Skip to content

Conversation

@sundayonah
Copy link
Collaborator

@sundayonah sundayonah commented Jan 14, 2026

Description

This PR implements a streamlined KYB integration referral system that enables automatic account verification and email automation for business users onboarding via partner referral links.

Key Changes:

  1. Database Schema Enhancement: Added an optional referral_id field (string, max 100 chars) to the Users table to track partner attribution.

  2. Auto-Verification Logic: Modified the user registration endpoint (/register) to:

    • Accept referral_id as a query parameter
    • Automatically set is_email_verified to true for users with a valid referral_id, bypassing the standard email verification flow
    • Store the referral_id in the user record for partner attribution
  3. API Key Generation: API keys are automatically generated during user registration when users have provider or sender scopes (existing behavior, confirmed working for referral users).

  4. Email Automation:

    • Created a new email template handler SendPartnerOnboardingSuccessEmail in the email service
    • Integrated email sending in the KYB submission handler to automatically send onboarding success emails to users with referral_id
    • The email includes: first name, API key, email (as username), and an auto-generated secure password
  5. Password Generation: Added a secure random password generation utility function for temporary passwords sent in onboarding emails.

References

Testing

Unit Tests Added:

  • Added tests for SendPartnerOnboardingSuccessEmail in aggregator/services/email/email_test.go:
    • Test for successful email sending with correct payload data
    • Test for fallback provider behavior
    • Template ID verification tests for all providers (SendGrid, Brevo, Mailgun)
  • Added tests for referral system in aggregator/controllers/index_test.go:
    • KYB submission with referral_id and sender profile - verifies email is sent
    • KYB submission with referral_id and provider profile - verifies email is sent
    • KYB submission without referral_id - verifies email is NOT sent

Manual Testing Steps:

  1. Registration with Referral ID:

POST /register?referral_id=PAYCREST
Body: { firstName, lastName, email, password, scopes, currencies (if provider) }

  • Verify user is created with referral_id set
  • Verify is_email_verified is true
  • Verify API key is generated (check database for API key associated with profile)
  1. KYB Submission for Referral User:

    • Complete KYB submission form for a user with referral_id
    • Verify partner onboarding success email is sent
    • Verify email contains: first_name, api_key, email, and password
  2. Standard Registration (without referral_id):

    • Register without referral_id query parameter
    • Verify is_email_verified is false (unless in dev/test environment)
    • Verify standard email verification flow works
  3. Environment Behavior:

    • Test in development/test environments (should auto-verify regardless of referral_id)
    • Test in staging/production (should only auto-verify with referral_id)
  • This change adds test coverage for new/changed/fixed functionality

Checklist

  • I have added documentation and tests for new/changed/fixed functionality in this PR
  • All active GitHub checks for tests, formatting, and security are passing
  • The correct base branch is being used, if not main

By submitting a PR, I agree to Paycrest's Contributor Code of Conduct and Contribution Guide.

Summary by CodeRabbit

  • New Features
    • Added referral system integration: users can now be registered with a referral ID via query parameters
    • Email auto-verification now triggers when a referral ID is supplied during registration
    • Added partner onboarding success email notifications to streamline the onboarding process

✏️ Tip: You can customize this high-level summary in your review settings.

- Introduced a new `referral_id` field in the User schema to support partner onboarding.
- Implemented logic in the registration process to set the `referral_id` if provided, allowing for auto-verification in non-production environments.
- Added a new email service method to send a partner onboarding success email, including relevant user details.
- Updated tests to cover the new onboarding email functionality and referral ID handling.
@coderabbitai
Copy link
Contributor

coderabbitai bot commented Jan 14, 2026

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

📝 Walkthrough

Walkthrough

This PR implements a referral system for KYB onboarding by adding a referral_id field to users, enabling auto-email verification for referred users, and triggering partner onboarding success emails with API credentials. Changes include schema updates, ORM mutations, auth registration modifications, email service enhancements, and comprehensive test coverage.

Changes

Cohort / File(s) Summary
Auth Registration & Referral Logic
controllers/accounts/auth.go
Modified Register to read referral_id from query string and auto-verify users when referral ID is present or in non-production/staging environments. Updated verification decision logic to conditionally apply referral-based auto-verification.
Database Schema & Migration
ent/migrate/schema.go, ent/schema/user.go
Added nullable referral_id field (string, max 100) to Users table schema supporting referral attribution.
ORM Entity Generation
ent/mutation.go, ent/user.go, ent/user/user.go, ent/user/where.go, ent/user_create.go, ent/user_update.go
Generated comprehensive mutation, accessor, and query methods for referral_id field including SetReferralID, ReferralID, OldReferralID, ClearReferralID, validation hooks, predicate functions (EQ, NEQ, IN, GT, LT, Contains, etc.), and upsert helpers.
ORM Runtime Configuration
ent/runtime/runtime.go
Wired referral_id validator into user schema initialization by retrieving descriptor and assigning to public ReferralIDValidator.
Email Service for Partner Onboarding
services/email/email.go, services/email/interface.go
Added SendPartnerOnboardingSuccessEmail method to EmailService and interface, constructing payload with first_name, api_key, email, and password. Extended template ID resolution to include partner_onboarding_success across SendGrid, Brevo, and Mailgun providers.
Utility Functions
utils/utils.go
Added GenerateRandomPassword function for cryptographically secure random password generation using crypto/rand.
Test Coverage
controllers/accounts/auth_test.go, controllers/index_test.go, services/email/email_test.go
Added mock SendPartnerOnboardingSuccessEmail to auth test mocks. Expanded KYB submission test suite with 220+ lines covering referral scenarios (API key generation, JWT creation, onboarding email verification), non-referral scenarios, and edge cases. Added PartnerOnboardingSuccessEmail tests validating payload and fallback behavior.
Dependency Updates
go.mod
Updated github.com/mattn/go-sqlite3 from v1.14.17 to v1.14.28 and indirect dependencies including golang.org/x/sync, golang.org/x/tools, ariga.io/atlas, and others.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

Suggested reviewers

  • 5ran6
  • onahprosper

Poem

🐰 A referral's spark ignites the flame,
Users auto-verified, no email shame,
Partners onboard with API in hand,
Swift credentials sent across the land,
KYB flows now streamlined, grand!

🚥 Pre-merge checks | ✅ 4 | ❌ 1
❌ Failed checks (1 warning)
Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 75.61% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and concisely summarizes the main changes: adding a referral_id field to the User entity and implementing onboarding email functionality for the referral system.
Description check ✅ Passed The PR description is comprehensive and well-structured, covering all required sections: clear purpose, key changes, references to issue #645, detailed testing steps (unit and manual), and completed checklist items.
Linked Issues check ✅ Passed All core requirements from issue #645 are met: referral_id field added to Users table, auto-verification logic implemented for referral users, API key generation confirmed working, SendPartnerOnboardingSuccessEmail implemented, and secure password generation utility added.
Out of Scope Changes check ✅ Passed All changes are directly aligned with issue #645 objectives. Database schema, registration logic, KYB submission handler, email service, and utilities are all within scope. The go.mod dependency updates are standard maintenance unrelated to PR scope.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3

🤖 Fix all issues with AI agents
In `@go.mod`:
- Line 19: Update the github.com/mattn/go-sqlite3 dependency to v1.14.28 in
go.mod (replace the existing v1.14.17 entry), then run the module update
workflow (use go get github.com/mattn/[email protected] and go mod tidy) and
run the test suite/CI to ensure nothing breaks; additionally, add a short note
to the dependency changelog or security tracking doc referencing
github.com/mattn/go-sqlite3 and the CVE IDs CVE-2025-29087 and CVE-2025-6965 so
we can monitor future advisories.

In `@services/email/email_test.go`:
- Line 359: The test currently asserts the placeholder SendGrid template ID
"d-XXXXX" for the "partner_onboarding_success" template; update the test to
expect the real SendGrid template ID once configured (replace "d-XXXXX" with the
actual ID), or better: reference the same template-ID constant/mapping used in
email.go (e.g., the templates/TemplateIDs map or the variable that holds the
template mapping) instead of hardcoding "d-XXXXX" so the test stays correct when
the template ID is updated.

In `@services/email/email.go`:
- Line 242: The SendGrid template entry for "partner_onboarding_success"
currently uses a placeholder "d-XXXXX" which will break email delivery; locate
the templates map where the "partner_onboarding_success" key is defined and
replace "d-XXXXX" with the actual SendGrid template ID in the correct format
(e.g., d-<hex> like d-f26d853bbb884c0c856f0bbda894032c); after updating, verify
the ID is the real one from the SendGrid dashboard (or environment/config) and
run a local or staging send test to confirm the template renders correctly.
🧹 Nitpick comments (4)
utils/utils.go (1)

1569-1581: Address modulo bias and add input validation.

Two issues to consider:

  1. Modulo bias: Using b[0] % len(charset) introduces slight bias since 256 is not evenly divisible by the charset length (88). Characters at lower indices are marginally more likely. Use crypto/rand.Int() for uniform distribution.

  2. Panic risk: Negative length will cause make([]byte, length) to panic.

♻️ Suggested implementation using crypto/rand.Int()
+import (
+	"math/big"
+)

 // GenerateRandomPassword generates a cryptographically secure random password
 func GenerateRandomPassword(length int) (string, error) {
+	if length <= 0 {
+		return "", fmt.Errorf("password length must be positive")
+	}
 	const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()-_=+[]{}|;:,.<>?"
+	charsetLen := big.NewInt(int64(len(charset)))
 	password := make([]byte, length)
 	for i := range password {
-		b := make([]byte, 1)
-		if _, err := rand.Read(b); err != nil {
+		n, err := rand.Int(rand.Reader, charsetLen)
+		if err != nil {
 			return "", err
 		}
-		password[i] = charset[int(b[0])%len(charset)]
+		password[i] = charset[n.Int64()]
 	}
 	return string(password), nil
 }
controllers/accounts/auth.go (1)

85-107: Referral-based auto-verification logic looks correct.

The implementation correctly:

  • Reads referral_id from query parameter
  • Stores it on the user when provided
  • Bypasses email verification for referred users (per PR objectives)

Consider whether you need to validate the referral_id against a known set of partner identifiers to prevent abuse. Currently, any non-empty string will trigger email auto-verification.

controllers/index_test.go (2)

754-832: Test name implies email verification, but email sending is not actually asserted.

The test correctly verifies that referral_id is preserved after KYB submission, but the test name "sends partner onboarding email" is misleading since there's no assertion that the email service was invoked. Consider either:

  1. Renaming to clarify what's actually tested (e.g., "KYB submission preserves referral_id for sender profile")
  2. Adding a mock for the email service to verify SendPartnerOnboardingSuccessEmail is called with correct parameters

834-912: Same observation: email sending not verified.

This test follows the same pattern as the sender profile test. The email verification concern applies here as well.

📜 Review details

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between b1b237c and 505aca1.

⛔ Files ignored due to path filters (2)
  • ent/migrate/migrations/atlas.sum is excluded by !**/*.sum
  • go.sum is excluded by !**/*.sum
📒 Files selected for processing (18)
  • controllers/accounts/auth.go
  • controllers/accounts/auth_test.go
  • controllers/index.go
  • controllers/index_test.go
  • ent/migrate/schema.go
  • ent/mutation.go
  • ent/runtime/runtime.go
  • ent/schema/user.go
  • ent/user.go
  • ent/user/user.go
  • ent/user/where.go
  • ent/user_create.go
  • ent/user_update.go
  • go.mod
  • services/email/email.go
  • services/email/email_test.go
  • services/email/interface.go
  • utils/utils.go
🧰 Additional context used
🧬 Code graph analysis (9)
controllers/accounts/auth_test.go (1)
types/types.go (1)
  • SendEmailResponse (549-552)
ent/user.go (2)
ent/user/where.go (1)
  • ReferralID (105-107)
ent/user/user.go (1)
  • FieldReferralID (41-41)
ent/user/user.go (6)
ent/paymentorder/paymentorder.go (1)
  • OrderOption (339-339)
ent/providerprofile/providerprofile.go (1)
  • OrderOption (213-213)
ent/fiatcurrency/fiatcurrency.go (1)
  • OrderOption (116-116)
ent/verificationtoken/verificationtoken.go (1)
  • OrderOption (117-117)
ent/senderprofile/senderprofile.go (1)
  • OrderOption (118-118)
ent/apikey/apikey.go (1)
  • OrderOption (85-85)
ent/user_update.go (3)
ent/user/where.go (1)
  • ReferralID (105-107)
ent/user/user.go (2)
  • ReferralIDValidator (130-130)
  • FieldReferralID (41-41)
ent/ent.go (1)
  • ValidationError (216-219)
services/email/email_test.go (4)
types/types.go (1)
  • SendEmailResponse (549-552)
services/email/email.go (1)
  • EmailService (14-19)
config/notification.go (1)
  • NotificationConfiguration (10-15)
ent/paymentorder/where.go (1)
  • FromAddress (146-148)
ent/runtime/runtime.go (1)
ent/user/user.go (1)
  • ReferralIDValidator (130-130)
services/email/email.go (1)
types/types.go (2)
  • SendEmailResponse (549-552)
  • SendEmailPayload (539-546)
ent/mutation.go (2)
ent/user/where.go (1)
  • ReferralID (105-107)
ent/user/user.go (1)
  • FieldReferralID (41-41)
ent/schema/user.go (1)
ent/user.go (2)
  • User (20-50)
  • User (110-127)
🪛 Gitleaks (8.30.0)
services/email/email_test.go

[high] 310-310: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

(generic-api-key)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
  • GitHub Check: build-and-test
🔇 Additional comments (33)
utils/utils.go (1)

6-6: LGTM!

Correct use of crypto/rand for cryptographically secure random number generation.

ent/user/user.go (1)

40-41: Auto-generated code correctly reflects the new referral_id field.

The generated constants, column definitions, validators, and ordering functions properly support the new optional referral_id field defined in the schema.

Also applies to: 95-95, 129-130, 221-224

ent/migrate/schema.go (1)

642-642: Migration schema correctly adds the referral_id column.

The column definition properly reflects the schema: nullable string with max size 100.

ent/schema/user.go (2)

47-49: Well-defined referral_id field.

The field is correctly configured as optional with a reasonable max length of 100 characters for partner attribution.


78-102: Password hashing hook is properly implemented.

The hook correctly:

  • Only hashes when password is present in the mutation
  • Uses bcrypt with cost 14, which provides strong security
  • Applies to create and update operations

This ensures passwords are always stored hashed.

controllers/accounts/auth_test.go (1)

73-75: Mock method correctly added for partner onboarding email.

The mock implementation matches the interface signature in services/email/interface.go and follows the same pattern as other email service mocks.

ent/user.go (1)

44-45: LGTM - Generated code correctly adds the ReferralID field.

The auto-generated Ent code properly integrates the new referral_id field with appropriate JSON serialization tag using omitempty for the optional field.

services/email/interface.go (1)

19-19: LGTM - Interface method signature follows established patterns.

The new method signature is consistent with other specialized email methods in the interface, taking context and relevant parameters, returning the standard response type.

ent/runtime/runtime.go (1)

633-636: LGTM - Generated runtime wiring for referral_id validator.

The auto-generated code correctly wires the ReferralIDValidator following the same pattern as other field validators in the schema.

services/email/email.go (1)

214-229: LGTM - Method implementation follows established patterns.

The implementation correctly constructs the payload with all required dynamic data fields (first_name, api_key, email, password) and delegates to the template email sender.

services/email/email_test.go (3)

302-323: LGTM - Comprehensive test coverage for partner onboarding success email.

The test properly validates:

  • Response ID propagation
  • Correct template ID selection for Brevo provider
  • All payload fields including first_name, api_key, email, and password
  • From/To address configuration

The static analysis warning about line 310 (apiKey := "test-api-key-12345") is a false positive - this is clearly a test fixture value, not a real credential.


325-347: LGTM - Fallback behavior test is thorough.

The test correctly verifies that when the primary provider fails, the fallback provider is invoked exactly once, and all payload data is correctly propagated to the fallback.


513-519: LGTM - Fallback test table extended correctly.

The new test case follows the established pattern and ensures SendPartnerOnboardingSuccessEmail is covered in the comprehensive fallback scenario testing.

controllers/index_test.go (2)

16-16: LGTM!

The import alias svc for the services package is appropriate and used for APIKeyService instantiation in the new tests.


914-971: Test logic is correct for verifying the negative case.

The assertion that referral_id remains empty is appropriate for validating the prerequisite condition for the email flow. The same observation about email verification applies, but the referral_id check is sufficient to validate the branching condition.

ent/user_update.go (3)

154-172: Generated code is correct.

The SetReferralID, SetNillableReferralID, and ClearReferralID methods follow the established ent patterns for optional string fields, consistent with other fields in this file.


349-353: Validation and SQL persistence properly integrated.

The check() method validates via ReferralIDValidator when the field is set, and sqlSave() correctly handles both setting and clearing the field. This mirrors the pattern used for KybVerificationStatus.

Also applies to: 396-401


672-690: UserUpdateOne implementation is consistent with UserUpdate.

The same patterns are correctly applied to UserUpdateOne, maintaining consistency across both update builder types.

Also applies to: 880-884, 944-949

ent/user_create.go (3)

131-143: Generated code correctly implements optional field setters.

The SetReferralID and SetNillableReferralID methods follow standard ent patterns for optional string fields.


351-355: Validation and spec creation properly handle optional referral_id.

The validation only runs when ReferralID is provided (appropriate for an optional field), and createSpec() correctly populates both the spec field and node value.

Also applies to: 432-435


660-676: Upsert variants are complete and consistent.

All three upsert types (UserUpsert, UserUpsertOne, UserUpsertBulk) include SetReferralID, UpdateReferralID, and ClearReferralID methods, providing full CRUD capability for the field.

Also applies to: 855-874, 1220-1239

ent/user/where.go (2)

104-107: Generated equality predicate is correct.

The ReferralID function correctly maps to FieldReferralID for equality checks.


554-627: Complete predicate suite for referral_id field.

The generated predicates include all standard string operations plus ReferralIDIsNil and ReferralIDNotNil for querying the optional field state. This enables flexible querying patterns for the referral flow (e.g., finding users with/without referral attribution).

ent/mutation.go (7)

19814-19820: LGTM: Field declaration follows established pattern.

The nullable referral_id *string field is correctly added to UserMutation, consistent with other optional fields in the struct.


20297-20344: LGTM: Accessor methods are correctly implemented.

All referral_id accessors follow the standard Ent mutation pattern:

  • SetReferralID / ReferralID for basic get/set
  • OldReferralID with proper UpdateOne restriction and error handling
  • ClearReferralID correctly updates both the field and clearedFields map
  • ReferralIDCleared / ResetReferralID for state tracking

20548-20585: LGTM: Fields() method correctly updated.

Capacity increased to 11 and referral_id is appended when non-nil, consistent with other field handling.


20610-20648: LGTM: Field() and OldField() dispatch correctly extended.

Both switch cases properly delegate to the typed accessor methods.


20725-20731: LGTM: SetField correctly handles string type assertion.

The type assertion to string is appropriate for the referral_id field type.


20758-20784: LGTM: ClearedFields() and ClearField() correctly handle the nullable field.

ClearedFields() properly checks FieldCleared before appending, and ClearField() correctly dispatches to ClearReferralID().


20817-20825: LGTM: ResetField() correctly dispatches to ResetReferralID().

This completes the full mutation lifecycle support for the referral_id field.

Note: This file appears to be auto-generated by the Ent framework. The generated code correctly implements all necessary mutation methods for the new referral_id field following the established patterns. Any schema-level concerns should be addressed in ent/schema/user.go rather than in this generated file.

go.mod (3)

45-47: Verify the purpose of directly added CLI/formatting dependencies.

The root module directly depends on several libraries that appear unrelated to the PR objectives: spf13/cobra (CLI framework), olekukonko/tablewriter (table formatting), ariga.io/atlas (database schema migration), and fatih/color (terminal coloring). The secondary dependencies on clipperhouse and other formatting utilities stem from tablewriter.

These packages should not be in the main aggregator module if they're only used for development tooling or CLI utilities. Confirm whether these were intentionally added for the referral system, email, or KYB features, or if they were accidentally included and should be removed.

Also applies to: 58-58, 69-69, 74-75, 77-80, 83-83, 90-90


104-105: No issues found. All golang.org/x package versions (sync v0.19.0, tools v0.41.0, crypto v0.47.0, mod v0.32.0, net v0.49.0, sys v0.40.0, text v0.33.0) are compatible with Go 1.25.0 and have no known critical issues or incompatibilities.


110-110: Test Atlas v1.0.0 compatibility before merging.

Atlas was updated from v0.32.1 to v1.0.0 (milestone release with new features). While v1.0 has no documented breaking changes, validate that migration policies and CI workflows (especially GitHub Actions if used) function correctly. Run smoke tests on representative migrations in a staging environment.

✏️ Tip: You can disable this entire section by setting review_details to false in your review settings.

github.com/jarcoal/httpmock v1.3.1
github.com/mailgun/mailgun-go/v3 v3.6.4
github.com/mattn/go-sqlite3 v1.14.17
github.com/mattn/go-sqlite3 v1.14.28
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🌐 Web query:

github.com/mattn/go-sqlite3 v1.14.28 security vulnerabilities advisories

💡 Result:

Short answer: There are no published security advisories on the go-sqlite3 GitHub security page for v1.14.28. However, known CVEs for the project/upstream SQLite you should be aware of:

  • GitHub security page for the repo shows no published advisories. [1]
  • CVE-2023-7104 (heap-based buffer overflow in SQLite sessionReadRecord) affects github.com/mattn/go-sqlite3 versions < 1.14.18 — upgrade guidance says use >= 1.14.18; v1.14.28 is not vulnerable to this CVE. [2][3]
  • Newer upstream SQLite CVEs reported in 2025 (e.g., CVE-2025-29087, CVE-2025-6965) have associated discussions/issues in the mattn/go-sqlite3 repo; whether they affect v1.14.28 depends on which SQLite amalgamation version is bundled/used — check the repo issues and release notes for the exact SQLite version included or build flags you use. [4][5]

If you want, I can:

  • check exactly which SQLite source/version is bundled in v1.14.28 and map it to specific CVEs, or
  • scan a given project for vulnerable go-sqlite3 versions. Which would you like?

Sources:
[1] mattn/go-sqlite3 — Security (GitHub).
[2] Snyk advisory SNYK‑GOLANG‑GITHUBCOMMATTNGOSQLITE3‑6139875 (CVE‑2023‑7104).
[3] GitHub Advisory entry and NVD references for CVE‑2023‑7104.
[4] mattn/go-sqlite3 issues referencing CVE‑2025‑29087.
[5] mattn/go-sqlite3 issue referencing CVE‑2025‑6965.


🏁 Script executed:

#!/bin/bash
# Check mattn/go-sqlite3 releases and tags to verify v1.14.28 exists
curl -s "https://api.github.com/repos/mattn/go-sqlite3/releases" | grep -i "v1.14.28" || echo "Checking tags..."
curl -s "https://api.github.com/repos/mattn/go-sqlite3/tags" | grep "v1.14.28" -A 2 -B 2 || echo "Version not found in tags"

Repository: paycrest/aggregator

Length of output: 375


🏁 Script executed:

#!/bin/bash
# Check for CVEs and vulnerabilities related to go-sqlite3
curl -s "https://api.github.com/repos/mattn/go-sqlite3/issues?labels=security&state=all&per_page=100" | head -100

Repository: paycrest/aggregator

Length of output: 67


🏁 Script executed:

#!/bin/bash
# Alternative: Check golang.org/x/vulndb for go-sqlite3 vulnerabilities
# Go vulnerability database reference
echo "Checking Go vulnerability data for sqlite3 v1.14.28..."
# Query against known vulnerability patterns
rg "go-sqlite3|sqlite3" . 2>/dev/null | head -20 || echo "No local references found"

Repository: paycrest/aggregator

Length of output: 1841


Upgrade to sqlite3 v1.14.28 addresses security vulnerability — monitor for newer CVEs.

The sqlite3 driver upgrade from v1.14.17 to v1.14.28 is a security improvement. v1.14.17 was vulnerable to CVE-2023-7104 (heap-based buffer overflow); v1.14.28 includes the fix. The version is stable and present in the public release history.

Monitor mattn/go-sqlite3 for any updates related to 2025 CVEs (CVE-2025-29087, CVE-2025-6965) currently in discussion; their applicability to v1.14.28 depends on the bundled SQLite version.

🤖 Prompt for AI Agents
In `@go.mod` at line 19, Update the github.com/mattn/go-sqlite3 dependency to
v1.14.28 in go.mod (replace the existing v1.14.17 entry), then run the module
update workflow (use go get github.com/mattn/[email protected] and go mod
tidy) and run the test suite/CI to ensure nothing breaks; additionally, add a
short note to the dependency changelog or security tracking doc referencing
github.com/mattn/go-sqlite3 and the CVE IDs CVE-2025-29087 and CVE-2025-6965 so
we can monitor future advisories.

{"welcome", "d-b425f024e6554c5ba2b4d03ab0a8b25d"},
{"kyb_approval", "d-5ebb862274214ba79eae226c09300aa7"},
{"kyb_rejection", "d-6917f9c32105467b8dd806a5a3dd32dc"},
{"partner_onboarding_success", "d-XXXXX"},
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Test encodes the placeholder template ID.

This test expects "d-XXXXX" which matches the placeholder in email.go. Once the actual SendGrid template ID is configured, this test expectation should also be updated.

🤖 Prompt for AI Agents
In `@services/email/email_test.go` at line 359, The test currently asserts the
placeholder SendGrid template ID "d-XXXXX" for the "partner_onboarding_success"
template; update the test to expect the real SendGrid template ID once
configured (replace "d-XXXXX" with the actual ID), or better: reference the same
template-ID constant/mapping used in email.go (e.g., the templates/TemplateIDs
map or the variable that holds the template mapping) instead of hardcoding
"d-XXXXX" so the test stays correct when the template ID is updated.

"kyb_approval": "d-5ebb862274214ba79eae226c09300aa7",
"kyb_rejection": "d-6917f9c32105467b8dd806a5a3dd32dc",
"webhook_failure": "d-da75eee4966544ad92dcd060421d4e12",
"partner_onboarding_success": "d-XXXXX",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

# First, find and examine the email.go file
fd "email.go" | head -20

Repository: paycrest/aggregator

Length of output: 86


🏁 Script executed:

# Check if the services/email/email.go file exists and examine it
if [ -f "services/email/email.go" ]; then
  wc -l "services/email/email.go"
fi

Repository: paycrest/aggregator

Length of output: 90


🏁 Script executed:

# Read the specific area around line 242
sed -n '235,250p' services/email/email.go

Repository: paycrest/aggregator

Length of output: 794


🏁 Script executed:

# Search for all SendGrid template ID patterns in the file
rg 'd-[A-Za-z0-9]+' services/email/email.go -A 1 -B 1

Repository: paycrest/aggregator

Length of output: 901


🏁 Script executed:

# Check if there are any configuration files or constants that define SendGrid templates
fd -e "go" -e "env" -e "yml" -e "yaml" -e "json" | xargs rg -l "sendgrid\|template.*id" -i 2>/dev/null | head -20

Repository: paycrest/aggregator

Length of output: 45


Replace placeholder SendGrid template ID before merge.

The "partner_onboarding_success": "d-XXXXX" entry is an incomplete placeholder that will cause SendGrid email delivery to fail in production. All other SendGrid template IDs in this configuration are properly populated with valid hex-format IDs (e.g., d-f26d853bbb884c0c856f0bbda894032c); this one must be updated with the actual SendGrid template ID before the code is merged.

Suggested fix
-			"partner_onboarding_success": "d-XXXXX",
+			"partner_onboarding_success": "d-<actual_sendgrid_template_id>",
🤖 Prompt for AI Agents
In `@services/email/email.go` at line 242, The SendGrid template entry for
"partner_onboarding_success" currently uses a placeholder "d-XXXXX" which will
break email delivery; locate the templates map where the
"partner_onboarding_success" key is defined and replace "d-XXXXX" with the
actual SendGrid template ID in the correct format (e.g., d-<hex> like
d-f26d853bbb884c0c856f0bbda894032c); after updating, verify the ID is the real
one from the SendGrid dashboard (or environment/config) and run a local or
staging send test to confirm the template renders correctly.

@sundayonah sundayonah marked this pull request as draft January 14, 2026 13:59
…andling

- Added a new endpoint for partner onboarding, allowing users to create accounts with associated KYB submissions.
- Introduced validation for partner onboarding payload, ensuring required fields are present and valid.
- Implemented transaction handling for user creation, sender profile generation, and KYB submission, with appropriate error management and rollback mechanisms.
- Enhanced response messages to provide clear feedback on submission status, including success notifications and error handling.
- Updated types to include PartnerOnboardingPayload for structured data handling during onboarding.
return types.SendEmailResponse{Id: "mock-webhook-failure-id"}, nil
}

func (m *mockEmailService) SendPartnerOnboardingSuccessEmail(ctx context.Context, email, firstName, apiKey, password string) (types.SendEmailResponse, error) {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i dont think this is still neccessary here, maybe not in this particular file

Copy link
Collaborator

@Dprof-in-tech Dprof-in-tech left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The implementation looks cool. please test and update your screenshots and pr description

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Streamlined KYB Integration - Referral System, Auto-Verification & Email Automation

3 participants