Conversation
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 15 minutes and 13 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThis PR introduces an Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~22 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Signed-off-by: RafaelJohn9 <rafaeljohb@gmail.com>
…ack initial password values. Signed-off-by: RafaelJohn9 <rafaeljohb@gmail.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
mpesakit/services/__init__.py (1)
1-1: Keep__all__in sync with the new facade.
AsyncB2BServiceis imported on Line 1, but it is still missing from__all__. If this is meant to be a supported package-level export, wildcard imports and any tooling that relies on the package export list will miss it.📦 Suggested update
__all__ = [ + "AsyncB2BService", "B2BService", "B2CService", "BalanceService",Also applies to: 13-25
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@mpesakit/services/__init__.py` at line 1, The package exports list __all__ is missing the newly imported AsyncB2BService, so update the module-level __all__ to include both B2BService and AsyncB2BService; locate the import of AsyncB2BService in mpesakit/services/__init__.py and add "AsyncB2BService" to the __all__ sequence (alongside "B2BService") so wildcard imports and tooling correctly expose the new facade.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@mpesakit/mpesa_express/schemas.py`:
- Line 92: Bandit flags the placeholder secret in the schema examples (the
"Password" key with value "B64_ENCODED_PASSWORD" and the other example at the
same pattern near line ~502) as B105; mark these example literal values as false
positives by appending a targeted inline suppression comment (# nosec B105) to
the lines containing the placeholder strings (e.g., the "Password":
"B64_ENCODED_PASSWORD" entry) so Bandit skips them, and apply the same inline #
nosec B105 to the other corresponding example entry mentioned in the review.
In `@tests/unit/services/test_b2b_service.py`:
- Around line 172-177: The fixture mock_async_http_client is defined inside
test_b2b_service_initializes_services_correctly so pytest won't register it;
move the `@pytest.fixture` def mock_async_http_client(...) (the
MagicMock(spec=HttpClient) with client.post = AsyncMock()) out of that test and
dedent it to module scope (or remove it entirely if unnecessary) so pytest can
discover and use it for other tests.
- Around line 309-317: The test's hasattr checks use public names that
AsyncB2BService doesn't set, so the wiring assertions are skipped; update the
test to inspect the actual stored delegate attributes (_express_checkout,
_business_paybill, _business_buygoods) or use getattr(service,
"_express_checkout", None) etc., then assert that each delegate's http_client
equals mock_async_http_client and token_manager equals mock_async_token_manager
(replace the three hasattr(..._service) blocks with checks against these private
attribute names or direct getattr assertions).
---
Nitpick comments:
In `@mpesakit/services/__init__.py`:
- Line 1: The package exports list __all__ is missing the newly imported
AsyncB2BService, so update the module-level __all__ to include both B2BService
and AsyncB2BService; locate the import of AsyncB2BService in
mpesakit/services/__init__.py and add "AsyncB2BService" to the __all__ sequence
(alongside "B2BService") so wildcard imports and tooling correctly expose the
new facade.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 465eb510-f536-4479-a1a2-9cab115048c9
📒 Files selected for processing (5)
mpesakit/mpesa_express/schemas.pympesakit/services/__init__.pympesakit/services/b2b.pypyproject.tomltests/unit/services/test_b2b_service.py
mpesakit/mpesa_express/schemas.py
Outdated
| "example": { | ||
| "BusinessShortCode": 654321, | ||
| "Password": "bXlwYXNzd29yZA==", | ||
| "Password": "B64_ENCODED_PASSWORD", |
There was a problem hiding this comment.
Bandit will keep failing on these schema examples.
The security job is already flagging both lines as B105, so this placeholder swap still blocks the PR even though the values are only documentation examples. Add a targeted # nosec B105 here, or move these examples out of Bandit's scan path.
🔧 Minimal fix
- "Password": "B64_ENCODED_PASSWORD",
+ "Password": "B64_ENCODED_PASSWORD", # nosec B105 - schema example
...
- "Password": "B64_ENCODED_PASSWORD",
+ "Password": "B64_ENCODED_PASSWORD", # nosec B105 - schema exampleAlso applies to: 502-502
🧰 Tools
🪛 GitHub Actions: Code Quality
[error] 92-92: Bandit (B105: hardcoded_password_string) found a possible hardcoded password string 'B64_ENCODED_PASSWORD' (CWE-259).
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@mpesakit/mpesa_express/schemas.py` at line 92, Bandit flags the placeholder
secret in the schema examples (the "Password" key with value
"B64_ENCODED_PASSWORD" and the other example at the same pattern near line ~502)
as B105; mark these example literal values as false positives by appending a
targeted inline suppression comment (# nosec B105) to the lines containing the
placeholder strings (e.g., the "Password": "B64_ENCODED_PASSWORD" entry) so
Bandit skips them, and apply the same inline # nosec B105 to the other
corresponding example entry mentioned in the review.
1 participant
Description
fixes #72
Type of Change
How Has This Been Tested?
Checklist
Screenshots (if applicable)
Additional Context
Summary by CodeRabbit
New Features
Chores