Feat accessing CMS with token. #667

sriramkanakam87 · 2025-11-23T11:25:09Z

No description provided.

Copilot

Pull request overview

This PR introduces token-based authentication for accessing the ChemInformatics Microservice (CMS) API and refactors the codebase to use centralized configuration and service patterns. It replaces direct env() calls with config() helpers throughout the application and introduces a new CmsClient service to handle authenticated API communication with the CMS.

Key Changes:

Introduced CmsClient service with Bearer token authentication for CMS API requests
Added CmsProxyController with two endpoints: a generic CSRF-protected proxy and a rate-limited depiction endpoint
Refactored all CMS API calls to use the new CmsClient service instead of direct Http facade calls
Replaced env() calls with config() helpers for better configuration caching and Laravel best practices
Added getDepictUrl() helper function to centralize depiction URL generation through the proxy

Reviewed changes

Copilot reviewed 32 out of 33 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
app/Services/CmsClient.php	New service for authenticated CMS API communication with Bearer token support
app/Http/Controllers/CmsProxyController.php	New controller providing generic proxy and depiction endpoints for CMS API
routes/web.php	Added two new routes: generic CSRF-protected proxy and rate-limited depiction endpoint
config/services.php	Added configuration for CMS API URLs, authentication token, rate limiting, citation services, and Tawk chat
config/filesystems.php	Replaced env() with config() for public disk URL
app/Helper.php	Added getDepictUrl() helper and updated citation fetching to use config()
app/Jobs/ProcessEntryBatch.php	Refactored to use CmsClient service for pre-processing API calls
app/Jobs/ProcessEntry.php	Refactored to use CmsClient service for pre-processing API calls
app/Jobs/ImportEntry.php	Updated citation API URLs to use config() instead of env()
app/Jobs/ImportEntryAuto.php	Updated citation API URLs to use config() instead of env()
app/Console/Commands/GenerateCoordinates.php	Refactored to use CmsClient service for coordinate generation API calls
app/Console/Commands/SubmissionsAutoProcess/FetchCitationMetadataAuto.php	Updated citation API URLs to use config() instead of env()
app/Notifications/*.php	Updated APP_URL references to use config() instead of env()
app/Models/Molecule.php	Updated schema URL generation to use config() instead of env()
app/Livewire/MoleculeDepict2d.php	Replaced direct API URL construction with getDepictUrl() helper
resources/views/molecule.blade.php	Updated Open Graph and Twitter meta image URLs to use getDepictUrl() helper
resources/views/components/tawk-chat.blade.php	Updated Tawk URL to use config() instead of env()
resources/views/forms/components/organisms-table.blade.php	Updated dashboard URL to use config() instead of env()
app/Filament/Dashboard/Resources/*.php	Updated all depiction URLs to use getDepictUrl() helper and dashboard URLs to use config()
.env.example	Added documentation for CMS configuration variables
composer.lock	Updated Symfony dependencies to newer versions

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-11-23T11:30:17Z

app/Jobs/ProcessEntryBatch.php

+            $response = $cmsClient->get('chem/coconut/pre-processing', [
+                'smiles' => $canonical_smiles,
+                '_3d_mol' => 'false',
+                'descriptors' => 'false',
+            ], false);


The CmsClient::get() method is being called with 3 arguments, but the method signature only accepts 2 parameters ($endpoint and $params). The third argument false will be ignored. This appears to be a bug that needs to be fixed by updating the CmsClient::get() method signature to accept this third parameter.

Copilot · 2025-11-23T11:30:18Z

app/Jobs/ProcessEntry.php

+            $response = $cmsClient->get('chem/coconut/pre-processing', [
+                'smiles' => $canonical_smiles,
+                '_3d_mol' => 'false',
+                'descriptors' => 'false',
+            ], false);


The CmsClient::get() method is being called with 3 arguments, but the method signature only accepts 2 parameters ($endpoint and $params). The third argument false will be ignored. This appears to be a bug that needs to be fixed by updating the CmsClient::get() method signature to accept this third parameter.

Copilot · 2025-11-23T11:30:18Z

app/Services/CmsClient.php

+    /**
+     * Make the actual HTTP request
+     *
+     * @return \Illuminate\Http\Client\Response


The documentation states the parameter type @return \Illuminate\Http\Client\Response, but the method can also throw an \InvalidArgumentException for unsupported HTTP methods. The documentation should include a @throws tag to document this possibility.

Suggested change

* @return \Illuminate\Http\Client\Response

* @return \Illuminate\Http\Client\Response

* @throws \InvalidArgumentException

Copilot · 2025-11-23T11:30:18Z

app/Services/CmsClient.php

+    public function get(string $endpoint, array $params = [])
+    {
+        return $this->makeRequest('GET', $endpoint, $params);
+    }


The get method signature only accepts 2 parameters ($endpoint and $params), but it's being called with 3 arguments in multiple places (e.g., ProcessEntryBatch.php:128, ProcessEntry.php:62, GenerateCoordinates.php:113). The third parameter appears to be a boolean flag, but it's not defined in the method signature and will be ignored.

If the third parameter is intended to control some behavior (like whether to use authentication), it should be added to the method signature with a proper parameter name and type.

Copilot · 2025-11-23T11:30:18Z

app/Console/Commands/GenerateCoordinates.php

+                $response = $cmsClient->get($endpoint, [
+                    'smiles' => $smiles,
+                    'toolkit' => 'rdkit',
+                ], false);


The CmsClient::get() method is being called with 3 arguments, but the method signature only accepts 2 parameters ($endpoint and $params). The third argument false will be ignored. This appears to be a bug that needs to be fixed by updating the CmsClient::get() method signature to accept this third parameter.

Suggested change

], false);

]);

Copilot · 2025-11-23T11:30:19Z

routes/web.php

 Route::get('/collections', CollectionList::class)->name('collections.index');

+// CMS API Proxy - CSRF protected for generic proxy
+Route::match(['GET', 'POST'], '/cms-proxy', [CmsProxyController::class, 'proxy'])->name('cms.proxy');


The /cms-proxy endpoint is publicly accessible without authentication middleware. This allows any user to proxy requests to the internal CMS API. Consider adding authentication middleware if this endpoint should be restricted to authenticated users only, or at minimum add rate limiting to prevent abuse.

Copilot · 2025-11-23T11:30:19Z

app/Http/Controllers/CmsProxyController.php

+        $response = $this->cmsClient->get('depict/2D', $params);
+
+        return response($response->body())
+            ->header('Content-Type', $response->header('Content-Type') ?? 'image/svg+xml')
+            ->header('Cache-Control', 'public, max-age=86400');


The response status code is not preserved when the API request fails. The proxy always returns the CMS API's status code, but if the request throws an exception (timeout, network error), it will result in a 500 error without a proper error response. Consider wrapping the API call in a try-catch and returning an appropriate error status (e.g., 502 Bad Gateway) when the upstream service is unavailable.

Copilot · 2025-11-23T11:30:19Z

app/Http/Controllers/CmsProxyController.php

+    {
+        $endpoint = $request->input('endpoint');


Missing input validation for the endpoint parameter. A malicious user could potentially pass arbitrary endpoints, which could lead to unintended API calls. Consider validating or sanitizing the endpoint input, or maintaining a whitelist of allowed endpoints.

Suggested change

{

$endpoint = $request->input('endpoint');

{

// Define a whitelist of allowed endpoints

$allowedEndpoints = [

'articles',

'users',

'depict/2D',

// Add other allowed endpoints here

];

$endpoint = $request->input('endpoint');

if (!in_array($endpoint, $allowedEndpoints, true)) {

return response('Invalid endpoint', 400);

}

Copilot · 2025-11-23T11:30:19Z

app/Http/Controllers/CmsProxyController.php

+        $response = match ($method) {
+            'GET' => $this->cmsClient->get($endpoint, $params),
+            'POST' => $this->cmsClient->post($endpoint, $params),
+            default => abort(405, 'Method not allowed'),
+        };
+
+        return response($response->body())
+            ->header('Content-Type', $response->header('Content-Type'))
+            ->header('Cache-Control', 'public, max-age=86400')
+            ->setStatusCode($response->status());


Missing error handling for failed API requests. If the CMS API returns an error or times out, the proxy will forward that error response to the client without any logging or fallback behavior. Consider adding try-catch blocks and logging failures for monitoring and debugging purposes.

Copilot · 2025-11-23T11:30:20Z

app/Http/Controllers/CmsProxyController.php

+        $response = $this->cmsClient->get('depict/2D', $params);
+
+        return response($response->body())
+            ->header('Content-Type', $response->header('Content-Type') ?? 'image/svg+xml')
+            ->header('Cache-Control', 'public, max-age=86400');


Missing error handling for failed API requests in the depict2D method. If the CMS API is unavailable or returns an error, users will see broken images without any fallback. Consider adding try-catch blocks and returning a placeholder image or appropriate error response on failure.

Suggested change

$response = $this->cmsClient->get('depict/2D', $params);

return response($response->body())

->header('Content-Type', $response->header('Content-Type') ?? 'image/svg+xml')

->header('Cache-Control', 'public, max-age=86400');

try {

$response = $this->cmsClient->get('depict/2D', $params);

// If the response is not successful, return a placeholder image

if ($response->status() !== 200) {

return $this->placeholderImage();

}

return response($response->body())

->header('Content-Type', $response->header('Content-Type') ?? 'image/svg+xml')

->header('Cache-Control', 'public, max-age=86400');

} catch (\Exception $e) {

// On exception, return a placeholder image

return $this->placeholderImage();

}

}

/**

* Returns a simple SVG placeholder image indicating an error.

*

* @return \Illuminate\Http\Response

*/

private function placeholderImage()

{

$svg = <<<SVG

<svg xmlns="http://www.w3.org/2000/svg" width="120" height="40">

<rect width="120" height="40" fill="#eee"/>

<text x="60" y="25" font-size="14" text-anchor="middle" fill="#888">Image Error</text>

</svg>

SVG;

return response($svg)

->header('Content-Type', 'image/svg+xml')

->header('Cache-Control', 'public, max-age=300');

sriramkanakam87 added 11 commits November 19, 2025 11:26

fix: the cms api base url is now accessed through the config.

f47e4de

fix: changed the trigger branch in the workflow.

1a389dd

fix: audit vulnerability.

713b54c

chore: refactored to use env variables to be served from config.

f29c8b1

chore: revered the triggering branch to development.

29fbdf7

feat: cms client to handle all the requests.

9fa6248

feat: controller to handle front end requests.

b621915

feat: route and service config setup.

48edf63

feat: modified the cms api access for backend.

c044628

feat: modified the cms access for frontend.

56b1bba

feat: added example env content.

98caa6c

sriramkanakam87 requested a review from Copilot November 23, 2025 11:25

Copilot started reviewing on behalf of sriramkanakam87 November 23, 2025 11:25 View session

Copilot finished reviewing on behalf of sriramkanakam87 November 23, 2025 11:28

Copilot AI reviewed Nov 23, 2025

View reviewed changes

vcnainala added the wip label Nov 24, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Feat accessing CMS with token. #667

Feat accessing CMS with token. #667

Uh oh!

sriramkanakam87 commented Nov 23, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Nov 23, 2025

Uh oh!

Copilot AI Nov 23, 2025

Uh oh!

Copilot AI Nov 23, 2025

Uh oh!

Copilot AI Nov 23, 2025

Uh oh!

Copilot AI Nov 23, 2025

Uh oh!

Copilot AI Nov 23, 2025

Uh oh!

Copilot AI Nov 23, 2025

Uh oh!

Copilot AI Nov 23, 2025

Uh oh!

Copilot AI Nov 23, 2025

Uh oh!

Copilot AI Nov 23, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	* @return \Illuminate\Http\Client\Response
	* @return \Illuminate\Http\Client\Response
	* @throws \InvalidArgumentException

-    {
-        $endpoint = $request->input('endpoint');
+    {
+        // Define a whitelist of allowed endpoints
+        $allowedEndpoints = [
+            'articles',
+            'users',
+            'depict/2D',
+            // Add other allowed endpoints here
+        ];
+        $endpoint = $request->input('endpoint');
+        if (!in_array($endpoint, $allowedEndpoints, true)) {
+            return response('Invalid endpoint', 400);
+        }

-        $response = $this->cmsClient->get('depict/2D', $params);
-        return response($response->body())
-            ->header('Content-Type', $response->header('Content-Type') ?? 'image/svg+xml')
-            ->header('Cache-Control', 'public, max-age=86400');
+        try {
+            $response = $this->cmsClient->get('depict/2D', $params);
+            // If the response is not successful, return a placeholder image
+            if ($response->status() !== 200) {
+                return $this->placeholderImage();
+            }
+            return response($response->body())
+                ->header('Content-Type', $response->header('Content-Type') ?? 'image/svg+xml')
+                ->header('Cache-Control', 'public, max-age=86400');
+        } catch (\Exception $e) {
+            // On exception, return a placeholder image
+            return $this->placeholderImage();
+        }
+    }
+    /**
+     * Returns a simple SVG placeholder image indicating an error.
+     *
+     * @return \Illuminate\Http\Response
+     */
+    private function placeholderImage()
+    {
+        $svg = <<<SVG
+<svg xmlns="http://www.w3.org/2000/svg" width="120" height="40">
+  <rect width="120" height="40" fill="#eee"/>
+  <text x="60" y="25" font-size="14" text-anchor="middle" fill="#888">Image Error</text>
+</svg>
+SVG;
+        return response($svg)
+            ->header('Content-Type', 'image/svg+xml')
+            ->header('Cache-Control', 'public, max-age=300');

Feat accessing CMS with token. #667

Are you sure you want to change the base?

Feat accessing CMS with token. #667

Uh oh!

Conversation

sriramkanakam87 commented Nov 23, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Nov 23, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 23, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 23, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 23, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 23, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 23, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 23, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 23, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 23, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 23, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants