Fix/social binding bug

[coodos]

Summary

• Fix social binding bug in scan QR logic and binding document service
• Remove debug push token display section from the onboarding screen
• Remove unused pushToken, pushTokenLoading, pushTokenError variables and NotificationService import from onboarding

Test plan

• Verify onboarding screen no longer shows push token debug info
• Verify social binding flow works correctly after scan QR changes
• Build completes without errors (pnpm build)

Summary by CodeRabbit

• Bug Fixes

  • Enhanced error handling and validation for binding document verification process.

• Chores

  • Removed push token display from the onboarding flow.
  • Added comprehensive debug logging to improve observability of social binding and signing operations.

[coderabbitai]

Warning

Rate limit exceeded

@coodos has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 19 minutes and 53 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 96edc5f1-1015-4540-bc24-37df71a009dd

📥 Commits

Reviewing files that changed from the base of the PR and between a6c8007 and bc5c0a7.

📒 Files selected for processing (1)

• infrastructure/evault-core/src/services/BindingDocumentService.ts

📝 Walkthrough

Walkthrough

Adds debug console logging to social binding signing and verification flows and removes push-token retrieval/display from the onboarding page; no public API changes or control-flow alterations beyond added logs and minor missing-registry handling.

Changes

Cohort / File(s)	Summary
Social binding logging infrastructure/eid-wallet/src/lib/utils/socialBinding.ts, infrastructure/eid-wallet/src/routes/(app)/scan-qr/scanLogic.ts	Inserted console.log statements to emit signing payloads and signature previews before/after signing and prior to mutation submission. No functional changes to signing or mutation logic.
Verification & binding service logging infrastructure/evault-core/src/services/BindingDocumentService.ts	Added defensive checks and extensive debug logs in verifyUserSignature and createBindingDocument, including signer, signature prefix, payload excerpts, registryUrl presence, and final verdict logs; added error logging on exceptions.
Onboarding cleanup infrastructure/eid-wallet/src/routes/(auth)/onboarding/+page.svelte	Removed NotificationService import and all push-token state, retrieval, error handling, and UI output related to push tokens.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• feat: add parties and relation_description to social_connection binding document #909: Adds/newly touches parties and relationDescription fields that are now logged in the social binding signing flow.
• chore: signing bug #315: Modifies QR-scan signing flow; related to logging added around the same signing code paths.
• Feat/signature verification library #464: Introduces signature-verification changes that intersect with added verification logging and error handling.

Suggested labels

evault-refactor

Suggested reviewers

• sosweetham

Poem

🐰 I hop through logs with tiny paws,
I print the payloads, trace the cause,
Signatures shimmer, snippets shown,
Old push tokens softly blown,
Hooray — a cleaner debugging lawn!

🚥 Pre-merge checks | ❌ 3

❌ Failed checks (2 warnings, 1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The PR description is partially complete but does not follow the required template structure with sections like 'Issue Number', 'Type of change', 'How the change has been tested', and a proper 'Change checklist'.	Update the PR description to follow the repository template by adding Issue Number, Type of change (Fix/Chore), How the change has been tested, and completing the Change checklist with all items properly marked.
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check	❓ Inconclusive	The title 'Fix/social binding bug' is vague and does not clearly specify the scope of changes—it mentions fixing a social binding bug but the PR also removes debug push token code from onboarding, making the title incomplete.	Revise the title to be more specific and comprehensive, such as 'Fix social binding bug and remove debug push token code from onboarding' or focus on the primary change if one is deemed more important.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/social-binding-bug

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 4

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@infrastructure/eid-wallet/src/lib/utils/socialBinding.ts`:
- Around line 307-315: The console.log in createSocialConnectionDoc currently
prints sensitive fields (normalizedSubject, normalizedSigner, subjectName,
parties, relationDescription and a fragment of signatureHash); remove this
detailed log and replace it with a fully redacted diagnostic (e.g., log only an
operation identifier, the count of parties, and a redaction marker) so no PII or
signature material is emitted; ensure any remaining log references only
non-sensitive metadata (e.g., parties.length, "social-binding created attempt",
and a hashed or fixed redaction token) and do not include signatureHash or
subjectName.
In `@infrastructure/eid-wallet/src/routes/`(app)/scan-qr/scanLogic.ts:
- Around line 730-748: The debug logs in the social-binding flow leak sensitive
social-graph fields (doc, canonicalPayload/payload, signerEname, requesterEname,
requesterName, relationDescription) and also expose a signature preview from
sig; modify the code around globalState.walletSdkAdapter.signPayload to remove
these detailed console.log calls and instead either (a) completely drop logging
in production, or (b) guard minimal redacted logging behind a debug flag (e.g.,
only log non-sensitive counters or lengths such as payloadLength and
signatureLength) so no names, parties, relation text, or signature fragments are
printed; update/remove the two console.log blocks that reference doc, payload,
signerEname, requesterName, relationDescription, and sig accordingly.
In `@infrastructure/evault-core/src/services/BindingDocumentService.ts`:
- Around line 130-133: The code in BindingDocumentService.verifyUserSignature
currently returns false when this.registryUrl is missing, which masks
configuration errors as signature failures; change this to throw a clear error
(e.g., new Error or a custom Error) when this.registryUrl is not set so the
GraphQL layer surfaces the configuration problem. Locate the verifyUserSignature
method and replace the early return false branch that checks this.registryUrl
with a thrown error message indicating the missing registryUrl/configuration.
- Around line 136-151: The console logs in verifyUserSignature (and the similar
block at lines 235-260) expose sensitive values—signature, payload excerpts,
signer, and expectedHash—so remove or redact them; replace the detailed
console.log calls around verifyUserSignature and any other logging that prints
payload/signature with metadata-only messages (e.g., log function name,
registryBaseUrl, lengths or presence flags, and a redacted boolean like
hasSignature) and never emit actual signature, expectedHash, payload contents,
or social_connection fields (relation_description, names); ensure
verifySignature calls remain unchanged but only log the safe metadata and the
final validity result.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 64d85578-f81f-457a-894a-ec6176226f4d

📥 Commits

Reviewing files that changed from the base of the PR and between b3b1a01 and ca2740c.

⛔ Files ignored due to path filters (1)

• infrastructure/eid-wallet/src-tauri/gen/android/key-shitore.properties is excluded by !**/gen/**

📒 Files selected for processing (4)

• infrastructure/eid-wallet/src/lib/utils/socialBinding.ts
• infrastructure/eid-wallet/src/routes/(app)/scan-qr/scanLogic.ts
• infrastructure/eid-wallet/src/routes/(auth)/onboarding/+page.svelte
• infrastructure/evault-core/src/services/BindingDocumentService.ts

💤 Files with no reviewable changes (1)

• infrastructure/eid-wallet/src/routes/(auth)/onboarding/+page.svelte

[coodos]

Summary

• Fix social binding bug in scan QR logic and binding document service
• Remove debug push token display section from the onboarding screen
• Remove unused pushToken, pushTokenLoading, pushTokenError variables and NotificationService import from onboarding

Test plan

• Verify onboarding screen no longer shows push token debug info
• Verify social binding flow works correctly after scan QR changes
• Build completes without errors (pnpm build)

Summary by CodeRabbit

• Bug Fixes

  • Enhanced error handling and validation for binding document verification process.

• Chores

  • Removed push token display from the onboarding flow.
  • Added comprehensive debug logging to improve observability of social binding and signing operations.

[coderabbitai]

Warning

Rate limit exceeded

@coodos has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 19 minutes and 53 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 96edc5f1-1015-4540-bc24-37df71a009dd

📥 Commits

Reviewing files that changed from the base of the PR and between a6c8007 and bc5c0a7.

📒 Files selected for processing (1)

• infrastructure/evault-core/src/services/BindingDocumentService.ts

📝 Walkthrough

Walkthrough

Adds debug console logging to social binding signing and verification flows and removes push-token retrieval/display from the onboarding page; no public API changes or control-flow alterations beyond added logs and minor missing-registry handling.

Changes

Cohort / File(s)	Summary
Social binding logging infrastructure/eid-wallet/src/lib/utils/socialBinding.ts, infrastructure/eid-wallet/src/routes/(app)/scan-qr/scanLogic.ts	Inserted console.log statements to emit signing payloads and signature previews before/after signing and prior to mutation submission. No functional changes to signing or mutation logic.
Verification & binding service logging infrastructure/evault-core/src/services/BindingDocumentService.ts	Added defensive checks and extensive debug logs in verifyUserSignature and createBindingDocument, including signer, signature prefix, payload excerpts, registryUrl presence, and final verdict logs; added error logging on exceptions.
Onboarding cleanup infrastructure/eid-wallet/src/routes/(auth)/onboarding/+page.svelte	Removed NotificationService import and all push-token state, retrieval, error handling, and UI output related to push tokens.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• feat: add parties and relation_description to social_connection binding document #909: Adds/newly touches parties and relationDescription fields that are now logged in the social binding signing flow.
• chore: signing bug #315: Modifies QR-scan signing flow; related to logging added around the same signing code paths.
• Feat/signature verification library #464: Introduces signature-verification changes that intersect with added verification logging and error handling.

Suggested labels

evault-refactor

Suggested reviewers

• sosweetham

Poem

🐰 I hop through logs with tiny paws,
I print the payloads, trace the cause,
Signatures shimmer, snippets shown,
Old push tokens softly blown,
Hooray — a cleaner debugging lawn!

🚥 Pre-merge checks | ❌ 3

❌ Failed checks (2 warnings, 1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The PR description is partially complete but does not follow the required template structure with sections like 'Issue Number', 'Type of change', 'How the change has been tested', and a proper 'Change checklist'.	Update the PR description to follow the repository template by adding Issue Number, Type of change (Fix/Chore), How the change has been tested, and completing the Change checklist with all items properly marked.
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check	❓ Inconclusive	The title 'Fix/social binding bug' is vague and does not clearly specify the scope of changes—it mentions fixing a social binding bug but the PR also removes debug push token code from onboarding, making the title incomplete.	Revise the title to be more specific and comprehensive, such as 'Fix social binding bug and remove debug push token code from onboarding' or focus on the primary change if one is deemed more important.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/social-binding-bug

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 4

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@infrastructure/eid-wallet/src/lib/utils/socialBinding.ts`:
- Around line 307-315: The console.log in createSocialConnectionDoc currently
prints sensitive fields (normalizedSubject, normalizedSigner, subjectName,
parties, relationDescription and a fragment of signatureHash); remove this
detailed log and replace it with a fully redacted diagnostic (e.g., log only an
operation identifier, the count of parties, and a redaction marker) so no PII or
signature material is emitted; ensure any remaining log references only
non-sensitive metadata (e.g., parties.length, "social-binding created attempt",
and a hashed or fixed redaction token) and do not include signatureHash or
subjectName.
In `@infrastructure/eid-wallet/src/routes/`(app)/scan-qr/scanLogic.ts:
- Around line 730-748: The debug logs in the social-binding flow leak sensitive
social-graph fields (doc, canonicalPayload/payload, signerEname, requesterEname,
requesterName, relationDescription) and also expose a signature preview from
sig; modify the code around globalState.walletSdkAdapter.signPayload to remove
these detailed console.log calls and instead either (a) completely drop logging
in production, or (b) guard minimal redacted logging behind a debug flag (e.g.,
only log non-sensitive counters or lengths such as payloadLength and
signatureLength) so no names, parties, relation text, or signature fragments are
printed; update/remove the two console.log blocks that reference doc, payload,
signerEname, requesterName, relationDescription, and sig accordingly.
In `@infrastructure/evault-core/src/services/BindingDocumentService.ts`:
- Around line 130-133: The code in BindingDocumentService.verifyUserSignature
currently returns false when this.registryUrl is missing, which masks
configuration errors as signature failures; change this to throw a clear error
(e.g., new Error or a custom Error) when this.registryUrl is not set so the
GraphQL layer surfaces the configuration problem. Locate the verifyUserSignature
method and replace the early return false branch that checks this.registryUrl
with a thrown error message indicating the missing registryUrl/configuration.
- Around line 136-151: The console logs in verifyUserSignature (and the similar
block at lines 235-260) expose sensitive values—signature, payload excerpts,
signer, and expectedHash—so remove or redact them; replace the detailed
console.log calls around verifyUserSignature and any other logging that prints
payload/signature with metadata-only messages (e.g., log function name,
registryBaseUrl, lengths or presence flags, and a redacted boolean like
hasSignature) and never emit actual signature, expectedHash, payload contents,
or social_connection fields (relation_description, names); ensure
verifySignature calls remain unchanged but only log the safe metadata and the
final validity result.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 64d85578-f81f-457a-894a-ec6176226f4d

📥 Commits

Reviewing files that changed from the base of the PR and between b3b1a01 and ca2740c.

⛔ Files ignored due to path filters (1)

• infrastructure/eid-wallet/src-tauri/gen/android/key-shitore.properties is excluded by !**/gen/**

📒 Files selected for processing (4)

• infrastructure/eid-wallet/src/lib/utils/socialBinding.ts
• infrastructure/eid-wallet/src/routes/(app)/scan-qr/scanLogic.ts
• infrastructure/eid-wallet/src/routes/(auth)/onboarding/+page.svelte
• infrastructure/evault-core/src/services/BindingDocumentService.ts

💤 Files with no reviewable changes (1)

• infrastructure/eid-wallet/src/routes/(auth)/onboarding/+page.svelte

[coodos]

Summary

• Fix social binding bug in scan QR logic and binding document service
• Remove debug push token display section from the onboarding screen
• Remove unused pushToken, pushTokenLoading, pushTokenError variables and NotificationService import from onboarding

Test plan

• Verify onboarding screen no longer shows push token debug info
• Verify social binding flow works correctly after scan QR changes
• Build completes without errors (pnpm build)

Summary by CodeRabbit

• Bug Fixes

  • Enhanced error handling and validation for binding document verification process.

• Chores

  • Removed push token display from the onboarding flow.
  • Added comprehensive debug logging to improve observability of social binding and signing operations.

[coderabbitai]

Warning

Rate limit exceeded

@coodos has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 19 minutes and 53 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 96edc5f1-1015-4540-bc24-37df71a009dd

📥 Commits

Reviewing files that changed from the base of the PR and between a6c8007 and bc5c0a7.

📒 Files selected for processing (1)

• infrastructure/evault-core/src/services/BindingDocumentService.ts

📝 Walkthrough

Walkthrough

Adds debug console logging to social binding signing and verification flows and removes push-token retrieval/display from the onboarding page; no public API changes or control-flow alterations beyond added logs and minor missing-registry handling.

Changes

Cohort / File(s)	Summary
Social binding logging infrastructure/eid-wallet/src/lib/utils/socialBinding.ts, infrastructure/eid-wallet/src/routes/(app)/scan-qr/scanLogic.ts	Inserted console.log statements to emit signing payloads and signature previews before/after signing and prior to mutation submission. No functional changes to signing or mutation logic.
Verification & binding service logging infrastructure/evault-core/src/services/BindingDocumentService.ts	Added defensive checks and extensive debug logs in verifyUserSignature and createBindingDocument, including signer, signature prefix, payload excerpts, registryUrl presence, and final verdict logs; added error logging on exceptions.
Onboarding cleanup infrastructure/eid-wallet/src/routes/(auth)/onboarding/+page.svelte	Removed NotificationService import and all push-token state, retrieval, error handling, and UI output related to push tokens.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• feat: add parties and relation_description to social_connection binding document #909: Adds/newly touches parties and relationDescription fields that are now logged in the social binding signing flow.
• chore: signing bug #315: Modifies QR-scan signing flow; related to logging added around the same signing code paths.
• Feat/signature verification library #464: Introduces signature-verification changes that intersect with added verification logging and error handling.

Suggested labels

evault-refactor

Suggested reviewers

• sosweetham

Poem

🐰 I hop through logs with tiny paws,
I print the payloads, trace the cause,
Signatures shimmer, snippets shown,
Old push tokens softly blown,
Hooray — a cleaner debugging lawn!

🚥 Pre-merge checks | ❌ 3

❌ Failed checks (2 warnings, 1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The PR description is partially complete but does not follow the required template structure with sections like 'Issue Number', 'Type of change', 'How the change has been tested', and a proper 'Change checklist'.	Update the PR description to follow the repository template by adding Issue Number, Type of change (Fix/Chore), How the change has been tested, and completing the Change checklist with all items properly marked.
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check	❓ Inconclusive	The title 'Fix/social binding bug' is vague and does not clearly specify the scope of changes—it mentions fixing a social binding bug but the PR also removes debug push token code from onboarding, making the title incomplete.	Revise the title to be more specific and comprehensive, such as 'Fix social binding bug and remove debug push token code from onboarding' or focus on the primary change if one is deemed more important.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/social-binding-bug

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 4

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@infrastructure/eid-wallet/src/lib/utils/socialBinding.ts`:
- Around line 307-315: The console.log in createSocialConnectionDoc currently
prints sensitive fields (normalizedSubject, normalizedSigner, subjectName,
parties, relationDescription and a fragment of signatureHash); remove this
detailed log and replace it with a fully redacted diagnostic (e.g., log only an
operation identifier, the count of parties, and a redaction marker) so no PII or
signature material is emitted; ensure any remaining log references only
non-sensitive metadata (e.g., parties.length, "social-binding created attempt",
and a hashed or fixed redaction token) and do not include signatureHash or
subjectName.
In `@infrastructure/eid-wallet/src/routes/`(app)/scan-qr/scanLogic.ts:
- Around line 730-748: The debug logs in the social-binding flow leak sensitive
social-graph fields (doc, canonicalPayload/payload, signerEname, requesterEname,
requesterName, relationDescription) and also expose a signature preview from
sig; modify the code around globalState.walletSdkAdapter.signPayload to remove
these detailed console.log calls and instead either (a) completely drop logging
in production, or (b) guard minimal redacted logging behind a debug flag (e.g.,
only log non-sensitive counters or lengths such as payloadLength and
signatureLength) so no names, parties, relation text, or signature fragments are
printed; update/remove the two console.log blocks that reference doc, payload,
signerEname, requesterName, relationDescription, and sig accordingly.
In `@infrastructure/evault-core/src/services/BindingDocumentService.ts`:
- Around line 130-133: The code in BindingDocumentService.verifyUserSignature
currently returns false when this.registryUrl is missing, which masks
configuration errors as signature failures; change this to throw a clear error
(e.g., new Error or a custom Error) when this.registryUrl is not set so the
GraphQL layer surfaces the configuration problem. Locate the verifyUserSignature
method and replace the early return false branch that checks this.registryUrl
with a thrown error message indicating the missing registryUrl/configuration.
- Around line 136-151: The console logs in verifyUserSignature (and the similar
block at lines 235-260) expose sensitive values—signature, payload excerpts,
signer, and expectedHash—so remove or redact them; replace the detailed
console.log calls around verifyUserSignature and any other logging that prints
payload/signature with metadata-only messages (e.g., log function name,
registryBaseUrl, lengths or presence flags, and a redacted boolean like
hasSignature) and never emit actual signature, expectedHash, payload contents,
or social_connection fields (relation_description, names); ensure
verifySignature calls remain unchanged but only log the safe metadata and the
final validity result.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 64d85578-f81f-457a-894a-ec6176226f4d

📥 Commits

Reviewing files that changed from the base of the PR and between b3b1a01 and ca2740c.

