voting system,crud operation with integration testing and hash function to generate anonymous id updated by Hrusi01 · Pull Request #40 · p-society/iiitbuzz

Hrusi01 · 2025-12-10T17:13:47Z

update 👍

Vote functionality

added a new vote table schema to maintain records
up vote 1
no vote 0
downvote -1
pk-userid+postid ensure a person can't register vote multiple time in a single post

END POINTS:

 Auth required
     post    /posts/{postId}/vote      Handles upvote, downvote, and vote retraction transactions (-1,0,1)

HASH FUNCTION

this function returns random looking names that cant be traceback to original user id

Algorithm flow
uses hash of seed and secret key(provided by user) using that in sha 256
from adjectives and animal dictionary of 30 each and number 2 digit 0 to 99 we can generate unique unknown uid

3030100 =90,000
unique id per thread

even if the secret key and thread id know HASH cant be reversed and uid is not stored in data base and only known to the current state of the server

How the system will know about the person?:

when we will pass user id ,thread id and secret key in that hash it will give same random user name out put per unique thread
by that system can check which user is this
db wont store the secret key it is only known to the server

what function expects:?

a secret key from front end using by the user that to be passed by post request

@iamanishx #38

gemini-code-assist · 2025-12-10T17:14:03Z

Summary of Changes

Hello @Hrusi01, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request implements a new mechanism for generating consistent, anonymous user identifiers within specific threads. By utilizing a SHA256 hash of the user's actual ID, the thread ID, and a server-side secret key, the system can produce unique, yet non-traceable, 'random-looking' names. This approach aims to enhance user privacy by not storing direct user identifiers in the database for these anonymous interactions, while still allowing the system to recognize a user's identity within a given thread context by re-generating the same anonymous name.

Highlights

Anonymous User ID Generation: Introduced a new utility function, generateAnonName, to create unique, anonymous user identifiers for specific threads.
Hashing Mechanism: The anonymous names are generated by hashing a combination of the user ID, thread ID, and a server-side secret key using SHA256, then mapping parts of the hash to a combination of an adjective, an animal, and a two-digit number.
Environment Configuration: Added ANON_SECRET_KEY to the .env.example file and enforced a minimum length of 16 characters for this key in the envSchema.ts validation.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request introduces a function to generate anonymous user names using an HMAC-based approach. While the core idea is sound, there are several issues that need to be addressed. Most importantly, there is a critical security concern based on the pull request description, which suggests the secret key might be coming from the client. This would completely compromise the security of this feature. Additionally, there is a bug in an environment variable validation message that provides a confusing error, and a couple of smaller improvements are suggested for correctness and consistency in the name generation logic.

gemini-code-assist · 2025-12-10T17:14:55Z

apps/server/src/utils/anonymousName.ts

@@ -0,0 +1,31 @@
+import crypto from "crypto";
+
+import { getSecret } from "../secretPass";


The pull request description states: "a secret key from front end using by the user that to be passed by post request". If the getSecret function implements this, it represents a critical security vulnerability. The secret key used for an HMAC must be kept confidential on the server and must never be exposed to or transmitted from the client. If a client can provide the secret, the entire security model is broken, as anyone could then generate names for any user, defeating the purpose of anonymity. The secret key should be securely loaded from the server's environment variables.

then it can be bypass by the admin as he have uid thread id and key.. but we can use some method to restrict users to use multiple password in a single thread using flag but that may expose their identity in admin data base need to brain strom

apps/server/src/envSchema.ts

gemini-code-assist · 2025-12-10T17:14:55Z

apps/server/src/utils/anonymousName.ts

+  const adjIndex = parseInt(hash.substring(0, 8), 16) % adjectives.length;
+  const animalIndex = parseInt(hash.substring(8, 16), 16) % animals.length;


Using the modulo operator (%) on a large number from a hash to derive an index can introduce a slight statistical bias, known as modulo bias. This means that some names might be generated slightly more frequently than others. While this may be acceptable for this use case, it's worth noting for future reference, especially in more cryptographically sensitive contexts where a uniform distribution is required.

bias is negligible near to 7* 10 pow -9 but yeah we can eliminate that by limit and 32 bit hash segment

gemini-code-assist · 2025-12-10T17:14:55Z

apps/server/src/utils/anonymousName.ts

+  const animalIndex = parseInt(hash.substring(8, 16), 16) % animals.length;
+  const num = parseInt(hash.substring(16, 20), 16) % 100;
+
+  return `${adjectives[adjIndex]}${animals[animalIndex]}${num}`;


The generated number num is between 0 and 99. When this number is a single digit, the total length of the anonymous name will vary. For consistency, it's better to pad the number with a leading zero to ensure it's always two digits long.

