Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 11 additions & 8 deletions backend/app/api/endpoints/analyses.py
Original file line number Diff line number Diff line change
Expand Up @@ -588,7 +588,9 @@ async def get_analysis(

if not analysis:
# Get the most recent analysis for this user to suggest as alternative
most_recent = db.query(Analysis).filter(
most_recent = db.query(Analysis).options(
load_only(Analysis.id, Analysis.uuid)
).filter(
Analysis.user_id == current_user.id,
Analysis.status == "completed"
).order_by(Analysis.created_at.desc()).first()
Expand Down Expand Up @@ -670,14 +672,15 @@ def get_member_surveys(analysis: Analysis, db: Session) -> dict:
analysis_end_date = datetime.now(timezone.utc)
analysis_start_date = analysis.created_at - timedelta(days=analysis.time_range or 30)

# Query 1: Get all team member emails
# Query 1: Get all team member emails (select only email column to avoid loading full objects)
# SECURITY: Explicitly check IS NOT NULL for defense-in-depth
correlations = db.query(UserCorrelation).filter(
UserCorrelation.organization_id == analysis.organization_id,
UserCorrelation.organization_id.isnot(None)
).all()

member_emails = [c.email for c in correlations if c.email]
member_emails = [
row[0] for row in db.query(UserCorrelation.email).filter(
UserCorrelation.organization_id == analysis.organization_id,
UserCorrelation.organization_id.isnot(None),
UserCorrelation.email.isnot(None)
).all()
]
Comment on lines +677 to +683
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the new SQL-level null check won't filter empty string emails '' like the old Python-level if c.email check did. if empty emails exist in the DB, they'll now be included

Suggested change
member_emails = [
row[0] for row in db.query(UserCorrelation.email).filter(
UserCorrelation.organization_id == analysis.organization_id,
UserCorrelation.organization_id.isnot(None),
UserCorrelation.email.isnot(None)
).all()
]
member_emails = [
row[0] for row in db.query(UserCorrelation.email).filter(
UserCorrelation.organization_id == analysis.organization_id,
UserCorrelation.organization_id.isnot(None),
UserCorrelation.email.isnot(None),
UserCorrelation.email != ''
).all()
]
Prompt To Fix With AI
This is a comment left during a code review.
Path: backend/app/api/endpoints/analyses.py
Line: 677:683

Comment:
the new SQL-level null check won't filter empty string emails `''` like the old Python-level `if c.email` check did. if empty emails exist in the DB, they'll now be included

```suggestion
    member_emails = [
        row[0] for row in db.query(UserCorrelation.email).filter(
            UserCorrelation.organization_id == analysis.organization_id,
            UserCorrelation.organization_id.isnot(None),
            UserCorrelation.email.isnot(None),
            UserCorrelation.email != ''
        ).all()
    ]
```

How can I resolve this? If you propose a fix, please make it concise.

if not member_emails:
return {}

Expand Down