feat(addresszen): add Addresszen plugin - #353
Conversation
|
@Ayush7614 is attempting to deploy a commit to the corsair Team on Vercel. A member of the Team first needs to authorize it. |
210ca96 to
b36a8be
Compare
Greptile SummaryThe PR adds a new Addresszen integration with API-key authentication, typed schemas, persistence entities, error handling, and live endpoint tests.
Confidence Score: 5/5The PR appears safe to merge, with no blocking failure remaining. No blocking failure remains; the only outstanding prior concern is the non-blocking exposure inherent in placing the API key in the key-availability request path. Important Files Changed
Sequence DiagramsequenceDiagram
participant App as Host application
participant Corsair as Corsair endpoint binding
participant Plugin as Addresszen plugin
participant API as Addresszen API
participant DB as Optional local database
App->>Corsair: Call addresszen.api endpoint
Corsair->>Corsair: Validate input and resolve API key
Corsair->>Plugin: Invoke bound endpoint
Plugin->>API: Send authenticated HTTP request
API-->>Plugin: Return address result
opt Database entity configured
Plugin->>DB: Upsert response data
end
Plugin-->>Corsair: Return typed response
Corsair->>Corsair: Validate output
Corsair-->>App: Return endpoint result
Reviews (5): Last reviewed commit: "fix(addresszen): omit auth header on pub..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
b36a8be to
5afb3ea
Compare
Implements the Addresszen OSS integration with API-key auth, autocomplete suggestions, USPS CASS address verification, local DB entities, and tests. Uses Authorization header auth, adds dotenv devDependency, and documents unknown API fields per plugin conventions. Closes corsairdev#352
5afb3ea to
bf65e86
Compare
Cover the OSS catalog surface and keep autocomplete/verify.
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (4)
📝 WalkthroughWalkthroughAdds a new ChangesAddresszen integration
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant Caller
participant AddresszenPlugin
participant AddresszenAPI
participant CorsairDatabase
Caller->>AddresszenPlugin: invoke typed endpoint
AddresszenPlugin->>AddresszenAPI: send authenticated request
AddresszenAPI-->>AddresszenPlugin: return typed response
AddresszenPlugin->>CorsairDatabase: optionally persist response
AddresszenPlugin-->>Caller: return endpoint response
Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Comment |
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/addresszen/api.test.ts`:
- Around line 11-13: Update the Addresszen API test suite around TEST_API_KEY
and “Addresszen API Type Tests” so it does not run live requests when
ADDRESSZEN_API_KEY is absent. Replace the non-null assertion with an explicit
presence check and conditionally skip the suite, or gate it behind the project’s
established integration-test setting; preserve normal execution when a valid
test key is configured.
In `@packages/addresszen/endpoints/key.ts`:
- Around line 24-30: Update the keyAvailability persistence call in the
upsertByEntityId flow to use the account’s non-secret identifier from await
ctx.$getAccountId() instead of ctx.key, while preserving the existing
availability payload and update behavior.
In `@packages/addresszen/endpoints/types.ts`:
- Around line 15-21: The autocomplete request contract is missing pagination
fields and uses the wrong provider query key. In
packages/addresszen/endpoints/types.ts lines 15-21, update
AutocompleteAddressesInputSchema to include optional public limit and page
fields; in packages/addresszen/endpoints/autocomplete.ts lines 20-22, map query
to provider parameter q and forward limit and page.
In `@packages/addresszen/endpoints/verify.ts`:
- Around line 28-43: Update the verified-address entity schema and the verify
endpoint’s entity-ID construction and upsert payload to include input.context.
Ensure context participates in identity so distinct contexts create separate
records, while preserving the existing address fields and storing the metadata
on each record.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: b119b8b7-d657-45d1-8b89-23cde0b1b193
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (18)
demo/testing/package.jsondemo/testing/src/server/corsair.tspackages/addresszen/api.test.tspackages/addresszen/client.tspackages/addresszen/endpoints/autocomplete.tspackages/addresszen/endpoints/index.tspackages/addresszen/endpoints/key.tspackages/addresszen/endpoints/resolve.tspackages/addresszen/endpoints/types.tspackages/addresszen/endpoints/verify.tspackages/addresszen/error-handlers.tspackages/addresszen/index.tspackages/addresszen/jest.config.cjspackages/addresszen/package.jsonpackages/addresszen/schema/database.tspackages/addresszen/schema/index.tspackages/addresszen/tsconfig.jsonpackages/addresszen/tsup.config.ts
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
|
@greptile Review |
Plugin PR scorecard —
|
| Check | Status | Notes |
|---|---|---|
| R1 — Scope: plugin files only | ✅ | |
| R2 — Tests with assertions | ✅ | |
| R3 — Description complete | ✅ | |
| R3 — Linked issue / claim | ✅ | |
| R4 — Demo video / recording | ✅ |
Rules: PLUGIN_PR_RULES.md · re-runs on every push
|
Hey @Ayush7614, thanks for the contribution! 🏴☠️ Before a maintainer reviews, please fix the items below — the review re-runs automatically on your next push. Must fix
PR requirements (rules)
If anything remains after your next push, a bot commit will clean it up; a maintainer always does the final review and merge. |
|
@greptile Review |
| ) => { | ||
| const response = await makeAddresszenRequest< | ||
| AddresszenEndpointOutputs['keyAvailability'] | ||
| >(`keys/${encodeURIComponent(ctx.key)}`, ctx.key, { |
There was a problem hiding this comment.
When a caller invokes key.availability, this endpoint interpolates the live API key into the request path, causing the credential to be retained by provider, proxy, or access-log infrastructure despite the new Authorization header. How this was verified: The endpoint passes ctx.key in keys/{key} while the client separately sends the same key in the Authorization header.
There was a problem hiding this comment.
AddressZen documents this as GET /keys/:key (public availability) there is no header-only variant (verified: /keys, /keys/me, /keys/current all 404). The path segment is the resource id, not optional auth.
Mitigation in 2544721: omit the Authorization header for this call so the key isn’t sent twice. Remaining path usage is provider-mandated; dropping the op would remove catalog ADDRESSZEN_KEY_AVAILABILITY.
There was a problem hiding this comment.
The implementation already has auth: false in the call — the mitigation is in place. The original concern was about the key being sent twice (path + header), and commit 2544721 resolved exactly that by adding the auth flag to makeAddresszenRequest.
Since the path is provider-mandated and the Authorization header is now suppressed for this endpoint, the concern is addressed. Fair point — withdrawing this comment.
Tip: You can customize Greptile's behavior for this repo with .greptile/rules.md and .greptile/config.json.
github-actions
Bot
added
bot:round-2
|
Remaining findings are being fixed by a bot commit — it will be re-reviewed automatically. |
|
@greptile review |
3 participants
Description
Adds
@corsair-dev/addresszenwith API-key auth and four read endpoints:key.availability—GET /v1/keys/{key}(catalog:ADDRESSZEN_KEY_AVAILABILITY)resolve.addressUsa—GET /v1/autocomplete/addresses/{id}/usa(catalog:ADDRESSZEN_RESOLVE_ADDRESS_USA)autocomplete.addresses—GET /v1/autocomplete/addressesverify.address—POST /v1/verify/addressesIncludes Zod input/output schemas, error handlers, local DB entities, and Jest live API tests.
Claimed integration: https://corsair.dev/oss/addresszen
Closes #352
Checklist
Before submitting your PR, please verify the following:
pnpm lintand all checks passpnpm typecheckand there are no TypeScript errorspnpm buildand all packages build successfullypnpm testand all tests passScreenshots / Demos (if applicable)
Live API tests passing:
Command used:
ADDRESSZEN_API_KEY='YOUR_KEY' pnpm --filter @corsair-dev/addresszen testSummary by CodeRabbit
New Features
Tests