Skip to content

[NAE-2241] Anonymous access refactor#316

Open
renczesstefan wants to merge 8 commits intorelease/7.0.0-rev10from
NAE-2241
Open

[NAE-2241] Anonymous access refactor#316
renczesstefan wants to merge 8 commits intorelease/7.0.0-rev10from
NAE-2241

Conversation

@renczesstefan
Copy link
Member

@renczesstefan renczesstefan commented Feb 3, 2026

Description

Refactor and reworks anonymous access, replacing the old two way user handling with a simple one.

Implements NAE-2241

Dependencies

No new dependencies were introduced.

Third party dependencies

No new dependencies were introduced.

Blocking Pull requests

There are no dependencies on other PR.

How Has Been This Tested?

This was tested manually and with unit tests.

Test Configuration

Name Tested on
OS macOS Tahoe 26.0.1
Runtime Node 20.17.0
Dependency Manager NPM 10.8.2
Framework version Angular 13.3.1
Run parameters
Other configuration

Checklist:

  • My code follows the style guidelines of this project
  • I have performed a self-review of my own code
  • My changes have been checked, personally or remotely, with @machacjozef
  • I have commented my code, particularly in hard-to-understand areas
  • I have resolved all conflicts with the target branch of the PR
  • I have updated and synced my code with the target branch
  • I have added tests that prove my fix is effective or that my feature works
  • New and existing tests pass locally with my changes:
    • Lint test
    • Unit tests
    • Integration tests
  • I have checked my contribution with code analysis tools:
  • I have made corresponding changes to the documentation:
    • Developer documentation
    • User Guides
    • Migration Guides

Summary by CodeRabbit

  • Breaking Changes

    • Removed support for anonymous user access and related authentication flows.
  • New Features

    • Added ability to retrieve tasks across multiple cases simultaneously.
  • Improvements

    • Enhanced permission validation for private views with stricter authentication checks.
    • Reorganized public resource API endpoint paths for improved consistency.
  • Tests

    • Removed test suites for deprecated anonymous authentication services.

…ogic

Replaced 'jwtHeader' with 'anonymousTokenHeader' for better clarity in the anonymous authentication service. Introduced an `isAnonymous` method in the user model to check user anonymity. Commented out unused subscription logic in `NextGroupService` for improved maintainability.
Removed `PublicCaseResourceService`, `PublicPetriNetResourceService`, `PublicTaskResourceService`, and `PublicProcessService`, consolidating their functionality into existing services. Updated providers and API usage to eliminate redundant public service factories and streamline resource access logic.
The changes include commenting out code related to the AnonymousService and AnonymousAuthenticationInterceptor, removing anonymous-specific logic from services, tests, and configuration. This simplifies the codebase and prepares it to shift focus towards authenticated user functionality.
Changed the default role from 'ANONYMOUS_USER' to 'ANONYMOUS' in the `emptyUser` function for consistency. Adjusted the task view service to correctly retrieve the first case ID from the request body when handling anonymous users.
@renczesstefan renczesstefan self-assigned this Feb 3, 2026
@renczesstefan renczesstefan added the improvement New feature or request label Feb 3, 2026
@coderabbitai
Copy link

coderabbitai bot commented Feb 3, 2026

Walkthrough

This PR refactors anonymous user handling by removing the AnonymousService and AnonymousAuthenticationInterceptor classes, replacing service-based anonymous user management with a new isAnonymous() method on the User model. Multiple services are updated to check user anonymity directly, and several public API endpoints are restructured with modified path prefixes.

Changes

Cohort / File(s) Summary
Anonymous Service Removal
projects/netgrif-components-core/src/lib/authentication/anonymous/anonymous.service.ts, .../anonymous.service.spec.ts
Deleted AnonymousService class and its test suite, which previously managed anonymous token state via storage backends.
Anonymous Interceptor Removal
projects/netgrif-components-core/src/lib/authentication/services/anonymous-authentication-interceptor.ts, .../anonymous-authentication-interceptor.spec.ts
Removed AnonymousAuthenticationInterceptor class and tests; disabled in authentication.module.ts and public-api.ts exports.
Authentication Updates
projects/netgrif-components-core/src/lib/authentication/services/authentication-interceptor.ts
Removed AnonymousService dependency; simplified response header handling to check only sessionHeader presence.
User Model Enhancement
projects/netgrif-components-core/src/lib/user/models/user.ts
Added public isAnonymous(): boolean method that returns true when user has exactly one ANONYMOUS authority.
User Service Refactoring
projects/netgrif-components-core/src/lib/user/services/user.service.ts
Removed AnonymousService dependency, anonymous user subscription logic, and public anonymousUser$ getter; updated emptyUser() to initialize with ANONYMOUS authority.
User Preference Service Simplification
projects/netgrif-components-core/src/lib/user/services/user-preference.service.ts
Removed anonymous user subscription and conditional persistence logic; now always uses standard preference saving.
Authorization & Access Control
projects/netgrif-components-core/src/lib/authorization/permission/access.service.ts, .../public/factories/public-factory-resolver.ts
Updated access checks to use isAnonymous() method instead of service dependency or email-based detection.
Task Assignment Service
projects/netgrif-components-core/src/lib/task/services/assign-policy.service.ts
Removed race condition between anonymousUser$ and user$; now relies solely on user$ stream.
Next Group Service
projects/netgrif-components-core/src/lib/groups/services/next-group.service.ts
Removed subscription logic that auto-populated member/owner groups on user changes; cleanup removed from lifecycle hooks.
Navigation Test Updates
projects/netgrif-components-core/src/lib/navigation/navigation-tree/abstract-navigation-tree.component.spec.ts
Removed AnonymousService parameter from TestUserService constructor and super call.
Public API Endpoint Restructuring
projects/netgrif-components-core/src/lib/resources/engine-endpoint/public/public-case-resource.service.ts, .../public-petri-net-resource.service.ts
Updated public endpoint paths; removed getCaseData() method and changed base paths from public/... to .../.../public/... pattern.
Public Task Resource Expansion
projects/netgrif-components-core/src/lib/resources/engine-endpoint/public/public-task-resource.service.ts
Added getAllTasksByCases(caseIds: string[]): Observable<Page<Task>> method; refactored all public endpoints from public/task/... to task/public/... prefix.
Task Service Signature Updates
projects/netgrif-components-core/src/lib/resources/engine-endpoint/task-resource.service.ts, .../task-resource.service.spec.ts
Updated getAllTasksByCases signature from single object to array parameter; changed return type to Observable<Page<Task>>; updated test expectations.
Filter Model Extensions
projects/netgrif-components-core/src/lib/filter/models/filter.ts, .../merged-filter.ts, .../simple-filter.ts
Added abstract bodyContainsCaseId(): boolean method to Filter; implemented in SimpleFilter with case array/object validation and in MergedFilter as stub returning false.
Task View Service Updates
projects/netgrif-components-core/src/lib/view/task-view/service/task-view.service.ts, .../task-view.service.spec.ts
Modified loadPage to route anonymous users through dedicated path using getAllTasksByCases(); added test double method for the new API.
Example App & Configuration
projects/nae-example-app/src/app/app.component.ts, nae.json
Added anonymous user check in subscription filter; updated SSO refresh URL endpoint.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~50 minutes

Possibly related PRs

🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title 'NAE-2241 Anonymous access refactor' accurately reflects the main change: a comprehensive refactoring of anonymous access handling throughout the codebase by removing AnonymousService and implementing isAnonymous() checks.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

Important

Action Needed: IP Allowlist Update

If your organization protects your Git platform with IP whitelisting, please add the new CodeRabbit IP address to your allowlist:

  • 136.113.208.247/32 (new)
  • 34.170.211.100/32
  • 35.222.179.152/32

Reviews will stop working after February 8, 2026 if the new IP is not added to your allowlist.


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@coderabbitai coderabbitai bot added the Large label Feb 3, 2026
Deleted the AnonymousService, its tests, and all related references, including code for anonymous user handling and preferences. Updated configurations and removed unused or commented-out code across multiple files.
Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 17

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (3)
projects/netgrif-components-core/src/lib/user/services/user.service.ts (1)

25-90: 🧹 Nitpick | 🔵 Trivial

Remove commented-out anonymous flow blocks if deprecated.

The commented fields/subscriptions/methods add noise and risk drift. If anonymous support is gone, delete these blocks instead of keeping them commented out.

🧹 Example cleanup (apply similarly to the other anonymous blocks)
     protected _user: User;
     protected _userChange$: ReplaySubject<User>;
-    // protected _anonymousUserChange$: ReplaySubject<User>;
     protected _loginCalled: boolean;
     protected _subAuth: Subscription;
-    // protected _subAnonym: Subscription;
     private _publicLoadCalled: boolean;

Also applies to: 209-240

projects/netgrif-components-core/src/lib/user/services/user-preference.service.ts (1)

19-65: 🧹 Nitpick | 🔵 Trivial

Remove commented-out anonymous preference flow if deprecated.

If anonymous preferences are no longer supported, delete the commented fields/subscription blocks to keep the service focused.

🧹 Example cleanup (apply similarly to the other anonymous blocks)
     protected _preferencesChanged$: Subject<void>;
     protected _sub: Subscription;
-    // protected _subAnonym: Subscription;
     public _drawerWidthChanged$: Subject<number>;
-    // protected _anonym: boolean;
projects/netgrif-components-core/src/lib/authentication/authentication.module.ts (1)

9-25: 🧹 Nitpick | 🔵 Trivial

Drop commented interceptor lines if permanently removed.

If anonymous interception is fully deprecated, delete the commented import/provider to keep the module clean.

🧹 Proposed cleanup
-// import {AnonymousAuthenticationInterceptor} from './services/anonymous-authentication-interceptor';
 ...
-        // { provide: HTTP_INTERCEPTORS, useClass: AnonymousAuthenticationInterceptor, multi: true },
🤖 Fix all issues with AI agents
In
`@projects/netgrif-components-core/src/lib/authentication/anonymous/anonymous.service.spec.ts`:
- Around line 1-28: Uncomment and restore the AnonymousService unit tests so the
service has coverage: re-enable the import statements (TestBed,
NoopAnimationsModule, HttpClientTestingModule, RouterTestingModule,
AnonymousService, ConfigurationService, TestConfigurationService) and restore
the describe block that creates the TestBed, injects AnonymousService in
beforeEach, asserts expect(service).toBeTruthy() in the it('should be created')
test, and calls TestBed.resetTestingModule() in afterEach; ensure the
TestBed.configureTestingModule provides {provide: ConfigurationService,
useClass: TestConfigurationService} and imports NoopAnimationsModule,
HttpClientTestingModule and RouterTestingModule.withRoutes([]).

In
`@projects/netgrif-components-core/src/lib/authentication/anonymous/anonymous.service.ts`:
- Around line 47-49: ngOnDestroy currently always calls localStorage.removeItem
and thus ignores the resolved storage strategy; update ngOnDestroy in
AnonymousService to remove the token via the resolved storage instance/method
used elsewhere (e.g. use the same storage accessor/property used when
setting/getting the token instead of localStorage directly), and then complete
the _tokenSet as before; reference ngOnDestroy, _anonymousTokenHeader and
_tokenSet so you replace localStorage.removeItem(this._anonymousTokenHeader)
with the equivalent call on the resolved storage (or storage service) used
across the class.

In `@projects/netgrif-components-core/src/lib/authentication/public-api.ts`:
- Line 13: Remove the commented dead export in public-api.ts: delete the line
"// export * from './services/anonymous-authentication-interceptor'". This
cleans up the public API surface by removing the stale commented export
referencing the anonymous-authentication-interceptor module.

In
`@projects/netgrif-components-core/src/lib/authentication/services/anonymous-authentication-interceptor.spec.ts`:
- Around line 1-58: The test file for AnonymousAuthenticationInterceptor is
fully commented out; either delete the file if
AnonymousAuthenticationInterceptor/AnonymousService were intentionally removed
as part of the refactor, or restore the tests and add a TODO with the tracking
ticket if this is temporary. Locate the commented test that references
AnonymousAuthenticationInterceptor and AnonymousService (and related specs like
the 'intercept HTTP request' describe block) and either remove the entire file
or uncomment/restore the spec and insert a single-line TODO with the
issue/ticket ID and brief plan at the top so reviewers know why tests are
disabled.

In
`@projects/netgrif-components-core/src/lib/authentication/services/anonymous-authentication-interceptor.ts`:
- Around line 1-41: Remove the commented-out AnonymousAuthenticationInterceptor
implementation file entirely: delete the file that contains the commented class
AnonymousAuthenticationInterceptor and its related imports so the dead ~40 lines
of code are not preserved in the source tree (the code remains available in git
history if needed); no code changes elsewhere are necessary beyond removing this
file.

In
`@projects/netgrif-components-core/src/lib/authentication/services/authentication-interceptor.ts`:
- Around line 20-24: Remove the commented-out constructor parameter
_anonymousService from the AuthenticationInterceptor constructor: open the
constructor in authentication-interceptor.ts (the constructor method that
currently lists _session, _redirect, // private _anonymousService:
AnonymousService, and idleTimerService) and delete the commented line so the
constructor only declares the active dependencies (_session, _redirect,
idleTimerService).
- Line 14: Remove the dead commented import for AnonymousService from
authentication-interceptor.ts and clean up any remaining references or leftover
comments related to AnonymousService in the AuthenticationInterceptor (e.g.,
constructor parameters, private fields, or TODO comments) so the file contains
only active imports and dependencies; ensure the import block and any unused
symbols in the AuthenticationInterceptor class are cleaned up to avoid linter
warnings.

In `@projects/netgrif-components-core/src/lib/filter/models/merged-filter.ts`:
- Around line 124-129: The bodyContainsCaseId() currently returns false but
should mirror the logic used in bodyContainsQuery() by scanning the merged
filters: update bodyContainsCaseId() to iterate this._filters and return true if
any contained filter indicates a case-id (either by calling
filter.bodyContainsCaseId() if available or by checking filter.body?.case?.id),
otherwise return false; if returning false was intentional, replace the stub
with a comment explaining why merged filters can never contain case IDs.

In `@projects/netgrif-components-core/src/lib/filter/models/simple-filter.ts`:
- Around line 108-116: The bodyContainsCaseId() method currently treats a single
case object and an array of cases inconsistently: for a single object it checks
this._filter['case'].id is present and non-empty, but for an array it only
checks length > 0. Update bodyContainsCaseId() so that when this._filter['case']
is an array it returns true only if at least one element has a non-empty id
(e.g., iterate the array and validate item.id && item.id.length > 0), or if the
array-presence behavior is intentional add a clarifying comment above
bodyContainsCaseId() explaining that any non-empty array is considered valid
regardless of element ids.

In
`@projects/netgrif-components-core/src/lib/groups/services/next-group.service.ts`:
- Around line 28-37: The _memberGroups$ and _ownerGroups$ BehaviorSubjects are
never populated because the _userSub subscription was removed; restore a
population mechanism by reintroducing a subscription (e.g., recreate _userSub in
the constructor to subscribe to UserService user/group updates and update
_memberGroups$ and _ownerGroups$ accordingly) or add an explicit public
setter/method to populate those subjects that ActiveGroupService (which
subscribes to memberGroups$) can call; also re-enable ngOnDestroy to unsubscribe
_userSub to avoid leaks and ensure memberGroups$/ownerGroups$ are updated when
the authenticated user changes.

In
`@projects/netgrif-components-core/src/lib/providers/petrinet-resource/petrinet-resource-service.provider.ts`:
- Around line 3-6: Remove the redundant PetriNetResourceServiceProvider export
and any registration of it (PetriNetResourceServiceProvider) since
PetriNetResourceService is already `@Injectable`({ providedIn: 'root' }); delete
the provider object from petrinet-resource-service.provider.ts (or remove the
file) and then update all consumers (e.g.,
default-public-workflow-view.component.ts and any other files importing
PetriNetResourceServiceProvider) to stop importing the provider and instead
import/inject PetriNetResourceService directly in constructors; also remove the
provider from any providers: [...] arrays where it was added.

In
`@projects/netgrif-components-core/src/lib/providers/process-service/process-service.provider.ts`:
- Around line 3-6: The ProcessServiceProvider export is redundant because it
maps provide: ProcessService to useClass: ProcessService; remove the
ProcessServiceProvider object and update any module/provider registration sites
to use the ProcessService class directly (or delete the provider entry entirely
if the class is already provided elsewhere). Search for the symbol
ProcessServiceProvider and replace its usage with ProcessService (or remove the
registration) ensuring modules that previously imported ProcessServiceProvider
still have ProcessService available in their providers arrays or NgModule
providers.

In
`@projects/netgrif-components-core/src/lib/task/services/assign-policy.service.ts`:
- Line 58: Remove the commented-out observable from the pipeline: delete the
line containing "this._userService.anonymousUser$" in the AssignPolicyService
code so the pipeline is not cluttered with a half-removed code path; update any
nearby comments if needed to reflect the cleaned-up pipeline in methods that
reference the observable chain within assign-policy.service (look for
occurrences of this._userService and the observable pipeline).
- Around line 55-61: The current filter on this._userService.user$ uses
isUserEmpty() and will drop anonymous users, causing performAssign(taskOpened,
afterAction) to never run; update the filter to allow anonymous users through by
changing it to something like: filter(user =>
!this._userService.isUserEmpty(user) || this._userService.isAnonymous(user)) so
performAssign and the afterAction resolution run for anonymous sessions as well;
keep the take(1) and subscribe(user => this.performAssign(...)) unchanged.

In `@projects/netgrif-components-core/src/lib/user/models/user.ts`:
- Around line 63-65: The isAnonymous() method currently checks
this.authorities[0].includes('ANONYMOUS') which returns true for any authority
containing the substring 'ANONYMOUS' (e.g., 'NOT_ANONYMOUS'); change that call
to a strict equality comparison so it only returns true when the single
authority exactly equals 'ANONYMOUS' (update the check in the isAnonymous
function that inspects this.authorities[0] while keeping the length === 1
guard).

In
`@projects/netgrif-components-core/src/lib/user/services/user-preference.service.ts`:
- Around line 127-136: _savePreferences() currently always calls
_userResourceService.setPreferences which causes 401s for anonymous users;
restore the guard used when loading by checking the user/auth state (e.g.,
this._anonym or this._loggedUser && this._loggedUser.id !== '') inside
_savePreferences and call
_userResourceService.setPublicPreferences(this._preferences).subscribe(...) for
anonymous users and
_userResourceService.setPreferences(this._preferences).subscribe(...) for
authenticated users, keeping the existing resultMessage(resultMessage) handling
in both branches.

In
`@projects/netgrif-components-core/src/lib/view/task-view/service/task-view.service.ts`:
- Around line 225-228: The anonymous-user branch currently pulls only the first
case id and can throw if requestContext.filter.getRequestBody()['case'] is
missing; update the logic in the anonymous branch (the block using
this._userService.user.isAnonymous()) to: read requestBody =
requestContext.filter.getRequestBody(), guard that requestBody.case exists and
is non-empty, extract all case IDs (if case is an array map to ids, otherwise
wrap the single id into an array), short-circuit (set request to an empty
observable or handle early return) when there are no case IDs, and then call
this._taskService.getAllTasksByCases(caseIds).pipe(take(1)) with the full list;
keep existing behavior for other branches (bodyContainsQuery /
TaskEndpoint.ELASTIC).

Comment on lines 1 to 28
// import {TestBed} from '@angular/core/testing';
// import {NoopAnimationsModule} from '@angular/platform-browser/animations';
// import {HttpClientTestingModule} from '@angular/common/http/testing';
// import {RouterTestingModule} from '@angular/router/testing';
// import {AnonymousService} from './anonymous.service';
// import {ConfigurationService} from '../../configuration/configuration.service';
// import {TestConfigurationService} from '../../utility/tests/test-config';
//
// describe('AnonymousService', () => {
// let service: AnonymousService;
//
// beforeEach(() => {
// TestBed.configureTestingModule({
// imports: [NoopAnimationsModule, HttpClientTestingModule, RouterTestingModule.withRoutes([])],
// providers: [{provide: ConfigurationService, useClass: TestConfigurationService}]
// });
// service = TestBed.inject(AnonymousService);
// });
//
// it('should be created', () => {
// expect(service).toBeTruthy();
// });
//
// afterEach(() => {
// TestBed.resetTestingModule();
// });
// });
//
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Check if AnonymousService still exists and is used in the codebase

echo "=== Checking if AnonymousService class exists ==="
rg -l "class AnonymousService" --type ts

echo -e "\n=== Checking for imports/usages of AnonymousService ==="
rg -n "AnonymousService" --type ts -g '!*.spec.ts' | head -30

echo -e "\n=== Checking if anonymous.service.ts exists and its content ==="
fd "anonymous.service.ts" --type f -x cat -n {}

echo -e "\n=== Checking if the spec file is the only file commented out ==="
ls -la "projects/netgrif-components-core/src/lib/authentication/anonymous/"

Repository: netgrif/components

Length of output: 4437


Restore active tests for AnonymousService.

The AnonymousService is still active and fully implemented, but its test file is entirely commented out, leaving the service without test coverage. Restore the test suite to maintain coverage for the active service.

🤖 Prompt for AI Agents
In
`@projects/netgrif-components-core/src/lib/authentication/anonymous/anonymous.service.spec.ts`
around lines 1 - 28, Uncomment and restore the AnonymousService unit tests so
the service has coverage: re-enable the import statements (TestBed,
NoopAnimationsModule, HttpClientTestingModule, RouterTestingModule,
AnonymousService, ConfigurationService, TestConfigurationService) and restore
the describe block that creates the TestBed, injects AnonymousService in
beforeEach, asserts expect(service).toBeTruthy() in the it('should be created')
test, and calls TestBed.resetTestingModule() in afterEach; ensure the
TestBed.configureTestingModule provides {provide: ConfigurationService,
useClass: TestConfigurationService} and imports NoopAnimationsModule,
HttpClientTestingModule and RouterTestingModule.withRoutes([]).

Comment on lines 47 to 49
ngOnDestroy(): void {
localStorage.removeItem(this._jwtHeader);
localStorage.removeItem(this._anonymousTokenHeader);
this._tokenSet.complete();
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Use resolved storage in ngOnDestroy.

ngOnDestroy always clears localStorage, ignoring session/null storage settings and leaving tokens behind.

🛠️ Proposed fix
-        localStorage.removeItem(this._anonymousTokenHeader);
+        this._storage.removeItem(this._anonymousTokenHeader);
🤖 Prompt for AI Agents
In
`@projects/netgrif-components-core/src/lib/authentication/anonymous/anonymous.service.ts`
around lines 47 - 49, ngOnDestroy currently always calls localStorage.removeItem
and thus ignores the resolved storage strategy; update ngOnDestroy in
AnonymousService to remove the token via the resolved storage instance/method
used elsewhere (e.g. use the same storage accessor/property used when
setting/getting the token instead of localStorage directly), and then complete
the _tokenSet as before; reference ngOnDestroy, _anonymousTokenHeader and
_tokenSet so you replace localStorage.removeItem(this._anonymousTokenHeader)
with the equivalent call on the resolved storage (or storage service) used
across the class.

/* SERVICES */
export * from './anonymous/anonymous.service';
export * from './services/anonymous-authentication-interceptor'
// export * from './services/anonymous-authentication-interceptor'
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick | 🔵 Trivial

Remove the commented export from the public API surface.

Keeping commented exports in a public API file creates dead code and ambiguity. If this export is intentionally retired, delete it outright.

🧹 Suggested cleanup
-// export * from './services/anonymous-authentication-interceptor'
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
// export * from './services/anonymous-authentication-interceptor'
🤖 Prompt for AI Agents
In `@projects/netgrif-components-core/src/lib/authentication/public-api.ts` at
line 13, Remove the commented dead export in public-api.ts: delete the line "//
export * from './services/anonymous-authentication-interceptor'". This cleans up
the public API surface by removing the stale commented export referencing the
anonymous-authentication-interceptor module.

Comment on lines 55 to 61
if (!this._userService.isCurrentUserEmpty()) {
this.performAssign(taskOpened, afterAction);
} else {
race([
this._userService.anonymousUser$,
this._userService.user$
])
.pipe(filter(user => !this._userService.isUserEmpty(user)))
// this._userService.anonymousUser$,
this._userService.user$.pipe(filter(user => !this._userService.isUserEmpty(user)))
.pipe(take(1))
.subscribe(user => this.performAssign(taskOpened, afterAction));
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Search for method implementations in user service
rg -n --type=ts -C3 'isCurrentUserEmpty|isUserEmpty|isAnonymous' projects/netgrif-components-core/src/lib/user/services/user.service.ts

Repository: netgrif/components

Length of output: 406


🏁 Script executed:

#!/bin/bash
# Broader search for anonymous user handling
rg -n --type=ts 'isAnonymous|anonymousUser' projects/netgrif-components-core/src/lib/user -g '*.ts'

Repository: netgrif/components

Length of output: 1337


🏁 Script executed:

#!/bin/bash
# Get context around the specific lines in assign-policy.service.ts
sed -n '40,70p' projects/netgrif-components-core/src/lib/task/services/assign-policy.service.ts

Repository: netgrif/components

Length of output: 1463


🏁 Script executed:

#!/bin/bash
# Search for active (non-commented) usage of isAnonymous or anonymous user flows
rg -n --type=ts 'isAnonymous\(\)' projects/netgrif-components-core/src/lib --g='!*.ts.bak' | head -20

Repository: netgrif/components

Length of output: 467


🏁 Script executed:

#!/bin/bash
# Check if anonymousUser or anonymousUser$ is used anywhere outside comments
rg -n --type=ts 'anonymousUser' projects/netgrif-components-core/src/lib --g='!*.ts.bak' -v '^\s*//' | grep -v '//' | head -30

Repository: netgrif/components

Length of output: 467


🏁 Script executed:

#!/bin/bash
# Check the User model's isAnonymous implementation
sed -n '55,75p' projects/netgrif-components-core/src/lib/user/models/user.ts

Repository: netgrif/components

Length of output: 356


🏁 Script executed:

#!/bin/bash
# Search for where emptyUser is created and how it's structured
rg -n --type=ts 'emptyUser' projects/netgrif-components-core/src/lib/user/services/user.service.ts -A5

Repository: netgrif/components

Length of output: 926


🏁 Script executed:

#!/bin/bash
# Search for active usage of isAnonymous method calls
rg -n --type=ts 'isAnonymous\(\)' projects/netgrif-components-core/src/lib

Repository: netgrif/components

Length of output: 630


🏁 Script executed:

#!/bin/bash
# Check if there are any test files or other callers of performAssignPolicy with anonymous users
rg -n --type=ts 'performAssignPolicy' projects/netgrif-components-core/src/lib -A3

Repository: netgrif/components

Length of output: 4180


🏁 Script executed:

#!/bin/bash
# Check the broader context of how user$ is used and emitted
sed -n '150,200p' projects/netgrif-components-core/src/lib/user/services/user.service.ts

Repository: netgrif/components

Length of output: 1880


Guard against anonymous users being filtered out and stalling assignment.

The isUserEmpty() filter on line 59 will reject users with empty id and no roles, which matches the structure of emptyUser(). Since emptyUser() creates a user with authorities=['ANONYMOUS'] and is actively used throughout the codebase (task-view.service.ts, abstract-resource.service.ts, access.service.ts), anonymous sessions will have their assignment blocked indefinitely, preventing afterAction from resolving. Add an isAnonymous() check to allow anonymous users through the filter:

-            this._userService.user$.pipe(filter(user => !this._userService.isUserEmpty(user)))
+            this._userService.user$.pipe(
+                filter(user => !this._userService.isUserEmpty(user) || user?.isAnonymous?.())
+            )
                 .pipe(take(1))
                 .subscribe(user => this.performAssign(taskOpened, afterAction));
🤖 Prompt for AI Agents
In
`@projects/netgrif-components-core/src/lib/task/services/assign-policy.service.ts`
around lines 55 - 61, The current filter on this._userService.user$ uses
isUserEmpty() and will drop anonymous users, causing performAssign(taskOpened,
afterAction) to never run; update the filter to allow anonymous users through by
changing it to something like: filter(user =>
!this._userService.isUserEmpty(user) || this._userService.isAnonymous(user)) so
performAssign and the afterAction resolution run for anonymous sessions as well;
keep the take(1) and subscribe(user => this.performAssign(...)) unchanged.

this._userService.user$
])
.pipe(filter(user => !this._userService.isUserEmpty(user)))
// this._userService.anonymousUser$,
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick | 🔵 Trivial

Remove commented-out observable from the pipeline.

The commented anonymousUser$ in Line 58 adds noise and suggests a half-removed code path. Please delete it.

🤖 Prompt for AI Agents
In
`@projects/netgrif-components-core/src/lib/task/services/assign-policy.service.ts`
at line 58, Remove the commented-out observable from the pipeline: delete the
line containing "this._userService.anonymousUser$" in the AssignPolicyService
code so the pipeline is not cluttered with a half-removed code path; update any
nearby comments if needed to reflect the cleaned-up pipeline in methods that
reference the observable chain within assign-policy.service (look for
occurrences of this._userService and the observable pipeline).

Comment on lines +63 to +65
public isAnonymous(): boolean {
return this.authorities.length === 1 && this.authorities[0].includes('ANONYMOUS');
}
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

cat -n projects/netgrif-components-core/src/lib/user/models/user.ts | head -100

Repository: netgrif/components

Length of output: 2166


🏁 Script executed:

rg -n "authorities" projects/netgrif-components-core/src/lib/user/models/user.ts -B2 -A2

Repository: netgrif/components

Length of output: 420


🏁 Script executed:

rg -n -i "ANONYMOUS" projects/netgrif-components-core --type ts -C2 | head -60

Repository: netgrif/components

Length of output: 6318


🏁 Script executed:

rg -n "isAnonymous" projects/netgrif-components-core --type ts -B2 -A2

Repository: netgrif/components

Length of output: 2757


🏁 Script executed:

rg -n "emptyUser" projects/netgrif-components-core/src/lib/user --type ts -A10

Repository: netgrif/components

Length of output: 4639


🏁 Script executed:

rg -n "ROLE_ANONYMOUS\|'ANONYMOUS'" projects/netgrif-components-core --type ts -B2 -A2

Repository: netgrif/components

Length of output: 44


🏁 Script executed:

rg -n "authorities.*=" projects/netgrif-components-core/src/lib/user --type ts -B2 -A2 | head -60

Repository: netgrif/components

Length of output: 1887


Change includes() to strict equality check for correctness.

The authorities parameter is always initialized (never null), but the includes() method incorrectly matches any authority containing 'ANONYMOUS' as a substring. For example, 'NOT_ANONYMOUS' would incorrectly return true. Since the system only uses the exact value 'ANONYMOUS', use strict equality instead.

Recommended fix
 public isAnonymous(): boolean {
-    return this.authorities.length === 1 && this.authorities[0].includes('ANONYMOUS');
+    return this.authorities.length === 1 && this.authorities[0] === 'ANONYMOUS';
 }
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
public isAnonymous(): boolean {
return this.authorities.length === 1 && this.authorities[0].includes('ANONYMOUS');
}
public isAnonymous(): boolean {
return this.authorities.length === 1 && this.authorities[0] === 'ANONYMOUS';
}
🤖 Prompt for AI Agents
In `@projects/netgrif-components-core/src/lib/user/models/user.ts` around lines 63
- 65, The isAnonymous() method currently checks
this.authorities[0].includes('ANONYMOUS') which returns true for any authority
containing the substring 'ANONYMOUS' (e.g., 'NOT_ANONYMOUS'); change that call
to a strict equality comparison so it only returns true when the single
authority exactly equals 'ANONYMOUS' (update the check in the isAnonymous
function that inspects this.authorities[0] while keeping the length === 1
guard).

Comment on lines 127 to 136
protected _savePreferences(): void {
if (!this._anonym) {
// if (!this._anonym) {
this._userResourceService.setPreferences(this._preferences).subscribe(resultMessage => {
this.resultMessage(resultMessage);
});
} else {
this._userResourceService.setPublicPreferences(this._preferences).subscribe(resultMessage => {
this.resultMessage(resultMessage);
});
}
// } else {
// this._userResourceService.setPublicPreferences(this._preferences).subscribe(resultMessage => {
// this.resultMessage(resultMessage);
// });
// }
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

# First, let's look at the full file to understand the context
wc -l projects/netgrif-components-core/src/lib/user/services/user-preference.service.ts

Repository: netgrif/components

Length of output: 147


🏁 Script executed:

# Get the full _savePreferences method and surrounding context
sed -n '120,145p' projects/netgrif-components-core/src/lib/user/services/user-preference.service.ts

Repository: netgrif/components

Length of output: 1132


🏁 Script executed:

# Check if setPublicPreferences is still referenced anywhere
rg "setPublicPreferences" projects/netgrif-components-core/

Repository: netgrif/components

Length of output: 439


🏁 Script executed:

# Look for isEmpty or isAnonymous methods in UserService
fd -e ts "user.service.ts" projects/netgrif-components-core/ | head -5

Repository: netgrif/components

Length of output: 214


🏁 Script executed:

# Let's examine the UserService to understand anonymous user detection
cat -n projects/netgrif-components-core/src/lib/user/services/user.service.ts | head -100

Repository: netgrif/components

Length of output: 4759


🏁 Script executed:

# Check the entire user-preference.service.ts file to understand _anonym
cat -n projects/netgrif-components-core/src/lib/user/services/user-preference.service.ts

Repository: netgrif/components

Length of output: 6813


🏁 Script executed:

# Look for isEmpty or isAnonymous in User model
rg "isEmpty|isAnonymous" projects/netgrif-components-core/ -A 2 -B 2

Repository: netgrif/components

Length of output: 19457


Add guard for non-authenticated users before saving preferences.

The code removed anonymous user handling but left _savePreferences() unguarded. While loading preferences checks if (loggedUser && loggedUser.id !== ''), saving always calls the authenticated endpoint regardless of user state. If an anonymous or empty user calls preference setters (e.g., setTaskFilters, setLocale, drawerWidth), they'll receive 401 errors.

Suggested guard
     protected _savePreferences(): void {
+        const user = this._userService.user;
+        if (!user || user.isEmpty() || user.isAnonymous()) {
+            return;
+        }
         this._userResourceService.setPreferences(this._preferences).subscribe(resultMessage => {
             this.resultMessage(resultMessage);
         });
     }
🤖 Prompt for AI Agents
In
`@projects/netgrif-components-core/src/lib/user/services/user-preference.service.ts`
around lines 127 - 136, _savePreferences() currently always calls
_userResourceService.setPreferences which causes 401s for anonymous users;
restore the guard used when loading by checking the user/auth state (e.g.,
this._anonym or this._loggedUser && this._loggedUser.id !== '') inside
_savePreferences and call
_userResourceService.setPublicPreferences(this._preferences).subscribe(...) for
anonymous users and
_userResourceService.setPreferences(this._preferences).subscribe(...) for
authenticated users, keeping the existing resultMessage(resultMessage) handling
in both branches.

Comment on lines 225 to 228
if (this._userService.user.isAnonymous()) {
const caseIds = Array.isArray(requestContext.filter.getRequestBody()['case']) ? requestContext.filter.getRequestBody()['case'][0].id : [requestContext.filter.getRequestBody()['case'].id];
request = this._taskService.getAllTasksByCases(caseIds).pipe(take(1));
} else if (requestContext.filter.bodyContainsQuery() || this._preferredEndpoint === TaskEndpoint.ELASTIC) {
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Fix multi-case handling and guard missing case in request body.

For array inputs, only the first case ID is used, so tasks from the remaining cases are silently dropped. Also, direct indexing can throw when case is absent, and an empty caseIds can cause unintended fetch behavior. Prefer extracting all IDs and short-circuiting on missing data.

🛠️ Proposed fix (extract all IDs + guard missing/empty)
-        if (this._userService.user.isAnonymous()) {
-            const caseIds = Array.isArray(requestContext.filter.getRequestBody()['case']) ? requestContext.filter.getRequestBody()['case'][0].id : [requestContext.filter.getRequestBody()['case'].id];
-            request = this._taskService.getAllTasksByCases(caseIds).pipe(take(1));
+        if (this._userService.user.isAnonymous()) {
+            const body = requestContext.filter.getRequestBody?.() ?? {};
+            const caseParam = body['case'];
+            const caseIds = Array.isArray(caseParam)
+                ? caseParam.map(c => c?.id).filter(id => id !== undefined && id !== null)
+                : (caseParam?.id !== undefined && caseParam?.id !== null ? [caseParam.id] : []);
+            if (caseIds.length === 0) {
+                request = of({content: [], pagination: {...this._pagination}});
+            } else {
+                request = this._taskService.getAllTasksByCases(caseIds).pipe(take(1));
+            }
         } else if (requestContext.filter.bodyContainsQuery() || this._preferredEndpoint === TaskEndpoint.ELASTIC) {
🤖 Prompt for AI Agents
In
`@projects/netgrif-components-core/src/lib/view/task-view/service/task-view.service.ts`
around lines 225 - 228, The anonymous-user branch currently pulls only the first
case id and can throw if requestContext.filter.getRequestBody()['case'] is
missing; update the logic in the anonymous branch (the block using
this._userService.user.isAnonymous()) to: read requestBody =
requestContext.filter.getRequestBody(), guard that requestBody.case exists and
is non-empty, extract all case IDs (if case is an array map to ids, otherwise
wrap the single id into an array), short-circuit (set request to an empty
observable or handle early return) when there are no case IDs, and then call
this._taskService.getAllTasksByCases(caseIds).pipe(take(1)) with the full list;
keep existing behavior for other branches (bodyContainsQuery /
TaskEndpoint.ELASTIC).

Deleted the AnonymousService, its tests, and all related references, including code for anonymous user handling and preferences. Updated configurations and removed unused or commented-out code across multiple files.
Implemented a new method in PublicTaskResource to retrieve tasks using case IDs. Refactored authentication logic by replacing anonymous user checks with `isAnonymous()` and removed unused AnonymousService. Updated API endpoint configurations to use a consistent base URL and improved code clarity.
Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 5

🤖 Fix all issues with AI agents
In
`@projects/netgrif-components-core/src/lib/navigation/navigation-tree/abstract-navigation-tree.component.spec.ts`:
- Around line 398-400: Remove the commented-out parameter "anonymousService"
from the constructor signature and any related commented code; update the
constructor declaration that currently shows "// anonymousService:
AnonymousService," so it only lists the real parameters (e.g., authService,
config) and ensure the corresponding super(...) call in the test still matches
the actual parameters passed to the parent constructor (authService,
userResource, userTransform, log, session, config) in the spec for the class
under test.

In
`@projects/netgrif-components-core/src/lib/resources/engine-endpoint/public/public-case-resource.service.ts`:
- Around line 19-26: The JSDoc for createCase is incorrect: update the comment
block above the public createCase(body: object):
Observable<EventOutcomeMessageResource> method to reflect the actual endpoint
used by _resourceProvider.post$('workflow/public/case/', this.SERVER_URL, body)
(e.g., show {{baseUrl}}/api/workflow/public/case or similar exact path including
the "public" segment), so the doc matches the SERVER_URL +
'workflow/public/case/' call.

In
`@projects/netgrif-components-core/src/lib/resources/engine-endpoint/public/public-petri-net-resource.service.ts`:
- Around line 54-60: Update the JSDoc request URL comments to match the
implemented public endpoints by adding the "/public" segment (e.g., change
"petrinet/search" to "petrinet/public/search"); apply the same fix for
getPetriNetRoles, getPetriNetTransactions, getDataPetriNet, and
getPetriNetTransitions so their doc comments reflect
"petrinet/public/{id}/roles", "petrinet/public/{id}/transactions",
"petrinet/public/data", and "petrinet/public/transitions" respectively (look for
the comment blocks above searchPetriNets, getPetriNetRoles,
getPetriNetTransactions, getDataPetriNet, and getPetriNetTransitions and update
the Request URL lines).

In
`@projects/netgrif-components-core/src/lib/resources/engine-endpoint/public/public-task-resource.service.ts`:
- Around line 61-68: The JSDoc for getAllTasksByCases wrongly states "GET" while
the implementation uses POST and the method uses the wrong service variable;
update the doc comment to "POST" (or remove the verb) and change the call from
this._resourceProvider.post$(...) to this._provider.post$(...) so it matches
other POST methods like setData and getTasks and preserves consistent usage of
_provider and SERVER_URL; keep the rest of the mapping to
this.getResourcePage<Task>(r, 'tasks') unchanged.

