correct payment stripe - #148

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@components/app/invoices/Invoices.tsx`:
- Around line 1338-1346: The else branch that clears payment state
(setPaymentClientSecret, setPaymentSessionId, setPaymentReceiptId,
setPaymentInvoiceLabel) and invalidates the received-invoices query currently
gives no user feedback; update that branch to also show the same success
toast/notification used in the success path (the one invoked around line 1326)
so users receive confirmation after completing Stripe checkout even when
session/receipt IDs are absent, ensuring the toast is called after state clears
and before/after queryClient.invalidateQueries(['received-invoices']) as
appropriate.

---

Nitpick comments:
In `@components/app/invoices/Invoices.tsx`:
- Around line 254-255: The backend's optional data.receiptId may be undefined
causing the confirmation flow to be skipped; update the call site after
createIndividualCheckoutSession to setPaymentReceiptId(data.receiptId ??
invoice.id) so the invoice.id is used as a fallback while still calling
setPaymentSessionId(data.sessionId); modify the logic around setPaymentReceiptId
in the component to prefer data.receiptId but default to invoice.id to ensure
the confirmation flow (which checks the receipt ID) always runs.
- Around line 1329-1337: When confirmPayment fails in the .catch block, clear
the payment dialog state so stale UI doesn't remain; after showing the toast
call the same state-reset logic used on successful close — e.g. call
setIsPaymentDialogOpen(false) (or the component's equivalent),
resetPaymentForm() (or clear payment form fields),
setSelectedPaymentMethod(null), and setPaymentProcessing(false) so the dialog
closes and internal payment-related state is cleared; reference the
confirmPayment catch handler and the state setters/reset helpers used elsewhere
in Invoices.tsx (like setIsPaymentDialogOpen, resetPaymentForm,
setSelectedPaymentMethod) to implement the cleanup.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@test/Invoices.test.tsx`:
- Around line 26-72: Add tests exercising the checkout-completion flow in
Invoices: simulate the component behavior when a checkout completion is detected
(e.g., URL query params or props that trigger the flow), mock the confirmPayment
function to return success and failure cases, mock/session storage helpers that
persist session/receipt (e.g., persistSession or persistReceipt) and ensure they
are read then cleared, and mock the cache invalidation function (e.g.,
invalidateQueries) and toast helpers (e.g., showToastSuccess/showToastError).
For success: assert confirmPayment is called, invalidateQueries is invoked,
session/receipt persistence is removed, and success toast was shown; for
failure: assert confirmPayment was called, cleanup still runs, and error toast
was shown. Use the Invoices component render with RTL, jest.fn() mocks for
confirmPayment/persistence/invalidation/toasts, and simulate the completion
trigger (query param or prop) to validate both success and error paths.

In `@test/Logs.test.tsx`:
- Around line 159-164: The test title and assertion are mismatched: update the
spec for the Logs component so it either (A) is renamed to reflect that it only
verifies the search input (change the it() description) or (B) actually asserts
the "no results" behavior by rendering Logs with an empty logs dataset (pass an
empty logs prop or a mock with zero items) and then asserting the no-results
message is shown (use screen.getByText(...) or getByRole to check the "no
results" string from mockDictionary). Locate the test containing render(<Logs
dictionary={mockDictionary} lang="en" />) and screen.getByPlaceholderText(...)
and apply one of these two fixes.

In `@vitest.config.ts`:
- Line 6: Replace the use of import.meta.dirname by deriving __dirname from the
imported fileURLToPath and path utilities: use fileURLToPath(import.meta.url)
and path.dirname to compute __dirname instead of import.meta.dirname; update the
const __dirname declaration that currently references import.meta.dirname to
call fileURLToPath(import.meta.url) wrapped by path.dirname so it works on Node
versions older than 20.11.0.

---

Nitpick comments:
In `@test/Invoices.test.tsx`:
- Around line 11-15: The test mock for useQuery in test/Invoices.test.tsx is
missing fields the Invoices component reads (isFetching, refetch, isError);
update the vi.mock for '@tanstack/react-query' so the useQuery mock returns the
full contract used by components/app/invoices/Invoices.tsx — include isFetching
(boolean), isError (boolean), and refetch (vi.fn() or async noop) alongside
data/isLoading/error; keep sensible defaults (false/undefined) and use vi.fn()
for refetch to avoid undefined behavior in tests.

In `@vitest.setup.ts`:
- Line 6: The test env sets NEXT_PUBLIC_BACKEND to 'http://localhost:3000' which
doesn't include the app's API base path used in lib/requests.ts (the code that
appends '/api' to requests), causing path mismatches in tests; update the value
in vitest.setup.ts to include the same API base (for example
'http://localhost:3000/api') so tests use the same base path as the
request-building logic (referencing NEXT_PUBLIC_BACKEND and lib/requests.ts).

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.dockerignore:
- Around line 1-11: The .dockerignore currently omits common build artifacts but
not environment files, which risks leaking secrets into Docker build context;
update the .dockerignore (the file named ".dockerignore" itself) to explicitly
ignore environment files by adding entries such as .env, *.env, .env.*,
.env.local, .env.production, .env.development, .env.test, and any
project-specific secret filenames so they are excluded from the build context
and image layers.

In `@app/api/metrics/route.ts`:
- Around line 7-25: Move the call to collectDefaultMetrics out of the GET
handler and into module initialization so it runs once per process (e.g., call
collectDefaultMetrics({ register }) at top-level when the module loads), remove
the try-catch around register.metrics() in the GET function, and have GET simply
await register.metrics() and return it with the appropriate headers; refer to
collectDefaultMetrics, register, and the exported GET function when making the
change.

In `@app/layout.tsx`:
- Around line 2-3: The current change mocks next/font by replacing imports for
Geist, Geist_Mono, and Noto_Sans_Arabic with literal class tokens, which
prevents CSS variables and fonts from loading; restore the proper font loader
usage by re-importing from next/font/google (or switch to next/font/local with
checked-in files if build-time network access is blocked) and use the actual
loader output (the objects returned by Geist, Geist_Mono, Noto_Sans_Arabic) for
the variable property and className wherever you set
variable="--font-geist-sans" or similar so the generated class names and CSS
variables are applied; update the places referenced in the diff (the import
lines and the variable/className usages around lines noted) to use the real font
objects.

In `@docker-compose-jenkins.yml`:
- Around line 5-12: The compose snippet exposes a host-compromise path by using
privileged: true, user: root and binding /var/run/docker.sock; remove
privileged: true and user: root entries and stop mounting the host Docker socket
directly (the privileged/user symbols and the volumes entry referencing
/var/run/docker.sock), and instead add a controlled Docker-in-Docker sidecar
(e.g., image docker:dind) or a docker socket proxy and configure the Jenkins
container to use DOCKER_HOST (tcp) to talk to that sidecar over the compose
network; ensure the sidecar is hardened (use TLS or an authenticated proxy) and
keep the jenkins_home volume mount but avoid granting host root or direct socket
access.
- Around line 13-14: The compose file currently hardcodes Windows developer
paths in the workspace mounts; replace those two host-specific bindings (the
lines mounting C:\Users\Asus\Desktop\accountia-web and accountia-api) with
parameterized values or named volumes so other hosts/agents can run the stack.
Update the volume entries to use environment variables like
${WORKSPACE_ACCOUNTIA_WEB} and ${WORKSPACE_ACCOUNTIA_API} (and add them to the
.env or CI agent env), or switch to named volumes such as
jenkins_workspace_accountia_web and jenkins_workspace_accountia_api and create
those volumes in the compose file; ensure any documentation or .env.example is
updated so agents know to set the paths.

In `@docker-compose-monitoring.yml`:
- Line 5: Replace the three image tags that use :latest (e.g., "image:
prom/prometheus:latest" and the Grafana and AlertManager lines) with explicit
versioned tags to ensure reproducible deployments, and remove the hardcoded
Grafana admin credential by wiring GF_SECURITY_ADMIN_PASSWORD to an environment
variable or secret (e.g., GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD})
instead of using "admin"; also add GF_USERS_ALLOW_SIGN_UP=false and require the
deployer to supply a strong 12+ character password via the
GRAFANA_ADMIN_PASSWORD secret/ENV rather than embedding it in the compose file.

In `@Dockerfile`:
- Around line 16-26: The final image currently runs as root; create and use a
non-root user in the runner stage by adding a user (e.g., "appuser" or "node"),
chown the application directory (WORKDIR /app) and any copied files to that user
after the COPY steps, and set USER to that user before EXPOSE/CMD so the
container no longer runs as root; update Dockerfile runner stage (WORKDIR, COPY
lines, EXPOSE, CMD) to include the user creation, chown, and USER instruction.
- Around line 19-23: The runtime image is missing env.js which next.config.ts
imports (causing module resolution errors when running next start); update the
Dockerfile runtime COPY stage to also COPY --from=builder /app/env.js ./ (i.e.,
include env.js alongside next.config.ts and package.json) so env.js is present
at runtime for next.config.ts to import.

In `@Jenkinsfile`:
- Around line 11-12: Replace hardcoded SOURCE_DIR and any other hardcoded
workspace references (e.g., the value assigned to SOURCE_DIR and similar uses
around lines referenced) with Jenkins' provided environment variable
${WORKSPACE}; update BUILD_DIR usage if it assumes a fixed source path by
deriving it from ${WORKSPACE} or using WORKSPACE for any workspace-relative
operations. Locate assignments to SOURCE_DIR and any occurrences of the
hardcoded path in the Jenkinsfile and substitute them to reference the WORKSPACE
variable so the pipeline works across multibranch and different agents.
- Line 39: Remove the "|| true" that is suppressing failures in the pipeline:
locate the shell invocations using the pattern "sh 'npm run lint:check || true'"
(and the other occurrence with "|| true") and change them to simply run the
command without "|| true" so the Jenkins step fails on lint/test errors; if you
need to capture output while still failing, run the command normally and rely on
Jenkins to report the non-zero exit code or explicitly check the exit status
after the command.
- Around line 53-62: After running the SonarQube scanner in the "SonarQube
Analysis" stage, add a blocking quality-gate check by invoking
waitForQualityGate() inside the withSonarQubeEnv context (or immediately after
the scanner run) so the pipeline fails when the SonarQube quality gate is not
met; update the stage that calls sh "${SCANNER_HOME}/bin/sonar-scanner" to call
waitForQualityGate() and handle the returned result (or throw an error) to
prevent later "Docker Build" / "Deploy" stages from running on failed quality
gates.

---

Duplicate comments:
In `@vitest.config.ts`:
- Line 5: Replace the unsafe use of import.meta.dirname when deriving __dirname:
locate the declaration of the __dirname variable (currently set via
import.meta.dirname) and change it to compute __dirname using
fileURLToPath(import.meta.url) combined with path.dirname; ensure you import or
reference fileURLToPath and path (from 'url' and 'path' respectively) as needed
so __dirname is derived with path.dirname(fileURLToPath(import.meta.url)).

---

Nitpick comments:
In @.github/workflows/ci.yml:
- Around line 17-20: The CI uses the "Setup Bun" step with bun-version: latest
which risks non-reproducible failures; update the GitHub Actions steps that use
oven-sh/setup-bun@v1 (both occurrences of the "Setup Bun" step) to pin
bun-version to a specific stable release (for example "1.3.13") instead of
"latest" so builds/lints/tests are reproducible across CI runs.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@sonar-project.properties`:
- Line 13: Remove the hardcoded Sonar token from sonar.login in
sonar-project.properties and replace its usage with an environment-based
approach (e.g., read SONAR_TOKEN from CI/agent or pass -Dsonar.login at scan
time); revoke/rotate the exposed token immediately, remove the secret from the
repo (rewrite history or use git-secrets to purge), and update build/CI
configuration to inject SONAR_TOKEN securely so sonar.login is no longer stored
in source.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Jenkinsfile`:
- Around line 63-64: Remove the hardcoded Sonar token from
sonar-project.properties (the sonar.login entry) and ensure the pipeline uses
Jenkins-managed credentials via withSonarQubeEnv('SonarQube') so the scanner run
(sh "${SCANNER_HOME}/bin/sonar-scanner") picks up the token from the
environment; update or remove any sonar.login lines in sonar-project.properties
and, if needed, set SONAR_TOKEN/sonar.login only via Jenkins credentials binding
or the SonarQube server configuration so no secret is stored in the repo.
- Around line 74-75: The pipeline currently tags and deploys the mutable
"latest" image which can cause wrong images to roll out; update the Docker
workflow so the deployment step uses the immutable tag built with
${BUILD_NUMBER} instead of ${DOCKER_IMAGE}:latest — i.e., ensure the build (sh
"docker build -t ${DOCKER_IMAGE}:${BUILD_NUMBER} .") and subsequent
tagging/deploy steps reference ${DOCKER_IMAGE}:${BUILD_NUMBER} (or remove the
automatic latest tag) so deployments always use the exact BUILD_NUMBER image.

---

Duplicate comments:
In `@Jenkinsfile`:
- Around line 11-12: The Jenkinsfile currently hardcodes SOURCE_DIR and
BUILD_DIR (SOURCE_DIR = "/var/jenkins_home/workspace/accountia-web", BUILD_DIR =
"/tmp/accountia_build"), which breaks on different agents and multibranch jobs;
change SOURCE_DIR to use the Jenkins workspace variable (e.g., set SOURCE_DIR =
"${WORKSPACE}" or use pwd() where SOURCE_DIR is referenced) and make BUILD_DIR
workspace-relative (e.g., "${WORKSPACE}/tmp/accountia_build" or
"${WORKSPACE}/build") so all workspace operations use Jenkins-provided paths;
update every occurrence of SOURCE_DIR and BUILD_DIR in the Jenkinsfile
(including other instances noted around lines 22 and 82) to reference these
variables.
- Line 45: The CI lint/test stages currently append "|| true" to the shell steps
(e.g., the sh lines containing "npm run lint:check || true" and the similar
command at the other occurrence), which masks failures; remove the "|| true"
from those sh commands in the Jenkinsfile so that failed lint or test commands
cause the pipeline to fail (ensure you update both occurrences).
- Around line 59-68: Add a blocking quality-gate wait after the SonarQube
analysis so the pipeline fails when the gate is not OK: inside the "SonarQube
Analysis" stage after running withSonarQubeEnv and sh
"${SCANNER_HOME}/bin/sonar-scanner", call waitForQualityGate() (optionally
wrapped in a timeout) and throw an error / error out the build if the returned
status is not "OK"; update the stage that currently uses withSonarQubeEnv and sh
to include this check so downstream Docker/build/deploy stages are prevented
when the quality gate fails.