SCAL-249159 ensuring the token type is a string before proceeding token validation #314

shivam-kumar-ts · 2025-09-18T15:54:16Z

Ensuring the token type is a string before proceeding token validation
Added unit tests for token type validation

mnk-blr · 2025-09-18T15:54:28Z

🎉 Snyk checks have passed. No issues have been found so far.

✅ security/snyk check is complete. No issues have been found. (View Details)

✅ license/snyk check is complete. No issues have been found. (View Details)

gemini-code-assist

Summary of Changes

Hello @shivam-kumar-ts, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request enhances the robustness of authentication token handling by implementing an early type check for the authToken parameter. It ensures that the token is always a string before any validation logic is applied, including scenarios where full token verification is disabled. This change prevents potential runtime errors caused by unexpected token types, thereby improving the overall stability and reliability of the authentication process.

Highlights

Token Type Validation: Introduced a new check in the validateAuthToken function to explicitly ensure that the authToken parameter is a string before proceeding with any further validation steps.
Robust Error Handling: If the authToken is not a string, an error message is logged using logger.error, and an Error is thrown, preventing unexpected behavior downstream.
Unconditional Type Check: This type validation is performed unconditionally, even when embedConfig.disableTokenVerification is set to true, guaranteeing basic token integrity regardless of other verification settings.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request adds a validation step to ensure that the authToken is a string before any further processing in validateAuthToken. This is a good defensive check to prevent runtime errors if the getAuthToken callback from the user returns an unexpected type. My review includes suggestions to improve the accuracy of a comment and to enhance code style and readability using modern JavaScript features.

gemini-code-assist · 2025-09-18T15:55:26Z

src/authToken.ts

+    // even if token verification is disabled, we will still validate 
+    // the token type to ensure that the token is valid and not expired


The comment on line 63 is slightly inaccurate. This check validates that the token is a string, but it doesn't ensure the token itself is 'valid and not expired'. The actual token validation (if not disabled) happens later in the function. To avoid confusion, I suggest rephrasing the comment to be more precise about what the following block does.

Suggested change

// even if token verification is disabled, we will still validate

// the token type to ensure that the token is valid and not expired

// even if token verification is disabled, we will still validate

// that the token is a string before proceeding.

gemini-code-assist · 2025-09-18T15:55:26Z

src/authToken.ts

+    if(typeof authToken !== 'string') {
+        const errorMessage = 'Expected getAuthToken to return a string, but received a ' + typeof authToken + '.';
+        logger.error(errorMessage);
+        throw new Error(errorMessage);
+    }


This block can be improved for better readability and consistency with modern JavaScript practices.

It's a common convention to have a space after the if keyword.

Using a template literal for constructing the errorMessage is more readable than string concatenation.

Additionally, for better maintainability, you could consider moving this error message to src/errors.ts by creating a function that generates this dynamic message, similar to how other errors are handled in the project.

Suggested change

if(typeof authToken !== 'string') {

const errorMessage = 'Expected getAuthToken to return a string, but received a ' + typeof authToken + '.';

logger.error(errorMessage);

throw new Error(errorMessage);

}

if (typeof authToken !== 'string') {

const errorMessage = `Expected getAuthToken to return a string, but received a ${typeof authToken}.`;

logger.error(errorMessage);

throw new Error(errorMessage);

}

pkg-pr-new · 2025-09-18T15:56:29Z

Open in StackBlitz

npm i https://pkg.pr.new/thoughtspot/visual-embed-sdk/@thoughtspot/visual-embed-sdk@314

commit: 51d37d4

… token validation

utsavkapoor · 2025-09-18T20:30:01Z

src/authToken.ts

    const cachedAuthToken = getCacheAuthToken();
+    // even if token verification is disabled, we will still validate 
+    // that the token is a string before proceeding.
+    if (typeof authToken !== 'string') {


Please write a unit test for this

sastaachar · 2025-09-19T09:36:56Z

src/errors.ts

    SDK_NOT_INITIALIZED: 'SDK not initialized',
    SESSION_INFO_FAILED: 'Failed to get session information',
    INVALID_TOKEN_ERROR: 'Received invalid token from getAuthToken callback or authToken endpoint.',
+    INVALID_TOKEN_TYPE_ERROR: 'Expected getAuthToken to return a string, but received a',


we can use template strings here 'Expected getAuthToken to return a string, but received a {invalidType}'

sastaachar · 2025-09-19T09:37:11Z

src/authToken.ts

+    // even if token verification is disabled, we will still validate 
+    // that the token is a string before proceeding.
+    if (typeof authToken !== 'string') {
+        const errorMessage = `${ERROR_MESSAGE.INVALID_TOKEN_TYPE_ERROR} ${typeof authToken}.`;


use template strings for this

…error messages

sastaachar · 2025-09-23T09:32:22Z

src/authToken.ts

    authToken: string,
    suppressAlert?: boolean,
 ): Promise<boolean> => {
    const cachedAuthToken = getCacheAuthToken();


move this line below the type check

…val after type check

sonar-prod-ts · 2025-09-23T10:17:41Z

SonarQube Quality Gate

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
0.0% Duplication

shivam-kumar-ts requested a review from a team as a code owner September 18, 2025 15:54

gemini-code-assist bot reviewed Sep 18, 2025

View reviewed changes

SCAL-249159 ensuring the token type is a string before proceeding to…

57e66f0

… token validation

shivam-kumar-ts force-pushed the SCAL-249159 branch from bf50237 to 57e66f0 Compare September 18, 2025 16:44

utsavkapoor reviewed Sep 18, 2025

View reviewed changes

shivam-kumar-ts requested a review from adityamittal3107 September 19, 2025 04:05

shivam-kumar-ts force-pushed the SCAL-249159 branch from cf38f55 to a7144d0 Compare September 19, 2025 06:16

SCAL-249159 add unit tests for token type validation

8338e32

shivam-kumar-ts force-pushed the SCAL-249159 branch from a7144d0 to 8338e32 Compare September 19, 2025 06:18

sastaachar reviewed Sep 19, 2025

View reviewed changes

SCAL-249159 refactor token type validation to use formatTemplate for …

6972fc2

…error messages

sastaachar reviewed Sep 23, 2025

View reviewed changes

SCAL-249159 Refactor validateAuthToken to move cachedAuthToken retrie…

51d37d4

…val after type check

sastaachar approved these changes Sep 23, 2025

View reviewed changes

utsavkapoor approved these changes Sep 24, 2025

View reviewed changes

shivam-kumar-ts merged commit 31d4d15 into main Sep 24, 2025
11 checks passed

		// even if token verification is disabled, we will still validate
		// the token type to ensure that the token is valid and not expired

SCAL-249159 ensuring the token type is a string before proceeding token validation #314

SCAL-249159 ensuring the token type is a string before proceeding token validation #314

Uh oh!

Conversation

shivam-kumar-ts commented Sep 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mnk-blr commented Sep 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🎉 Snyk checks have passed. No issues have been found so far.

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Sep 18, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Sep 18, 2025

Choose a reason for hiding this comment

Uh oh!

pkg-pr-new bot commented Sep 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

utsavkapoor Sep 18, 2025

Choose a reason for hiding this comment

Uh oh!

shivam-kumar-ts Sep 19, 2025

Choose a reason for hiding this comment

Uh oh!

sastaachar Sep 19, 2025

Choose a reason for hiding this comment

Uh oh!

sastaachar Sep 19, 2025

Choose a reason for hiding this comment

Uh oh!

sastaachar Sep 23, 2025

Choose a reason for hiding this comment

Uh oh!

shivam-kumar-ts Sep 23, 2025

Choose a reason for hiding this comment

Uh oh!

sonar-prod-ts bot commented Sep 23, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

shivam-kumar-ts commented Sep 18, 2025 •

edited

Loading

mnk-blr commented Sep 18, 2025 •

edited

Loading

pkg-pr-new bot commented Sep 18, 2025 •

edited

Loading