Suggested change

return `${adjectives[adjIndex]}${animals[animalIndex]}${num}`;

return `${adjectives[adjIndex]}${animals[animalIndex]}${String(num).padStart(2, '0')}`;

Signed-off-by: Hrusi01 <hrusikeshkar01@gmail.com>

Hrusi01 · 2025-12-12T05:46:45Z

@iamanishx #38

Hrusi01 · 2025-12-12T07:55:38Z

paggination added in post and thread

iamanishx

@Hrusi01 how are you supposed to get total number of votes for a post ? And its if someone upvote and then downvote it totally 0 right .

iamanishx · 2025-12-10T17:22:44Z

apps/server/src/utils/anonymousName.ts

@@ -0,0 +1,31 @@
+import crypto from "crypto";
+
+import { getSecret } from "../secretPass";


@Hrusi01 where is this func? i cant find this in the PR

Hrusi01 · 2025-12-12T08:05:19Z

@Hrusi01 how are you supposed to get total number of votes for a post ? And its if someone upvote and then downvote it totally 0 right .

we can find that in post table vote column as post.vote
stores net vote

if someone down vote or up vote

final score is always calculated by the change in value relative to the previous vote

if a has vote 0
if up vote the a=+1
if down vote then a= -currentvote-1 =-2 from total

iamanishx · 2025-12-12T08:10:45Z

@Hrusi01 the vote mapping table is just to prevent multiple upvote or downvote from a user so i think we can have downvote and upvote as boolean so a user on upvoting will be upvote as true and on downvoting downvote as true it will better to maintain

iamanishx · 2025-12-12T08:11:12Z

@Hrusi01 the vote mapping table is just prevent multiple upvote or downvote from a user so i think we can have downvote and upvote ad boolean so a user on upvoting will be upvote as true and on downvoting downvote as true it will better to maintain

@neoandmatrix @ujsquared have a look

Hrusi01 · 2025-12-12T08:29:14Z

@Hrusi01 the vote mapping table is just to prevent multiple upvote or downvote from a user so i think we can have downvote and upvote as boolean so a user on upvoting will be upvote as true and on downvoting downvote as true it will better to maintain

i think it mean vote table with 3 column pk, 2 columns upvote(default o yes if 1 ), down vote(default 0 yes if 1 )
here we need to scan 2 column to get 3 variable 10 or 00 or 01

but existing schema has 2 column as pk,value(-1,0,1) it will reduce space and easy while maintainance by scaning a single coloumn we can get 3 variable data

iamanishx · 2025-12-12T08:29:27Z

@Hrusi01 fix the ci errors

iamanishx · 2025-12-12T08:32:01Z

@Hrusi01 the vote mapping table is just to prevent multiple upvote or downvote from a user so i think we can have downvote and upvote as boolean so a user on upvoting will be upvote as true and on downvoting downvote as true it will better to maintain

i think it mean vote table with 3 column pk, 2 columns upvote(default o yes if 1 ), down vote(default 0 yes if 1 )

here we need to scan 2 column to get 3 variable 10 or 00 or 01

but existing schema has 2 column as pk,value(-1,0,1) it will reduce space and easy while maintainance by scaning a single coloumn we can get 3 variable data

Fix the ci errors we will discuss the schema later on vc

Hrusi01 · 2025-12-12T08:32:17Z

@Hrusi01 fix the ci errors

bhaiya apka signoff missing he

iamanishx · 2025-12-12T08:36:00Z

@Hrusi01 fix the ci errors

bhaiya apka signoff missing he

Dekh sehi se ek baar

iamanishx · 2025-12-12T08:40:09Z

@Hrusi01 what are doing bro?

95ca5e0

What did you mean by //ci fixing?

iamanishx · 2025-12-12T08:41:35Z

https://github.com/p-society/iiitbuzz/actions/runs/20161096520/job/57873563774#step:6:1

Hrusi01 · 2025-12-12T08:50:57Z

@Hrusi01 what are doing bro?

95ca5e0

What did you mean by //ci fixing?

fixed ci errors bhaiya

iamanishx · 2025-12-12T08:55:27Z

@Hrusi01 leave dco bot

Fix is the ci errors

https://github.com/p-society/iiitbuzz/actions/runs/20161352795/job/57874679402#step:5:1

Its again failing

Hrusi01 · 2025-12-12T09:15:38Z

@Hrusi01 leave dco bot

Fix is the ci errors

https://github.com/p-society/iiitbuzz/actions/runs/20161352795/job/57874679402#step:5:1

Its again failing

please check if it is still failing

Hrusi01 · 2025-12-12T09:32:01Z

check all mein no errors

neoandmatrix

Too big of a PR with many changes at once.
My suggestions :-

Remove all the get route functionality overlapping with #39 .
Make changes manageable to review like one pr which adds all the schemas with dto and other one to add the logical and functionality.

CC: @iamanishx @ujsquared

iamanishx · 2025-12-13T05:24:53Z

Too big of a PR with many changes at once. My suggestions :-

Remove all the get route functionality overlapping with added get methods #39 .

Make changes manageable to review like one pr which adds all the schemas with dto and other one to add the logical and functionality.

CC: @iamanishx @ujsquared

@Hrusi01 remove the GET functionality overlapping with the other PR then ping us will review it

Signed-off-by: Hrusi01 <hrusikeshkar01@gmail.com>

Hrusi01 · 2025-12-13T10:11:41Z

Too big of a PR with many changes at once. My suggestions :-

Remove all the get route functionality overlapping with added get methods #39 .

Make changes manageable to review like one pr which adds all the schemas with dto and other one to add the logical and functionality.

CC: @iamanishx @ujsquared

removed the get function and crud function

iamanishx · 2025-12-13T10:14:44Z

@Hrusi01 please don't expose the db to the whole internet put some authentication and authorisation
Leaving security vulnerabilities for the sake of anonymity is foolishness
apps/server/src/routers/anonymousName.ts

Signed-off-by: Hrusi01 <hrusikeshkar01@gmail.com>

iamanishx · 2025-12-13T10:19:01Z

@Hrusi01 whats tanstack query doing in the package.json? there is nothing to do with this pr
Check those files to the orogin

neoandmatrix

Changes required.

neoandmatrix · 2025-12-13T10:18:55Z

apps/web/package.json

 		"@react-router/node": "^7.6.1",
 		"@react-router/serve": "^7.6.1",
 		"@tanstack/react-form": "^1.12.0",
+		"@tanstack/react-query": "^5.80.5",


Why??? Are there any frontend changes here?

neoandmatrix · 2025-12-13T10:19:05Z

apps/web/package.json

 		"react": "19.1.0",
 		"react-dom": "19.1.0",
 		"react-router": "^7.6.1",
+		"react-router-dom": "^7.10.1",


tried to test the front end at sometime that time i installed react router dom by mistake

neoandmatrix · 2025-12-13T10:21:43Z

apps/server/src/routers/anonymousName.ts

+	];
+
+	fastify.post("/anon-name", async (request, reply) => {
+		const parsed = bodySchema.safeParse(request.body);


I think auth checks are needed here.

iamanishx · 2025-12-13T16:00:02Z

@neoandmatrix @ujsquared kal iska schema discussion karte hainn bc mein

Hrusi01 · 2025-12-13T21:50:39Z

@neoandmatrix @ujsquared kal iska schema discussion karte hainn bc mein

sure

iamanishx · 2025-12-14T03:15:08Z

Remove apps/server/src/routers/topics.ts and post.dto,ts from the unrelated to your issue
@Hrusi01

iamanishx · 2025-12-14T03:17:38Z

@Hrusi01 remove apps/server/src/routers/posts.ts also

iamanishx · 2025-12-14T03:19:56Z

@Hrusi01 apps/server/src/routers/votes.ts 1st of all why is this under /routes? And again no authentication or authorisation!!

Signed-off-by: Hrusi01 <hrusikeshkar01@gmail.com>

Hrusi01 · 2025-12-14T14:42:50Z

@iamanishx @neoandmatrix
new schema updated, auth added to vote.ts, added logic separatly in service layer

gemini-code-assist bot reviewed Dec 10, 2025

View reviewed changes

Hrusi01 added 4 commits December 12, 2025 00:53

anonymous hash function

e5f4181

Signed-off-by: Hrusi01 <hrusikeshkar01@gmail.com>

updated hash

393caa8

Signed-off-by: Hrusi01 <hrusikeshkar01@gmail.com>

finalHash function

e859a32

Signed-off-by: Hrusi01 <hrusikeshkar01@gmail.com>

old hash file deleted

c297efa

Signed-off-by: Hrusi01 <hrusikeshkar01@gmail.com>

Hrusi01 force-pushed the main branch from 8be9519 to 07d974c Compare December 11, 2025 19:23

Hrusi01 changed the title ~~Hash funtion to generate anonymous user id~~ CRUD OPERATION AND HASH FUNCTION UPDATED Dec 11, 2025

Hrusi01 changed the title ~~CRUD OPERATION AND HASH FUNCTION UPDATED~~ CRUD OPERATION WITH INTEGRATION TESTING AND HASH FUNCTION UPDATED Dec 11, 2025

Hrusi01 changed the title ~~CRUD OPERATION WITH INTEGRATION TESTING AND HASH FUNCTION UPDATED~~ crud operation with integration testing and hash function to generate anonymous id updated Dec 11, 2025

Hrusi01 changed the title ~~crud operation with integration testing and hash function to generate anonymous id updated~~ crud operation with integration testing,voting system and hash function to generate anonymous id updated Dec 11, 2025

Hrusi01 changed the title ~~crud operation with integration testing,voting system and hash function to generate anonymous id updated~~ voting system,crud operation with integration testing and hash function to generate anonymous id updated Dec 11, 2025

iamanishx reviewed Dec 12, 2025

View reviewed changes

Hrusi01 closed this Dec 12, 2025

Hrusi01 reopened this Dec 12, 2025

neoandmatrix reviewed Dec 12, 2025

View reviewed changes

Hrusi01 added 2 commits December 13, 2025 14:57

vote schema added

827bf99

Signed-off-by: Hrusi01 <hrusikeshkar01@gmail.com>

index.ts updated

18e58f3

Signed-off-by: Hrusi01 <hrusikeshkar01@gmail.com>

Hrusi01 force-pushed the main branch 2 times, most recently from 7747cd6 to d2bb11f Compare December 13, 2025 10:06

Hrusi01 added 6 commits December 13, 2025 15:45

vote.dto.ts and votes.ts created

22eaec2

Signed-off-by: Hrusi01 <hrusikeshkar01@gmail.com>

update

f76c2c5

Signed-off-by: Hrusi01 <hrusikeshkar01@gmail.com>

biome fix

71238a1

Signed-off-by: Hrusi01 <hrusikeshkar01@gmail.com>

ci fix

0f55cd9

Signed-off-by: Hrusi01 <hrusikeshkar01@gmail.com>

ci fix

5222634

Signed-off-by: Hrusi01 <hrusikeshkar01@gmail.com>

updated the anonymousname

13ec4a7

Signed-off-by: Hrusi01 <hrusikeshkar01@gmail.com>

Hrusi01 force-pushed the main branch from d2bb11f to 13ec4a7 Compare December 13, 2025 10:17

neoandmatrix reviewed Dec 13, 2025

View reviewed changes

Merge branch 'main' into main

b89bb5d

Hrusi01 added 4 commits December 14, 2025 19:12

sync posts.dto.ts from upstream

3206e48

Signed-off-by: Hrusi01 <hrusikeshkar01@gmail.com>

upstream sync lock posts topic pkgJson

981c6a0

Signed-off-by: Hrusi01 <hrusikeshkar01@gmail.com>

new vote schema update

da8b3dd

Signed-off-by: Hrusi01 <hrusikeshkar01@gmail.com>

updated dto

ec51644

Signed-off-by: Hrusi01 <hrusikeshkar01@gmail.com>

		@@ -0,0 +1,31 @@
		import crypto from "crypto";

		import { getSecret } from "../secretPass";

		const adjIndex = parseInt(hash.substring(0, 8), 16) % adjectives.length;
		const animalIndex = parseInt(hash.substring(8, 16), 16) % animals.length;

	return `${adjectives[adjIndex]}${animals[animalIndex]}${num}`;
	return `${adjectives[adjIndex]}${animals[animalIndex]}${String(num).padStart(2, '0')}`;

Conversation

Hrusi01 commented Dec 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gemini-code-assist bot commented Dec 10, 2025

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

Hrusi01 Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

gemini-code-assist bot Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

Hrusi01 Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

Hrusi01 commented Dec 12, 2025

Uh oh!

Hrusi01 commented Dec 12, 2025

Uh oh!

iamanishx left a comment

Choose a reason for hiding this comment

Uh oh!

iamanishx Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

Hrusi01 commented Dec 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

iamanishx commented Dec 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

iamanishx commented Dec 12, 2025

Uh oh!

Hrusi01 commented Dec 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

iamanishx commented Dec 12, 2025

Uh oh!

iamanishx commented Dec 12, 2025

Uh oh!

Hrusi01 commented Dec 12, 2025

Uh oh!

iamanishx commented Dec 12, 2025

Uh oh!

iamanishx commented Dec 12, 2025

Uh oh!

iamanishx commented Dec 12, 2025

Uh oh!

Hrusi01 commented Dec 12, 2025

Uh oh!

iamanishx commented Dec 12, 2025

Uh oh!

Hrusi01 commented Dec 12, 2025

Uh oh!

Hrusi01 commented Dec 12, 2025

Uh oh!

neoandmatrix left a comment

Choose a reason for hiding this comment

Uh oh!

iamanishx commented Dec 13, 2025

Uh oh!

Hrusi01 commented Dec 13, 2025

Uh oh!

iamanishx commented Dec 13, 2025

Uh oh!

iamanishx commented Dec 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Hrusi01 commented Dec 10, 2025 •

edited

Loading

Hrusi01 commented Dec 12, 2025 •

edited

Loading

iamanishx commented Dec 12, 2025 •

edited

Loading

Hrusi01 commented Dec 12, 2025 •

edited

Loading

iamanishx commented Dec 13, 2025 •

edited

Loading