cjs logs only the raw error object, which omits structured operation context needed to diagnose failures. Log the operation name, test file, and error object, such as logger.error('shared session test failed', { operation: 'shared-session-test', err: error }).

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

BrokerCredentialMiddleware logs the raw remote address and identifying client value, exposing personal or identifying data in application logs. Replace those values with stable hashes or tokens while retaining the authentication failure context.

Kody rule violation: Mask PII and secrets in logs

Framework.Logging.LogError("Broker credential authentication failed", new { Operation = "AuthenticateBrokerCredential", ClientIdHash = Hash(clientId), RemoteHostToken = Tokenize(RemoteHost(context)), Error = "UnknownIdOrWrongKey" });

Prompt for LLM

File Web/Resgrid.Web.Broker/Middleware/BrokerCredentialMiddleware.cs:

Line 56:

BrokerCredentialMiddleware logs the raw remote address and identifying client value, exposing personal or identifying data in application logs. Replace those values with stable hashes or tokens while retaining the authentication failure context.

Suggested Code:

Framework.Logging.LogError("Broker credential authentication failed", new { Operation = "AuthenticateBrokerCredential", ClientIdHash = Hash(clientId), RemoteHostToken = Tokenize(RemoteHost(context)), Error = "UnknownIdOrWrongKey" });

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

BrokerCredentialMiddleware logs personal data such as the remote address without diagnostic-purpose or lawful-basis metadata. Redact or tokenize the personal data and attach the required security purpose and legitimate-interest metadata.

Kody rule violation: Redact PII in logs and metrics by default

Framework.Logging.LogError("Broker credential authentication failed", new { Operation = "AuthenticateBrokerCredential", ClientIdHash = Hash(clientId), RemoteHostToken = Tokenize(RemoteHost(context)), Gdpr = new { Purpose = "security", LawfulBasis = "legitimate-interest" } });

Prompt for LLM

File Web/Resgrid.Web.Broker/Middleware/BrokerCredentialMiddleware.cs:

Line 56:

BrokerCredentialMiddleware logs personal data such as the remote address without diagnostic-purpose or lawful-basis metadata. Redact or tokenize the personal data and attach the required security purpose and legitimate-interest metadata.

Suggested Code:

Framework.Logging.LogError("Broker credential authentication failed", new { Operation = "AuthenticateBrokerCredential", ClientIdHash = Hash(clientId), RemoteHostToken = Tokenize(RemoteHost(context)), Gdpr = new { Purpose = "security", LawfulBasis = "legitimate-interest" } });

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

BrokerCredentials.AuditLayer interpolates the nullable Id directly, producing an ambiguous audit value when Id is absent. Enforce a non-null invariant in the constructor or use a defined fallback such as string.Empty.

Kody rule violation: Add null checks to prevent NullReferenceException

public string AuditLayer(BrokerLane lane) => $"broker/{Id ?? string.Empty}/{LaneName(lane)}";

Prompt for LLM

File Web/Resgrid.Web.Broker/Services/BrokerCredentials.cs:

Line 38:

BrokerCredentials.AuditLayer interpolates the nullable Id directly, producing an ambiguous audit value when Id is absent. Enforce a non-null invariant in the constructor or use a defined fallback such as string.Empty.

Suggested Code:

		public string AuditLayer(BrokerLane lane) => $"broker/{Id ?? string.Empty}/{LaneName(lane)}";

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

AccountSecurityController performs GetDepartmentByIdAsync for each link inside a loop, creating an N+1 lookup pattern. Batch-load departments with GetDepartmentsByIdsAsync before iterating and resolve each link from the resulting dictionary.

Kody rule violation: Optimize database queries with JOINs

IReadOnlyDictionary<string, Department> departments = await _departments.GetDepartmentsByIdsAsync(links.Select(link => link.DepartmentId));
Department department = departments[link.DepartmentId];

Prompt for LLM

File Web/Resgrid.Web.Services/Controllers/v4/AccountSecurityController.cs:

Line 203:

AccountSecurityController performs GetDepartmentByIdAsync for each link inside a loop, creating an N+1 lookup pattern. Batch-load departments with GetDepartmentsByIdsAsync before iterating and resolve each link from the resulting dictionary.

Suggested Code:

IReadOnlyDictionary<string, Department> departments = await _departments.GetDepartmentsByIdsAsync(links.Select(link => link.DepartmentId));
Department department = departments[link.DepartmentId];

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

AuthenticationController processes CompleteTotp input before checking ModelState.IsValid, allowing invalid model data to reach authentication logic. Check ModelState.IsValid at the start of the action and return a 400 response before processing input.

Kody rule violation: Always Validate `ModelState.IsValid` in Controllers

Prompt for LLM

File Web/Resgrid.Web.Services/Controllers/v4/AuthenticationController.cs:

Line 66:

AuthenticationController processes CompleteTotp input before checking ModelState.IsValid, allowing invalid model data to reach authentication logic. Check ModelState.IsValid at the start of the action and return a 400 response before processing input.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

FactorRecoveryController and the listed audit call sites record incomplete security-event data and do not establish an immutable audit trail. Include a UTC ISO-8601 timestamp, actor user ID and role, action, resource ID, result, trace ID, IP, and user agent, and use an append-only, signed or WORM-backed sink forwarded to the SIEM.

Kody rule violation: Emit tamper-evident audit logs with required fields

Prompt for LLM

File Web/Resgrid.Web.Services/Controllers/v4/FactorRecoveryController.cs:

Line 282 to 291:

FactorRecoveryController and the listed audit call sites record incomplete security-event data and do not establish an immutable audit trail. Include a UTC ISO-8601 timestamp, actor user ID and role, action, resource ID, result, trace ID, IP, and user agent, and use an append-only, signed or WORM-backed sink forwarded to the SIEM.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

FactorRecoveryController permits anonymous access to recovery actions through blanket [AllowAnonymous] authorization, without binding requests to an authorized transaction, user, and recovery scope. Replace anonymous access with explicit default-deny authorization and validate each recovery request against those values.

Kody rule violation: Implement RBAC with least privilege and deny-by-default

Prompt for LLM

File Web/Resgrid.Web.Services/Controllers/v4/FactorRecoveryController.cs:

Line 30:

FactorRecoveryController permits anonymous access to recovery actions through blanket [AllowAnonymous] authorization, without binding requests to an authorized transaction, user, and recovery scope. Replace anonymous access with explicit default-deny authorization and validate each recovery request against those values.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

Sso/Redeem routes every transaction other than Reauthentication into LoginAsync, including StepUp and AdpStepUp transactions created for an already authenticated session, which can issue login credentials instead of only recording step-up evidence. Dispatch each SsoTransactionPurpose explicitly and reject StepUp and AdpStepUp transactions from Sso/Redeem.

return transaction.TransactionPurpose switch
{
	SsoTransactionPurpose.Reauthentication => await ReauthenticatedAsync(transaction, cancellationToken),
	SsoTransactionPurpose.Login => await LoginAsync(transaction, client, input.ClientId, cancellationToken),
	_ => Refuse(SsoBrokerOutcome.InvalidRequest)
};

Prompt for LLM

File Web/Resgrid.Web.Services/Controllers/v4/SsoController.cs:

Line 149 to 151:

Sso/Redeem routes every transaction other than Reauthentication into LoginAsync, including StepUp and AdpStepUp transactions created for an already authenticated session, which can issue login credentials instead of only recording step-up evidence. Dispatch each SsoTransactionPurpose explicitly and reject StepUp and AdpStepUp transactions from Sso/Redeem.

Suggested Code:

return transaction.TransactionPurpose switch
{
	SsoTransactionPurpose.Reauthentication => await ReauthenticatedAsync(transaction, cancellationToken),
	SsoTransactionPurpose.Login => await LoginAsync(transaction, client, input.ClientId, cancellationToken),
	_ => Refuse(SsoBrokerOutcome.InvalidRequest)
};

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

DataProtectionController queries the approval service with an unvalidated approvalRequestId, allowing empty or malformed identifiers to reach the data layer. Reject blank or malformed approvalRequestId before calling GetForRequesterAsync.

Kody rule violation: Validate inputs on the server (zod) in Route Handlers/Actions

if (string.IsNullOrWhiteSpace(approvalRequestId)) return Json(new { success = false, error = "invalid_request" }); var found = await _approvals.GetForRequesterAsync(approvalRequestId, Model.Security.MfaApprovalRequesterKind.Session, session.SessionId,

Prompt for LLM

File Web/Resgrid.Web/Areas/User/Controllers/DataProtectionController.cs:

Line 537 to 538:

DataProtectionController queries the approval service with an unvalidated approvalRequestId, allowing empty or malformed identifiers to reach the data layer. Reject blank or malformed approvalRequestId before calling GetForRequesterAsync.

Suggested Code:

if (string.IsNullOrWhiteSpace(approvalRequestId)) return Json(new { success = false, error = "invalid_request" }); var found = await _approvals.GetForRequesterAsync(approvalRequestId, Model.Security.MfaApprovalRequesterKind.Session, session.SessionId,

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

PasskeysController queries the identity store before validating requestId and credential, allowing malformed requests to trigger unnecessary lookups. Reject empty or malformed values before calling GetUserAsync.

Kody rule violation: Order validations before database queries

if (string.IsNullOrWhiteSpace(requestId) || string.IsNullOrWhiteSpace(credential))
    return Refuse(PasskeyOutcome.InvalidRequest);

var user = await _userManager.GetUserAsync(User);

Prompt for LLM

File Web/Resgrid.Web/Areas/User/Controllers/PasskeysController.cs:

Line 60:

PasskeysController queries the identity store before validating requestId and credential, allowing malformed requests to trigger unnecessary lookups. Reject empty or malformed values before calling GetUserAsync.

Suggested Code:

if (string.IsNullOrWhiteSpace(requestId) || string.IsNullOrWhiteSpace(credential))
    return Refuse(PasskeyOutcome.InvalidRequest);

var user = await _userManager.GetUserAsync(User);

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

SearchController has already verified that model.Families is non-empty, so FirstOrDefault can incorrectly imply that absence is valid. Use First to preserve the non-empty invariant and surface an unexpected missing match.

Kody rule violation: Use `First`/`Single` Instead of `FirstOrDefault`/`SingleOrDefault` for Non-Empty Collections

model.Type = model.Families.First(f => string.Equals(f, type, StringComparison.OrdinalIgnoreCase));

Prompt for LLM

File Web/Resgrid.Web/Areas/User/Controllers/SearchController.cs:

Line 83:

SearchController has already verified that model.Families is non-empty, so FirstOrDefault can incorrectly imply that absence is valid. Use First to preserve the non-empty invariant and surface an unexpected missing match.

Suggested Code:

model.Type = model.Families.First(f => string.Equals(f, type, StringComparison.OrdinalIgnoreCase));

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

The ReplaceAuthenticator POST action omits the fresh-first-factor check required by the GET action, allowing an older authenticated session that satisfies HasReplacementAuthorityAsync to replace the account authenticator without fresh password or SSO proof. Call HasFreshFirstFactorAsync with TwoFactorConfig.FirstFactorOperationWindowMinutes before HasReplacementAuthorityAsync and reject or redirect when it returns false.

if (!await _userManager.GetTwoFactorEnabledAsync(user))\n    return RedirectToAction(nameof(Enable2FA));\n\nif (!await HasFreshFirstFactorAsync(user, TwoFactorConfig.FirstFactorOperationWindowMinutes))\n    return RedirectToReauthenticate(Url.Action(nameof(ReplaceAuthenticator)));\n\nif (!await HasReplacementAuthorityAsync(user, cancellationToken))\n    return RedirectToStepUp();\n\nvar stagedKey = await GetStagedAuthenticatorKeyAsync(user);

Prompt for LLM

File Web/Resgrid.Web/Areas/User/Controllers/TwoFactorController.cs:

Line 251 to 259:

The ReplaceAuthenticator POST action omits the fresh-first-factor check required by the GET action, allowing an older authenticated session that satisfies HasReplacementAuthorityAsync to replace the account authenticator without fresh password or SSO proof. Call HasFreshFirstFactorAsync with TwoFactorConfig.FirstFactorOperationWindowMinutes before HasReplacementAuthorityAsync and reject or redirect when it returns false.

Suggested Code:

if (!await _userManager.GetTwoFactorEnabledAsync(user))\n    return RedirectToAction(nameof(Enable2FA));\n\nif (!await HasFreshFirstFactorAsync(user, TwoFactorConfig.FirstFactorOperationWindowMinutes))\n    return RedirectToReauthenticate(Url.Action(nameof(ReplaceAuthenticator)));\n\nif (!await HasReplacementAuthorityAsync(user, cancellationToken))\n    return RedirectToStepUp();\n\nvar stagedKey = await GetStagedAuthenticatorKeyAsync(user);

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

SearchIndexView.FirstIndex multiplies Page by PageSize using Int32 arithmetic, so large values can overflow silently. Use checked arithmetic or a wider numeric type.

Kody rule violation: Prevent Numeric Overflow in Calculations

public int FirstIndex => checked((Page - 1) * PageSize + 1);

Prompt for LLM

File Web/Resgrid.Web/Areas/User/Models/Search/SearchIndexView.cs:

Line 49:

SearchIndexView.FirstIndex multiplies Page by PageSize using Int32 arithmetic, so large values can overflow silently. Use checked arithmetic or a wider numeric type.

Suggested Code:

public int FirstIndex => checked((Page - 1) * PageSize + 1);

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

The SsoViews.cshtml LINQ chain combines splitting, trimming, filtering, and materialization in one expression, obscuring each transformation. Assign the intermediate splitLines, trimmedLines, and nonEmptyLines expressions before materializing values.

Kody rule violation: Limit Lengthy LINQ Chains

var splitLines = (lines ?? string.Empty).Split('\n');
var trimmedLines = splitLines.Select(line => line.Trim());
var nonEmptyLines = trimmedLines.Where(line => line.Length > 0);
var values = nonEmptyLines.ToList();

Prompt for LLM

File Web/Resgrid.Web/Areas/User/Models/Security/SsoViews.cs:

Line 215:

The SsoViews.cshtml LINQ chain combines splitting, trimming, filtering, and materialization in one expression, obscuring each transformation. Assign the intermediate splitLines, trimmedLines, and nonEmptyLines expressions before materializing values.

Suggested Code:

			var splitLines = (lines ?? string.Empty).Split('\n');
			var trimmedLines = splitLines.Select(line => line.Trim());
			var nonEmptyLines = trimmedLines.Where(line => line.Length > 0);
			var values = nonEmptyLines.ToList();

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

Outbox.cshtml constructs raw HTML with message.MessageId interpolated into query strings and passes it through Html.Raw, bypassing normal Razor attribute encoding. Generate URLs with Url.Action or URL-encode the identifier and let Razor encode the resulting attributes.

Kody rule violation: Always sanitize user inputs

<td><a href="@Url.Action("ViewMessage", "Messages", new { area = "User", messageId = message.MessageId })" class="btn btn-primary btn-xs" title="@localizer["View"].Value">@commonLocalizer["View"].Value</a></td>

Prompt for LLM

File Web/Resgrid.Web/Areas/User/Views/Messages/Outbox.cshtml:

Line 50:

Outbox.cshtml constructs raw HTML with message.MessageId interpolated into query strings and passes it through Html.Raw, bypassing normal Razor attribute encoding. Generate URLs with Url.Action or URL-encode the identifier and let Razor encode the resulting attributes.

Suggested Code:

<td><a href="@Url.Action("ViewMessage", "Messages", new { area = "User", messageId = message.MessageId })" class="btn btn-primary btn-xs" title="@localizer["View"].Value">@commonLocalizer["View"].Value</a></td>

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

Search/Index.cshtml embeds layout declarations in an inline style attribute, making styling harder to reuse and maintain. Move the declarations into a scoped stylesheet or component-scoped class such as a dedicated BEM modifier.

Kody rule violation: Use component-scoped styling

<div class="btn-group top-page-buttons">

Prompt for LLM

File Web/Resgrid.Web/Areas/User/Views/Search/Index.cshtml:

Line 28:

Search/Index.cshtml embeds layout declarations in an inline style attribute, making styling harder to reuse and maintain. Move the declarations into a scoped stylesheet or component-scoped class such as a dedicated BEM modifier.

Suggested Code:

<div class="btn-group top-page-buttons">

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

The recovery transaction is marked complete before the replacement authenticator and account cleanup succeed, so an exception in PromoteAsync, passkey revocation, or pending-request cancellation consumes the recovery transaction while leaving the old factor unchanged. Complete the recovery atomically with authenticator promotion and cleanup, or retain a resumable pending state until all required mutations commit.

// Perform TryCompleteAsync together with PromoteAsync and the required cleanup in one atomic service operation,
// or complete the recovery only after those mutations have succeeded.
var completed = await _recoveries.TryCompleteAndPromoteAsync(recovery, user, stagedKey, remove, cancellationToken);
if (!completed)
	return RecoveryEnded();

Prompt for LLM

File Web/Resgrid.Web/Controllers/AccountController.Recovery.cs:

Line 321 to 326:

The recovery transaction is marked complete before the replacement authenticator and account cleanup succeed, so an exception in PromoteAsync, passkey revocation, or pending-request cancellation consumes the recovery transaction while leaving the old factor unchanged. Complete the recovery atomically with authenticator promotion and cleanup, or retain a resumable pending state until all required mutations commit.

Suggested Code:

// Perform TryCompleteAsync together with PromoteAsync and the required cleanup in one atomic service operation,
// or complete the recovery only after those mutations have succeeded.
var completed = await _recoveries.TryCompleteAndPromoteAsync(recovery, user, stagedKey, remove, cancellationToken);
if (!completed)
	return RecoveryEnded();

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

GetLatestSecondFactorUtcAsync discards all evidence when the latest second-factor record is Federated and excludeFederated is true, so MayTestMappingAsync can reject a recent valid Resgrid factor within the five-minute window. Query the latest acceptable non-federated evidence or pass an exclusion filter to the repository instead of returning null after examining only the overall latest row.

if (excludeFederated && latest?.Method == (int)MfaEvidenceMethod.Federated)
				latest = await evidence.GetLatestSecondFactorAsync(user.Id, sessionKey, user.AuthenticationGeneration, cancellationToken, excludeMethods: new[] { MfaEvidenceMethod.Federated });

Prompt for LLM

File Web/Resgrid.Web/Helpers/StepUpEvidence.cs:

Line 34 to 36:

GetLatestSecondFactorUtcAsync discards all evidence when the latest second-factor record is Federated and excludeFederated is true, so MayTestMappingAsync can reject a recent valid Resgrid factor within the five-minute window. Query the latest acceptable non-federated evidence or pass an exclusion filter to the repository instead of returning null after examining only the overall latest row.

Suggested Code:

if (excludeFederated && latest?.Method == (int)MfaEvidenceMethod.Federated)
				latest = await evidence.GetLatestSecondFactorAsync(user.Id, sessionKey, user.AuthenticationGeneration, cancellationToken, excludeMethods: new[] { MfaEvidenceMethod.Federated });

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

SsoLogOn.cshtml and the listed account and shared-session views serve a PNG without meaningful alt text, explicit dimensions, lazy loading, asynchronous decoding, or a modern-format fallback. Serve WebP with a PNG fallback and include alt, width, height, loading="lazy", and decoding="async" attributes.

Kody rule violation: Serve responsive images with modern formats and lazy-load

<picture><source srcset="~/images/Resgrid_JustText.webp" type="image/webp" /><img src="~/images/Resgrid_JustText.png" width="200" height="auto" loading="lazy" decoding="async" alt="Resgrid" /></picture>

Prompt for LLM

File Web/Resgrid.Web/Views/Account/SsoLogOn.cshtml:

Line 23:

SsoLogOn.cshtml and the listed account and shared-session views serve a PNG without meaningful alt text, explicit dimensions, lazy loading, asynchronous decoding, or a modern-format fallback. Serve WebP with a PNG fallback and include alt, width, height, loading="lazy", and decoding="async" attributes.

Suggested Code:

<picture><source srcset="~/images/Resgrid_JustText.webp" type="image/webp" /><img src="~/images/Resgrid_JustText.png" width="200" height="auto" loading="lazy" decoding="async" alt="Resgrid" /></picture>

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

The empty catch block in resgrid.shared.locked.js silently swallows exceptions, preventing diagnosis and allowing failures to continue without explicit handling. Log the error with relevant context and either rethrow it or handle the failure explicitly.

Kody rule violation: Avoid empty catch blocks

Prompt for LLM

File Web/Resgrid.Web/wwwroot/js/app/common/shared/resgrid.shared.locked.js:

Line 51:

The empty catch block in resgrid.shared.locked.js silently swallows exceptions, preventing diagnosis and allowing failures to continue without explicit handling. Log the error with relevant context and either rethrow it or handle the failure explicitly.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

resgrid.shared.session.js creates an interval without retaining its ID, so the timer can survive component or page teardown. Store the interval ID and call clearInterval during teardown.

Kody rule violation: Clear timers on teardown/unmount

const intervalId = window.setInterval(tick, 1000);
// clearInterval(intervalId) during teardown

Prompt for LLM

File Web/Resgrid.Web/wwwroot/js/app/common/shared/resgrid.shared.session.js:

Line 269:

resgrid.shared.session.js creates an interval without retaining its ID, so the timer can survive component or page teardown. Store the interval ID and call clearInterval during teardown.

Suggested Code:

const intervalId = window.setInterval(tick, 1000);
// clearInterval(intervalId) during teardown

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[Resgrid-Bot]

resgrid.profile.yourdepartments.js navigates directly to the server-provided xhr.responseJSON.redirectUrl, allowing an open redirect or phishing destination. Validate the URL against an explicit trusted allowlist or same-origin policy before assigning window.location.href.

Kody rule violation: Avoid unprotected HTTP request redirections

const redirectUrl = xhr.responseJSON.redirectUrl;
if (typeof redirectUrl === 'string' && redirectUrl.startsWith(window.location.origin + '/')) {
	window.location.href = redirectUrl;
}

Prompt for LLM

File Web/Resgrid.Web/wwwroot/js/app/internal/profile/resgrid.profile.yourdepartments.js:

Line 58:

resgrid.profile.yourdepartments.js navigates directly to the server-provided xhr.responseJSON.redirectUrl, allowing an open redirect or phishing destination. Validate the URL against an explicit trusted allowlist or same-origin policy before assigning window.location.href.

Suggested Code:

const redirectUrl = xhr.responseJSON.redirectUrl;
if (typeof redirectUrl === 'string' && redirectUrl.startsWith(window.location.origin + '/')) {
	window.location.href = redirectUrl;
}

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​