Merged
Conversation
Agent-Logs-Url: https://github.com/FrendsPlatform/Frends.GraphQl/sessions/d08cb411-35fe-44de-af63-099f7e4ba4e8 Co-authored-by: MatteoDelOmbra <44415151+MatteoDelOmbra@users.noreply.github.com>
Agent-Logs-Url: https://github.com/FrendsPlatform/Frends.GraphQl/sessions/d08cb411-35fe-44de-af63-099f7e4ba4e8 Co-authored-by: MatteoDelOmbra <44415151+MatteoDelOmbra@users.noreply.github.com>
Agent-Logs-Url: https://github.com/FrendsPlatform/Frends.GraphQl/sessions/1a898b04-9335-4649-b3bf-573637ffbef0 Co-authored-by: MatteoDelOmbra <44415151+MatteoDelOmbra@users.noreply.github.com>
…apping Agent-Logs-Url: https://github.com/FrendsPlatform/Frends.GraphQl/sessions/e2056bdf-225b-40d9-8808-231b326a4ad5 Co-authored-by: MatteoDelOmbra <44415151+MatteoDelOmbra@users.noreply.github.com>
…ate-authentication Add ClientCertificate authentication method to GraphQL ExecuteQuery
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 12 minutes and 22 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (4)
📒 Files selected for processing (10)
WalkthroughAdded client certificate authentication support to GraphQL ExecuteQuery task. Introduced Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 1 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (1 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In
`@Frends.GraphQl.ExecuteQuery/Frends.GraphQl.ExecuteQuery.Tests/IntegrationTests.cs`:
- Around line 355-404: The tests currently use Assert.ThrowsAsync<Exception>
which is too broad; update each test to assert the specific exception expected
when loading the certificate: in
ClientCertificateAuthenticationThrowsWhenCertificatePathIsEmpty replace
Assert.ThrowsAsync<Exception>(Action) with
Assert.ThrowsAsync<ArgumentNullException>(Action) (the empty path should throw
ArgumentNullException), in
ClientCertificateAuthenticationThrowsWhenCertificatePathIsInvalid replace it
with Assert.ThrowsAsync<FileNotFoundException>(Action) (nonexistent path should
surface a FileNotFoundException), and in
ClientCertificateAuthenticationThrowsWhenInvalidPasswordProvided replace it with
Assert.ThrowsAsync<CryptographicException>(Action) (wrong PFX password surfaces
a cryptographic error); keep the Action local function and calls to
GraphQl.ExecuteQuery as-is.
- Around line 311-348: The tests
ClientCertificateAuthenticationWorksWithValidCertificate and
ClientCertificateAuthenticationWorksWithPasswordProtectedCertificate only
exercise PFX loading and not mutual-TLS; either update the test harness to
exercise mTLS end-to-end or rename the tests to reflect they only verify
certificate loading. To exercise mTLS: modify the test server (index.js) to
serve HTTPS and require client certificates, install a test CA and server cert,
change TestData.InitialConnection() to use https://localhost:4000 and trust the
CA, and ensure the call path into GraphQl.ExecuteQuery uses the
CertificatePath/CertificatePassword when creating the client handler so the
client presents the cert. Alternatively, rename the two test methods and their
asserts to CertificateLoading... and add a new integration test that runs the
HTTPS mutual-TLS server to truly validate Authentication.ClientCertificate.
In
`@Frends.GraphQl.ExecuteQuery/Frends.GraphQl.ExecuteQuery/Frends.GraphQl.ExecuteQuery.cs`:
- Around line 72-80: The client-certificate branch (checking
connection.Authentication == Authentication.ClientCertificate) currently loads a
PFX even for non-TLS endpoints; add a fail-fast check that the target endpoint
uses TLS before loading the certificate: parse the request URI (the property
holding the endpoint on your Connection object) and if the scheme is not "https"
throw an ArgumentException (or similar) with a clear message; keep the existing
checks for connection.CertificatePath/connection.CertificatePassword and only
call handler.ClientCertificates.Add(certificate) after the HTTPS check passes so
client certificates are only used for TLS endpoints.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 85716895-02e4-4675-9131-12469e833ca3
📒 Files selected for processing (4)
Frends.GraphQl.ExecuteQuery/Frends.GraphQl.ExecuteQuery.Tests/IntegrationTests.csFrends.GraphQl.ExecuteQuery/Frends.GraphQl.ExecuteQuery/Definitions/Authentication.csFrends.GraphQl.ExecuteQuery/Frends.GraphQl.ExecuteQuery/Definitions/Connection.csFrends.GraphQl.ExecuteQuery/Frends.GraphQl.ExecuteQuery/Frends.GraphQl.ExecuteQuery.cs
Comment on lines
+72
to
+80
| if (connection.Authentication == Authentication.ClientCertificate) | ||
| { | ||
| if (string.IsNullOrEmpty(connection.CertificatePath)) | ||
| throw new ArgumentNullException(nameof(connection.CertificatePath), "Certificate path cannot be empty when using ClientCertificate authentication."); | ||
| var certificate = string.IsNullOrEmpty(connection.CertificatePassword) | ||
| ? new X509Certificate2(connection.CertificatePath) | ||
| : new X509Certificate2(connection.CertificatePath, connection.CertificatePassword); | ||
| handler.ClientCertificates.Add(certificate); | ||
| } |
There was a problem hiding this comment.
Require HTTPS for client-certificate auth.
Client certificates are only sent during the TLS handshake. With an http:// endpoint this branch still loads the PFX, but no certificate is ever presented to the server, so the selected auth mode silently does nothing.
Suggested fail-fast check
if (connection.Authentication == Authentication.ClientCertificate)
{
+ if (!Uri.TryCreate(connection.EndpointUrl, UriKind.Absolute, out var endpointUri) ||
+ endpointUri.Scheme != Uri.UriSchemeHttps)
+ throw new ArgumentException("Client certificate authentication requires an HTTPS endpoint.", nameof(connection.EndpointUrl));
+
if (string.IsNullOrEmpty(connection.CertificatePath))
throw new ArgumentNullException(nameof(connection.CertificatePath), "Certificate path cannot be empty when using ClientCertificate authentication.");
var certificate = string.IsNullOrEmpty(connection.CertificatePassword)
? new X509Certificate2(connection.CertificatePath)
: new X509Certificate2(connection.CertificatePath, connection.CertificatePassword);
handler.ClientCertificates.Add(certificate);
}🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In
`@Frends.GraphQl.ExecuteQuery/Frends.GraphQl.ExecuteQuery/Frends.GraphQl.ExecuteQuery.cs`
around lines 72 - 80, The client-certificate branch (checking
connection.Authentication == Authentication.ClientCertificate) currently loads a
PFX even for non-TLS endpoints; add a fail-fast check that the target endpoint
uses TLS before loading the certificate: parse the request URI (the property
holding the endpoint on your Connection object) and if the scheme is not "https"
throw an ArgumentException (or similar) with a clear message; keep the existing
checks for connection.CertificatePath/connection.CertificatePassword and only
call handler.ClientCertificates.Add(certificate) after the HTTPS check passes so
client certificates are only used for TLS endpoints.
MichalFrends1
requested changes
Apr 14, 2026
Contributor
MichalFrends1
left a comment
MichalFrends1
left a comment
There was a problem hiding this comment.
@MatteoDelOmbra Check code rabbit comments about client-certificate authentication
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
MichalFrends1
approved these changes
Apr 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Review Checklist
Summary by CodeRabbit
Release Notes
New Features
Tests