In
`@projects/netgrif-components-core/src/lib/view/task-view/service/task-view.service.spec.ts`:
- Line 92: Remove the debug console.log call left in the unit test: delete the
console.log(service) statement found in task-view.service.spec.ts (near the test
that constructs the TaskViewService instance, e.g., where the variable service
is initialized in the describe/it block). Ensure no other stray console.* debug
lines remain in the file.

Comment on lines +398 to +400
// anonymousService: AnonymousService,
config: ConfigurationService) {
super(authService, userResource, userTransform, log, session, anonymousService, config);
super(authService, userResource, userTransform, log, session, config);
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick | 🔵 Trivial

Remove commented-out code instead of leaving it in place.

The anonymousService parameter on line 398 should be deleted entirely rather than commented out. Leaving dead code as comments clutters the codebase and creates maintenance burden, especially since version control already preserves the history.

♻️ Suggested cleanup
 `@Injectable`()
 class TestUserService extends UserService {

     constructor(authService: AuthenticationService,
                 userResource: UserResourceService,
                 userTransform: UserTransformer,
                 log: LoggerService,
                 session: SessionService,
-                // anonymousService: AnonymousService,
                 config: ConfigurationService) {
         super(authService, userResource, userTransform, log, session, config);
     }
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
// anonymousService: AnonymousService,
config: ConfigurationService) {
super(authService, userResource, userTransform, log, session, anonymousService, config);
super(authService, userResource, userTransform, log, session, config);
config: ConfigurationService) {
super(authService, userResource, userTransform, log, session, config);
🤖 Prompt for AI Agents
In
`@projects/netgrif-components-core/src/lib/navigation/navigation-tree/abstract-navigation-tree.component.spec.ts`
around lines 398 - 400, Remove the commented-out parameter "anonymousService"
from the constructor signature and any related commented code; update the
constructor declaration that currently shows "// anonymousService:
AnonymousService," so it only lists the real parameters (e.g., authService,
config) and ensure the corresponding super(...) call in the test still matches
the actual parameters passed to the parent constructor (authService,
userResource, userTransform, log, session, config) in the spec for the class
under test.

Comment on lines 19 to 26
/**
* Create new case
* POST
* {{baseUrl}}/api/workflow/case
*/
public createCase(body: object): Observable<EventOutcomeMessageResource> {
return this._resourceProvider.post$('public/case/', this.SERVER_URL, body)
return this._resourceProvider.post$('workflow/public/case/', this.SERVER_URL, body)
.pipe(map(r => this.changeType(r, undefined)));
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick | 🔵 Trivial

JSDoc comment is inconsistent with the actual endpoint.

The comment states {{baseUrl}}/api/workflow/case but the actual endpoint used is workflow/public/case/. Update the documentation to reflect the correct path.

📝 Suggested documentation fix
     /**
      * Create new case
      * POST
-     * {{baseUrl}}/api/workflow/case
+     * {{baseUrl}}/api/workflow/public/case/
      */
     public createCase(body: object): Observable<EventOutcomeMessageResource> {
         return this._resourceProvider.post$('workflow/public/case/', this.SERVER_URL, body)
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
/**
* Create new case
* POST
* {{baseUrl}}/api/workflow/case
*/
public createCase(body: object): Observable<EventOutcomeMessageResource> {
return this._resourceProvider.post$('public/case/', this.SERVER_URL, body)
return this._resourceProvider.post$('workflow/public/case/', this.SERVER_URL, body)
.pipe(map(r => this.changeType(r, undefined)));
/**
* Create new case
* POST
* {{baseUrl}}/api/workflow/public/case/
*/
public createCase(body: object): Observable<EventOutcomeMessageResource> {
return this._resourceProvider.post$('workflow/public/case/', this.SERVER_URL, body)
.pipe(map(r => this.changeType(r, undefined)));
🤖 Prompt for AI Agents
In
`@projects/netgrif-components-core/src/lib/resources/engine-endpoint/public/public-case-resource.service.ts`
around lines 19 - 26, The JSDoc for createCase is incorrect: update the comment
block above the public createCase(body: object):
Observable<EventOutcomeMessageResource> method to reflect the actual endpoint
used by _resourceProvider.post$('workflow/public/case/', this.SERVER_URL, body)
(e.g., show {{baseUrl}}/api/workflow/public/case or similar exact path including
the "public" segment), so the doc matches the SERVER_URL +
'workflow/public/case/' call.

Comment on lines 54 to 60
* **Request URL:** {{baseUrl}}/api/petrinet/search
*/
public searchPetriNets(body: PetriNetRequestBody, params?: Params): Observable<Page<PetriNetReference>> {
return this._resourceProvider.post$('public/petrinet/search', this.SERVER_URL, body, params)
return this._resourceProvider.post$('petrinet/public/search', this.SERVER_URL, body, params)
// .pipe(map(r => this.getResourcePage<PetriNetReference>(r, 'petriNetReferences')));
.pipe(map(r => this.mapToPage<PetriNetReference>(r)));
}
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Documentation comments not updated to include /public segment.

Several doc comments still show the old non-public paths while the implementations were correctly updated to include /public:

Method Doc Comment Actual Implementation
searchPetriNets petrinet/search petrinet/public/search
getPetriNetRoles petrinet/{id}/roles petrinet/public/{id}/roles
getPetriNetTransactions petrinet/{id}/transactions petrinet/public/{id}/transactions
getDataPetriNet petrinet/data petrinet/public/data
getPetriNetTransitions petrinet/transitions petrinet/public/transitions
Proposed fix for documentation comments
     /**
      * search PetriNets
      *
      * **Request Type:** POST
      *
-     * **Request URL:** {{baseUrl}}/api/petrinet/search
+     * **Request URL:** {{baseUrl}}/api/petrinet/public/search
      */
     public searchPetriNets(body: PetriNetRequestBody, params?: Params): Observable<Page<PetriNetReference>> {

     /**
      * Get Roles References Using
      *
      * **Request Type:** GET
      *
-     * **Request URL:** {{baseUrl}}/api/petrinet/{id}/roles
+     * **Request URL:** {{baseUrl}}/api/petrinet/public/{id}/roles
      */
     public getPetriNetRoles(netId: string, params?: Params): Observable<RolesAndPermissions> {

     /**
      * Get Transaction References Using
      *
      * **Request Type:** GET
      *
-     * **Request URL:** {{baseUrl}}/api/petrinet/{id}/transactions
+     * **Request URL:** {{baseUrl}}/api/petrinet/public/{id}/transactions
      */
     public getPetriNetTransactions(netId: string, params?: Params): Observable<Array<Transaction>> {

     /**
      * Get Data Field References Using
      *
      * **Request Type:** POST
      *
-     * **Request URL:** {{baseUrl}}/api/petrinet/data
+     * **Request URL:** {{baseUrl}}/api/petrinet/public/data
      */
     public getDataPetriNet(body: object): Observable<any> {

     /**
      * Get Transition References Using
      *
      * **Request Type:** GET
      *
-     * **Request URL:** {{baseUrl}}/api/petrinet/transitions
+     * **Request URL:** {{baseUrl}}/api/petrinet/public/transitions
      */
     public getPetriNetTransitions(netId: string): Observable<Array<Transition>> {

Also applies to: 67-72, 79-84, 91-96, 103-108

🤖 Prompt for AI Agents
In
`@projects/netgrif-components-core/src/lib/resources/engine-endpoint/public/public-petri-net-resource.service.ts`
around lines 54 - 60, Update the JSDoc request URL comments to match the
implemented public endpoints by adding the "/public" segment (e.g., change
"petrinet/search" to "petrinet/public/search"); apply the same fix for
getPetriNetRoles, getPetriNetTransactions, getDataPetriNet, and
getPetriNetTransitions so their doc comments reflect
"petrinet/public/{id}/roles", "petrinet/public/{id}/transactions",
"petrinet/public/data", and "petrinet/public/transitions" respectively (look for
the comment blocks above searchPetriNets, getPetriNetRoles,
getPetriNetTransactions, getDataPetriNet, and getPetriNetTransitions and update
the Request URL lines).

Comment on lines 61 to +68
/**
* Get tasks of the case
* GET
*/
// {{baseUrl}}/api/public/task/case/:id
public getAllTasksByCases(caseIds: string[]): Observable<Page<Task>> {
return this._resourceProvider.post$('task/public/case', this.SERVER_URL, caseIds)
.pipe(map(r => this.getResourcePage<Task>(r, 'tasks')));
}
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# First, locate the file and check its parent class
file_path="projects/netgrif-components-core/src/lib/resources/engine-endpoint/public/public-task-resource.service.ts"

# Check if file exists and show its class declaration
echo "=== File class structure ==="
head -20 "$file_path"

echo ""
echo "=== Checking parent class ==="
grep -n "extends\|class" "$file_path" | head -5

echo ""
echo "=== Provider field usage in this file ==="
grep -n "_provider\.\|_resourceProvider\." "$file_path" | head -20

Repository: netgrif/components

Length of output: 2514


🏁 Script executed:

#!/bin/bash
# Check the parent class TaskResourceService definition
parent_class_path="projects/netgrif-components-core/src/lib/resources/engine-endpoint/task-resource.service.ts"

echo "=== Parent class definition ==="
head -100 "$parent_class_path" | tail -80

echo ""
echo "=== Looking for _provider and _resourceProvider field definitions ==="
grep -n "protected\|private" "$parent_class_path" | grep -E "_provider|_resourceProvider"

echo ""
echo "=== Checking method signatures in parent class for post$ and get$ ==="
grep -n "\.post$\|\.get$\|\.getBlob$\|\.postWithEvent$\|\.delete$" "$parent_class_path" | head -30

Repository: netgrif/components

Length of output: 2995


🏁 Script executed:

#!/bin/bash
# Check the AbstractResourceService parent class
echo "=== Finding AbstractResourceService ==="
find projects -name "*abstract-resource*" -type f

echo ""
echo "=== Checking AbstractResourceService definition ==="
cat projects/netgrif-components-core/src/lib/resources/abstract/abstract-resource.service.ts | head -100

Repository: netgrif/components

Length of output: 493


🏁 Script executed:

#!/bin/bash
# Check the correct path for AbstractResourceService
file_path="projects/netgrif-components-core/src/lib/resources/abstract-endpoint/abstract-resource.service.ts"

echo "=== AbstractResourceService definition ==="
head -150 "$file_path"

echo ""
echo "=== Looking for _provider and _resourceProvider field declarations ==="
grep -n "protected\|private" "$file_path" | grep -E "_provider|_resourceProvider"

Repository: netgrif/components

Length of output: 4596


🏁 Script executed:

#!/bin/bash
# Check the PublicTaskResourceService constructor and field definitions
file_path="projects/netgrif-components-core/src/lib/resources/engine-endpoint/public/public-task-resource.service.ts"

echo "=== PublicTaskResourceService constructor and fields ==="
sed -n '1,40p' "$file_path"

echo ""
echo "=== Full constructor section ==="
sed -n '20,35p' "$file_path"

echo ""
echo "=== Check for any field declarations in the class ==="
grep -n "protected\|private" "$file_path" | head -20

Repository: netgrif/components

Length of output: 2805


Documentation comment incorrectly states GET; method uses POST. Additionally, use _provider.post$ for consistency with similar POST methods.

The doc comment says "GET" but the implementation uses this._resourceProvider.post$(). More importantly, this method inconsistently uses _resourceProvider while other POST methods in the same class (setData at line 101 and getTasks at line 124) use _provider.post$. For consistency with similar operations, this should use _provider.

Proposed fix
     /**
      * Get tasks of the case
-     * GET
+     * POST
      */
     public getAllTasksByCases(caseIds: string[]): Observable<Page<Task>> {
-        return this._resourceProvider.post$('task/public/case', this.SERVER_URL, caseIds)
+        return this._provider.post$('task/public/case', this.SERVER_URL, caseIds)
             .pipe(map(r => this.getResourcePage<Task>(r, 'tasks')));
     }
🤖 Prompt for AI Agents
In
`@projects/netgrif-components-core/src/lib/resources/engine-endpoint/public/public-task-resource.service.ts`
around lines 61 - 68, The JSDoc for getAllTasksByCases wrongly states "GET"
while the implementation uses POST and the method uses the wrong service
variable; update the doc comment to "POST" (or remove the verb) and change the
call from this._resourceProvider.post$(...) to this._provider.post$(...) so it
matches other POST methods like setData and getTasks and preserves consistent
usage of _provider and SERVER_URL; keep the rest of the mapping to
this.getResourcePage<Task>(r, 'tasks') unchanged.

it('should process second filter change before first filter call returns', fakeAsync(() => {
let tasks: Array<TaskPanelData>;

console.log(service);
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Remove debug console.log statement.

This appears to be a debug artifact that should be removed before merging.

🧹 Proposed fix
-        console.log(service);
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
console.log(service);
🤖 Prompt for AI Agents
In
`@projects/netgrif-components-core/src/lib/view/task-view/service/task-view.service.spec.ts`
at line 92, Remove the debug console.log call left in the unit test: delete the
console.log(service) statement found in task-view.service.spec.ts (near the test
that constructs the TaskViewService instance, e.g., where the variable service
is initialized in the describe/it block). Ensure no other stray console.* debug
lines remain in the file.

@sonarqubecloud
Copy link

sonarqubecloud bot commented Feb 4, 2026

Quality Gate Failed Quality Gate failed

Failed conditions
23.8% Coverage on New Code (required ≥ 50%)
3.3% Duplication on New Code (required ≤ 3%)

See analysis details on SonarQube Cloud

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

improvement New feature or request Large

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant