Repository navigation
Conversation
- Make getConnection async with a connecting promise to avoid duplicate simultaneous connections - Add ensureClient() in RedisCache with null-guards - Remove unused err parameter in error handler (fixes pre-commit ESLint) - Expose redis and postgres ports in docker-compose - Set POSTGRES_DB=evolution_api
Contributor
Reviewer's GuideThe PR refactors Redis initialization into an awaited, deduplicated connection flow and adds lazy null-safe access throughout RedisCache, preventing cold-start crashes when Redis is temporarily unavailable. Docker Compose is also updated to expose Redis/PostgreSQL ports and use the expected PostgreSQL database name. Sequence diagram for deduplicated Redis connectionsequenceDiagram
participant Cache as RedisCache
participant Redis as redisClient
participant Client as RedisClient
Cache->>Redis: getConnection()
alt connection already ready
Redis-->>Cache: return client
else connection in progress
Redis-->>Cache: return connecting promise
else no connection
Redis->>Redis: _connect()
Redis->>Client: createClient()
Redis->>Client: connect()
Client-->>Redis: ready
Redis-->>Cache: return client
end
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Hey - I've found 2 issues
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="docker-compose.yaml" line_range="48" />
<code_context>
aliases:
- evolution-redis
+ ports:
+ - "6379:6379"
expose:
- "6379"
</code_context>
<issue_to_address>
**Unauthenticated Redis is network-exposed**
When the Compose host is reachable from an untrusted network, the published Redis port accepts connections on host interfaces, and Redis starts without authentication, so remote clients can read, alter, or delete cache data.
Remove the public Redis port mapping or bind it to localhost, and configure authentication if Redis must be reachable remotely.
Also at `docker-compose.yaml:70-71`.
</issue_to_address>
### Comment 2
<location path="docker-compose.yaml" line_range="71" />
<code_context>
volumes:
- postgres_data:/var/lib/postgresql/data
+ ports:
+ - "5432:5432"
networks:
- evolution-net
</code_context>
<issue_to_address>
**PostgreSQL is reachable off-host**
When the Compose host is reachable from an untrusted network and the configured database password is weak or compromised, the `5432:5432` mapping binds PostgreSQL on every host interface, allowing remote clients to send login attempts directly to the database and, with a weak or compromised password, access application data using the configured database role.
Bind the PostgreSQL port to localhost for local development or restrict it to a trusted private network instead of publishing it on all host interfaces.
</issue_to_address>Sourcery assessment
Needs a human reviewer. 2 findings to address first, and publishing Redis and PostgreSQL ports makes both services reachable through the host’s network interfaces, potentially exposing cached data and database contents or allowing writes wherever those interfaces are reachable. Reverting closes the ports, but cannot undo data access or changes that already occurred.
Blocking findings: docker-compose.yaml:48, docker-compose.yaml:71
| aliases: | ||
| - evolution-redis | ||
| ports: | ||
| - "6379:6379" |
Contributor
There was a problem hiding this comment.
🔴 Critical · Unauthenticated Redis is network-exposed
When the Compose host is reachable from an untrusted network, the published Redis port accepts connections on host interfaces, and Redis starts without authentication, so remote clients can read, alter, or delete cache data.
Remove the public Redis port mapping or bind it to localhost, and configure authentication if Redis must be reachable remotely.
Also at docker-compose.yaml:70-71.
Prompt for AI agents
In `docker-compose.yaml` at line 48:
**Unauthenticated Redis is network-exposed**
When the Compose host is reachable from an untrusted network, the published Redis port accepts connections on host interfaces, and Redis starts without authentication, so remote clients can read, alter, or delete cache data.
Remove the public Redis port mapping or bind it to localhost, and configure authentication if Redis must be reachable remotely.
Also at `docker-compose.yaml:70-71`.From AGENTS.md L316:
- **Secure defaults** for all configurations| volumes: | ||
| - postgres_data:/var/lib/postgresql/data | ||
| ports: | ||
| - "5432:5432" |
Contributor
There was a problem hiding this comment.
🟡 Medium · PostgreSQL is reachable off-host
When the Compose host is reachable from an untrusted network and the configured database password is weak or compromised, the 5432:5432 mapping binds PostgreSQL on every host interface, allowing remote clients to send login attempts directly to the database and, with a weak or compromised password, access application data using the configured database role.
Bind the PostgreSQL port to localhost for local development or restrict it to a trusted private network instead of publishing it on all host interfaces.
Prompt for AI agents
In `docker-compose.yaml` at line 71:
**PostgreSQL is reachable off-host**
When the Compose host is reachable from an untrusted network and the configured database password is weak or compromised, the `5432:5432` mapping binds PostgreSQL on every host interface, allowing remote clients to send login attempts directly to the database and, with a weak or compromised password, access application data using the configured database role.
Bind the PostgreSQL port to localhost for local development or restrict it to a trusted private network instead of publishing it on all host interfaces.This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📋 Description
🔗 Related Issue
Closes #(issue_number)
🧪 Type of Change
🧪 Testing
📸 Screenshots (if applicable)
✅ Checklist
📝 Additional Notes
What
Make Redis client resilient for serverless / external DB setups (Vercel + NeonDB)
src/cache/rediscache.client.ts: async connection with retry + deduplication, fix ESLinterrshadowingsrc/cache/rediscache.ts: add ensureClient() null-guards to prevent crashes on cold startdocker-compose.yaml: expose Redis/Postgres ports + set POSTGRES_DB for local dev parity with Neon external DBWhy
When deploying with external Postgres (NeonDB) and Redis Cloud on Vercel, the cache client can be null during cold starts. This prevents crashes and retries connection.
Checks
Summary by Sourcery
Harden Redis connectivity for cold starts and external database deployments while improving local Docker database access.
Bug Fixes:
Enhancements: