Add Civil ID S3 recovery audit helper#89
Conversation
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThis pull request adds infrastructure for Phase 8 of Civil ID S3 recovery: documentation and tooling to audit offline Civil ID file status. The audit tool classifies candidates as present, recoverable from legacy storage, recoverable from a temporary bucket, or missing, and outputs findings as Markdown or CSV with optional AWS copy commands. ChangesCivil ID S3 Recovery Audit
🎯 2 (Simple) | ⏱️ ~12 minutes
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@tools/audit-civil-id-s3-objects.mjs`:
- Around line 34-43: The CLI currently accepts any --<key> which allows typos to
silently add unexpected options; update the argument parsing block that builds
args (the branch handling arg.startsWith('--') which extracts key and sets
args[key]) to validate the computed key against an explicit allowlist of
permitted flag names (e.g., a Set or array of allowed keys) and throw a clear
Error when an unknown flag is encountered; ensure this validation occurs before
assigning args[key] and incrementing i so unknown flags fail fast.
In `@tools/check-civil-id-s3-audit.mjs`:
- Around line 9-10: Replace usage of URL.pathname with Node's fileURLToPath to
get a proper filesystem path: derive the current module file path from
import.meta.url via fileURLToPath (and dirname if needed) to compute root, then
use path.join to build script; update the symbols root and script (currently
created from new URL('..', import.meta.url).pathname and join(root,
'tools/audit-civil-id-s3-objects.mjs')) so they use
fileURLToPath(import.meta.url) (and path.dirname) before join to ensure Windows
and encoded-character safe paths.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 6078ecf3-2fde-4acb-a5a5-fc8b349b3ad3
📒 Files selected for processing (3)
docs/civil-id-s3-recovery-audit.mdtools/audit-civil-id-s3-objects.mjstools/check-civil-id-s3-audit.mjs
|
Addressed the CodeRabbit feedback in
Verification run locally:
The repository wrapper |
1 participant
/claim #55
Summary
Scope
This is a separate Phase 8 audit/recovery helper slice. It does not overlap with the open Civil ID backend/frontend fixes, S3 credential rotation, IAM policy changes, n8n audit, CloudTrail export, bucket guardrail, or secret-scanning PRs.
No live AWS/IAM/S3 calls were made. No key rotation, deletion, bucket policy change, candidate record export, real S3 inventory, or credential material is included.
Verification
node tools/check-civil-id-s3-audit.mjsnode --check tools/audit-civil-id-s3-objects.mjsnode --check tools/check-civil-id-s3-audit.mjsgit diff --checkThe repo's documented full suite command currently fails before test bootstrap because
run-tests.shinvokesdocker-composewithout a compose file, while this checkout only includes named compose files such asdocker-compose-local.yml,docker-compose-dev.yml, anddocker-compose-prod.yml.Summary by CodeRabbit
Documentation
New Features