commercelayer / app-imports Goto Github PK

Vanta detected 1 HIGH severity vulnerabilities in this repo, through Dependabot alerts integration.

Detection Date: 2024-01-30
CRITICAL SLA: 15 days
HIGH SLA: 30 days

Please check the repo's Security tab for Dependabot alerts and fix the reported CRITICAL/HIGH vulnerabilities before the SLAs above.

customer_subscriptions csv template should only contains ['customer_email', 'reference']

The access token in URL query should be validated against slug, env and kind.
We also need to perform a check on user token info in order to validate role/permissions.

Everything should just be a matter of perform required check on the validateToken method that already perform a basic token validation.

We also need to fix the isProduction helper that checks the NODE_ENV=production flag, which does not exists by default in vitejs and circleci

• When a promotion doesn't have a coupon_codes_promotion_rule it won't appear in the list
• Results are not always listed in same order

• Remove RuntimeConfigProvider and use window.config.js instead
• Update app-elements to the latest version that includes some breaking changes

Following resources are missing:

• Line items
• SKU list items
• Tags

While the followings can't be directly added

• Line item options (does't play well with CSVs)
• Price tiers (can already be imported as part of prices)

• test valid token from dashboard
• check behavior when token expires
• handle onInvalidAuth from <TokenProvider>
• back button from list page goes to dashboard hub

When importing a JSON file without a parent resource selected we get a validation error but the select has no border red.

• The pipeline will be trigger on each commit if it doesn't contain [skip ci] in the message.
• When a tag with the convention vX.Y.Z is pushed the pipeline will run tests and moves compiled files to a specific s3 bucket (infra-cl-static-assets-stg)