⛔ Files ignored due to path filters (1)

• infrastructure/eid-wallet/src-tauri/gen/android/key-shitore.properties is excluded by !**/gen/**

📒 Files selected for processing (4)

• infrastructure/eid-wallet/src/lib/utils/socialBinding.ts
• infrastructure/eid-wallet/src/routes/(app)/scan-qr/scanLogic.ts
• infrastructure/eid-wallet/src/routes/(auth)/onboarding/+page.svelte
• infrastructure/evault-core/src/services/BindingDocumentService.ts

💤 Files with no reviewable changes (1)

• infrastructure/eid-wallet/src/routes/(auth)/onboarding/+page.svelte

[coodos]

Summary

• Fix social binding bug in scan QR logic and binding document service
• Remove debug push token display section from the onboarding screen
• Remove unused pushToken, pushTokenLoading, pushTokenError variables and NotificationService import from onboarding

Test plan

• Verify onboarding screen no longer shows push token debug info
• Verify social binding flow works correctly after scan QR changes
• Build completes without errors (pnpm build)

Summary by CodeRabbit

• Bug Fixes

  • Enhanced error handling and validation for binding document verification process.

• Chores

  • Removed push token display from the onboarding flow.
  • Added comprehensive debug logging to improve observability of social binding and signing operations.

[coderabbitai]

Warning

Rate limit exceeded

@coodos has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 19 minutes and 53 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 96edc5f1-1015-4540-bc24-37df71a009dd

📥 Commits

Reviewing files that changed from the base of the PR and between a6c8007 and bc5c0a7.

📒 Files selected for processing (1)

• infrastructure/evault-core/src/services/BindingDocumentService.ts

📝 Walkthrough

Walkthrough

Adds debug console logging to social binding signing and verification flows and removes push-token retrieval/display from the onboarding page; no public API changes or control-flow alterations beyond added logs and minor missing-registry handling.

Changes

Cohort / File(s)	Summary
Social binding logging infrastructure/eid-wallet/src/lib/utils/socialBinding.ts, infrastructure/eid-wallet/src/routes/(app)/scan-qr/scanLogic.ts	Inserted console.log statements to emit signing payloads and signature previews before/after signing and prior to mutation submission. No functional changes to signing or mutation logic.
Verification & binding service logging infrastructure/evault-core/src/services/BindingDocumentService.ts	Added defensive checks and extensive debug logs in verifyUserSignature and createBindingDocument, including signer, signature prefix, payload excerpts, registryUrl presence, and final verdict logs; added error logging on exceptions.
Onboarding cleanup infrastructure/eid-wallet/src/routes/(auth)/onboarding/+page.svelte	Removed NotificationService import and all push-token state, retrieval, error handling, and UI output related to push tokens.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• feat: add parties and relation_description to social_connection binding document #909: Adds/newly touches parties and relationDescription fields that are now logged in the social binding signing flow.
• chore: signing bug #315: Modifies QR-scan signing flow; related to logging added around the same signing code paths.
• Feat/signature verification library #464: Introduces signature-verification changes that intersect with added verification logging and error handling.

Suggested labels

evault-refactor

Suggested reviewers

• sosweetham

Poem

🐰 I hop through logs with tiny paws,
I print the payloads, trace the cause,
Signatures shimmer, snippets shown,
Old push tokens softly blown,
Hooray — a cleaner debugging lawn!

🚥 Pre-merge checks | ❌ 3

❌ Failed checks (2 warnings, 1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The PR description is partially complete but does not follow the required template structure with sections like 'Issue Number', 'Type of change', 'How the change has been tested', and a proper 'Change checklist'.	Update the PR description to follow the repository template by adding Issue Number, Type of change (Fix/Chore), How the change has been tested, and completing the Change checklist with all items properly marked.
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check	❓ Inconclusive	The title 'Fix/social binding bug' is vague and does not clearly specify the scope of changes—it mentions fixing a social binding bug but the PR also removes debug push token code from onboarding, making the title incomplete.	Revise the title to be more specific and comprehensive, such as 'Fix social binding bug and remove debug push token code from onboarding' or focus on the primary change if one is deemed more important.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/social-binding-bug

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 4

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@infrastructure/eid-wallet/src/lib/utils/socialBinding.ts`:
- Around line 307-315: The console.log in createSocialConnectionDoc currently
prints sensitive fields (normalizedSubject, normalizedSigner, subjectName,
parties, relationDescription and a fragment of signatureHash); remove this
detailed log and replace it with a fully redacted diagnostic (e.g., log only an
operation identifier, the count of parties, and a redaction marker) so no PII or
signature material is emitted; ensure any remaining log references only
non-sensitive metadata (e.g., parties.length, "social-binding created attempt",
and a hashed or fixed redaction token) and do not include signatureHash or
subjectName.
In `@infrastructure/eid-wallet/src/routes/`(app)/scan-qr/scanLogic.ts:
- Around line 730-748: The debug logs in the social-binding flow leak sensitive
social-graph fields (doc, canonicalPayload/payload, signerEname, requesterEname,
requesterName, relationDescription) and also expose a signature preview from
sig; modify the code around globalState.walletSdkAdapter.signPayload to remove
these detailed console.log calls and instead either (a) completely drop logging
in production, or (b) guard minimal redacted logging behind a debug flag (e.g.,
only log non-sensitive counters or lengths such as payloadLength and
signatureLength) so no names, parties, relation text, or signature fragments are
printed; update/remove the two console.log blocks that reference doc, payload,
signerEname, requesterName, relationDescription, and sig accordingly.
In `@infrastructure/evault-core/src/services/BindingDocumentService.ts`:
- Around line 130-133: The code in BindingDocumentService.verifyUserSignature
currently returns false when this.registryUrl is missing, which masks
configuration errors as signature failures; change this to throw a clear error
(e.g., new Error or a custom Error) when this.registryUrl is not set so the
GraphQL layer surfaces the configuration problem. Locate the verifyUserSignature
method and replace the early return false branch that checks this.registryUrl
with a thrown error message indicating the missing registryUrl/configuration.
- Around line 136-151: The console logs in verifyUserSignature (and the similar
block at lines 235-260) expose sensitive values—signature, payload excerpts,
signer, and expectedHash—so remove or redact them; replace the detailed
console.log calls around verifyUserSignature and any other logging that prints
payload/signature with metadata-only messages (e.g., log function name,
registryBaseUrl, lengths or presence flags, and a redacted boolean like
hasSignature) and never emit actual signature, expectedHash, payload contents,
or social_connection fields (relation_description, names); ensure
verifySignature calls remain unchanged but only log the safe metadata and the
final validity result.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 64d85578-f81f-457a-894a-ec6176226f4d

📥 Commits

Reviewing files that changed from the base of the PR and between b3b1a01 and ca2740c.

⛔ Files ignored due to path filters (1)

• infrastructure/eid-wallet/src-tauri/gen/android/key-shitore.properties is excluded by !**/gen/**

📒 Files selected for processing (4)

• infrastructure/eid-wallet/src/lib/utils/socialBinding.ts
• infrastructure/eid-wallet/src/routes/(app)/scan-qr/scanLogic.ts
• infrastructure/eid-wallet/src/routes/(auth)/onboarding/+page.svelte
• infrastructure/evault-core/src/services/BindingDocumentService.ts

💤 Files with no reviewable changes (1)

• infrastructure/eid-wallet/src/routes/(auth)/onboarding/+page.svelte

[coodos]

Summary

• Fix social binding bug in scan QR logic and binding document service
• Remove debug push token display section from the onboarding screen
• Remove unused pushToken, pushTokenLoading, pushTokenError variables and NotificationService import from onboarding

Test plan

• Verify onboarding screen no longer shows push token debug info
• Verify social binding flow works correctly after scan QR changes
• Build completes without errors (pnpm build)

Summary by CodeRabbit

• Bug Fixes

  • Enhanced error handling and validation for binding document verification process.

• Chores

  • Removed push token display from the onboarding flow.
  • Added comprehensive debug logging to improve observability of social binding and signing operations.

[coderabbitai]

Warning

Rate limit exceeded

@coodos has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 19 minutes and 53 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 96edc5f1-1015-4540-bc24-37df71a009dd

📥 Commits

Reviewing files that changed from the base of the PR and between a6c8007 and bc5c0a7.

📒 Files selected for processing (1)

• infrastructure/evault-core/src/services/BindingDocumentService.ts

📝 Walkthrough

Walkthrough

Adds debug console logging to social binding signing and verification flows and removes push-token retrieval/display from the onboarding page; no public API changes or control-flow alterations beyond added logs and minor missing-registry handling.

Changes

Cohort / File(s)	Summary
Social binding logging infrastructure/eid-wallet/src/lib/utils/socialBinding.ts, infrastructure/eid-wallet/src/routes/(app)/scan-qr/scanLogic.ts	Inserted console.log statements to emit signing payloads and signature previews before/after signing and prior to mutation submission. No functional changes to signing or mutation logic.
Verification & binding service logging infrastructure/evault-core/src/services/BindingDocumentService.ts	Added defensive checks and extensive debug logs in verifyUserSignature and createBindingDocument, including signer, signature prefix, payload excerpts, registryUrl presence, and final verdict logs; added error logging on exceptions.
Onboarding cleanup infrastructure/eid-wallet/src/routes/(auth)/onboarding/+page.svelte	Removed NotificationService import and all push-token state, retrieval, error handling, and UI output related to push tokens.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• feat: add parties and relation_description to social_connection binding document #909: Adds/newly touches parties and relationDescription fields that are now logged in the social binding signing flow.
• chore: signing bug #315: Modifies QR-scan signing flow; related to logging added around the same signing code paths.
• Feat/signature verification library #464: Introduces signature-verification changes that intersect with added verification logging and error handling.

Suggested labels

evault-refactor

Suggested reviewers

• sosweetham

Poem

🐰 I hop through logs with tiny paws,
I print the payloads, trace the cause,
Signatures shimmer, snippets shown,
Old push tokens softly blown,
Hooray — a cleaner debugging lawn!

🚥 Pre-merge checks | ❌ 3

❌ Failed checks (2 warnings, 1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The PR description is partially complete but does not follow the required template structure with sections like 'Issue Number', 'Type of change', 'How the change has been tested', and a proper 'Change checklist'.	Update the PR description to follow the repository template by adding Issue Number, Type of change (Fix/Chore), How the change has been tested, and completing the Change checklist with all items properly marked.
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check	❓ Inconclusive	The title 'Fix/social binding bug' is vague and does not clearly specify the scope of changes—it mentions fixing a social binding bug but the PR also removes debug push token code from onboarding, making the title incomplete.	Revise the title to be more specific and comprehensive, such as 'Fix social binding bug and remove debug push token code from onboarding' or focus on the primary change if one is deemed more important.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/social-binding-bug

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 4

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@infrastructure/eid-wallet/src/lib/utils/socialBinding.ts`:
- Around line 307-315: The console.log in createSocialConnectionDoc currently
prints sensitive fields (normalizedSubject, normalizedSigner, subjectName,
parties, relationDescription and a fragment of signatureHash); remove this
detailed log and replace it with a fully redacted diagnostic (e.g., log only an
operation identifier, the count of parties, and a redaction marker) so no PII or
signature material is emitted; ensure any remaining log references only
non-sensitive metadata (e.g., parties.length, "social-binding created attempt",
and a hashed or fixed redaction token) and do not include signatureHash or
subjectName.
In `@infrastructure/eid-wallet/src/routes/`(app)/scan-qr/scanLogic.ts:
- Around line 730-748: The debug logs in the social-binding flow leak sensitive
social-graph fields (doc, canonicalPayload/payload, signerEname, requesterEname,
requesterName, relationDescription) and also expose a signature preview from
sig; modify the code around globalState.walletSdkAdapter.signPayload to remove
these detailed console.log calls and instead either (a) completely drop logging
in production, or (b) guard minimal redacted logging behind a debug flag (e.g.,
only log non-sensitive counters or lengths such as payloadLength and
signatureLength) so no names, parties, relation text, or signature fragments are
printed; update/remove the two console.log blocks that reference doc, payload,
signerEname, requesterName, relationDescription, and sig accordingly.
In `@infrastructure/evault-core/src/services/BindingDocumentService.ts`:
- Around line 130-133: The code in BindingDocumentService.verifyUserSignature
currently returns false when this.registryUrl is missing, which masks
configuration errors as signature failures; change this to throw a clear error
(e.g., new Error or a custom Error) when this.registryUrl is not set so the
GraphQL layer surfaces the configuration problem. Locate the verifyUserSignature
method and replace the early return false branch that checks this.registryUrl
with a thrown error message indicating the missing registryUrl/configuration.
- Around line 136-151: The console logs in verifyUserSignature (and the similar
block at lines 235-260) expose sensitive values—signature, payload excerpts,
signer, and expectedHash—so remove or redact them; replace the detailed
console.log calls around verifyUserSignature and any other logging that prints
payload/signature with metadata-only messages (e.g., log function name,
registryBaseUrl, lengths or presence flags, and a redacted boolean like
hasSignature) and never emit actual signature, expectedHash, payload contents,
or social_connection fields (relation_description, names); ensure
verifySignature calls remain unchanged but only log the safe metadata and the
final validity result.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 64d85578-f81f-457a-894a-ec6176226f4d

📥 Commits

Reviewing files that changed from the base of the PR and between b3b1a01 and ca2740c.

⛔ Files ignored due to path filters (1)

• infrastructure/eid-wallet/src-tauri/gen/android/key-shitore.properties is excluded by !**/gen/**

📒 Files selected for processing (4)

• infrastructure/eid-wallet/src/lib/utils/socialBinding.ts
• infrastructure/eid-wallet/src/routes/(app)/scan-qr/scanLogic.ts
• infrastructure/eid-wallet/src/routes/(auth)/onboarding/+page.svelte
• infrastructure/evault-core/src/services/BindingDocumentService.ts

💤 Files with no reviewable changes (1)

• infrastructure/eid-wallet/src/routes/(auth)/onboarding/+page.svelte

[coodos]

Summary

• Fix social binding bug in scan QR logic and binding document service
• Remove debug push token display section from the onboarding screen
• Remove unused pushToken, pushTokenLoading, pushTokenError variables and NotificationService import from onboarding

Test plan

• Verify onboarding screen no longer shows push token debug info
• Verify social binding flow works correctly after scan QR changes
• Build completes without errors (pnpm build)

Summary by CodeRabbit

• Bug Fixes

  • Enhanced error handling and validation for binding document verification process.

• Chores

  • Removed push token display from the onboarding flow.
  • Added comprehensive debug logging to improve observability of social binding and signing operations.

[coderabbitai]

Warning

Rate limit exceeded

@coodos has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 19 minutes and 53 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 96edc5f1-1015-4540-bc24-37df71a009dd

📥 Commits

Reviewing files that changed from the base of the PR and between a6c8007 and bc5c0a7.

📒 Files selected for processing (1)

• infrastructure/evault-core/src/services/BindingDocumentService.ts

📝 Walkthrough

Walkthrough

Adds debug console logging to social binding signing and verification flows and removes push-token retrieval/display from the onboarding page; no public API changes or control-flow alterations beyond added logs and minor missing-registry handling.

Changes

Cohort / File(s)	Summary
Social binding logging infrastructure/eid-wallet/src/lib/utils/socialBinding.ts, infrastructure/eid-wallet/src/routes/(app)/scan-qr/scanLogic.ts	Inserted console.log statements to emit signing payloads and signature previews before/after signing and prior to mutation submission. No functional changes to signing or mutation logic.
Verification & binding service logging infrastructure/evault-core/src/services/BindingDocumentService.ts	Added defensive checks and extensive debug logs in verifyUserSignature and createBindingDocument, including signer, signature prefix, payload excerpts, registryUrl presence, and final verdict logs; added error logging on exceptions.
Onboarding cleanup infrastructure/eid-wallet/src/routes/(auth)/onboarding/+page.svelte	Removed NotificationService import and all push-token state, retrieval, error handling, and UI output related to push tokens.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• feat: add parties and relation_description to social_connection binding document #909: Adds/newly touches parties and relationDescription fields that are now logged in the social binding signing flow.
• chore: signing bug #315: Modifies QR-scan signing flow; related to logging added around the same signing code paths.
• Feat/signature verification library #464: Introduces signature-verification changes that intersect with added verification logging and error handling.

Suggested labels

evault-refactor

Suggested reviewers

• sosweetham

Poem

🐰 I hop through logs with tiny paws,
I print the payloads, trace the cause,
Signatures shimmer, snippets shown,
Old push tokens softly blown,
Hooray — a cleaner debugging lawn!

🚥 Pre-merge checks | ❌ 3

❌ Failed checks (2 warnings, 1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The PR description is partially complete but does not follow the required template structure with sections like 'Issue Number', 'Type of change', 'How the change has been tested', and a proper 'Change checklist'.	Update the PR description to follow the repository template by adding Issue Number, Type of change (Fix/Chore), How the change has been tested, and completing the Change checklist with all items properly marked.
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check	❓ Inconclusive	The title 'Fix/social binding bug' is vague and does not clearly specify the scope of changes—it mentions fixing a social binding bug but the PR also removes debug push token code from onboarding, making the title incomplete.	Revise the title to be more specific and comprehensive, such as 'Fix social binding bug and remove debug push token code from onboarding' or focus on the primary change if one is deemed more important.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/social-binding-bug

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 4

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@infrastructure/eid-wallet/src/lib/utils/socialBinding.ts`:
- Around line 307-315: The console.log in createSocialConnectionDoc currently
prints sensitive fields (normalizedSubject, normalizedSigner, subjectName,
parties, relationDescription and a fragment of signatureHash); remove this
detailed log and replace it with a fully redacted diagnostic (e.g., log only an
operation identifier, the count of parties, and a redaction marker) so no PII or
signature material is emitted; ensure any remaining log references only
non-sensitive metadata (e.g., parties.length, "social-binding created attempt",
and a hashed or fixed redaction token) and do not include signatureHash or
subjectName.
In `@infrastructure/eid-wallet/src/routes/`(app)/scan-qr/scanLogic.ts:
- Around line 730-748: The debug logs in the social-binding flow leak sensitive
social-graph fields (doc, canonicalPayload/payload, signerEname, requesterEname,
requesterName, relationDescription) and also expose a signature preview from
sig; modify the code around globalState.walletSdkAdapter.signPayload to remove
these detailed console.log calls and instead either (a) completely drop logging
in production, or (b) guard minimal redacted logging behind a debug flag (e.g.,
only log non-sensitive counters or lengths such as payloadLength and
signatureLength) so no names, parties, relation text, or signature fragments are
printed; update/remove the two console.log blocks that reference doc, payload,
signerEname, requesterName, relationDescription, and sig accordingly.
In `@infrastructure/evault-core/src/services/BindingDocumentService.ts`:
- Around line 130-133: The code in BindingDocumentService.verifyUserSignature
currently returns false when this.registryUrl is missing, which masks
configuration errors as signature failures; change this to throw a clear error
(e.g., new Error or a custom Error) when this.registryUrl is not set so the
GraphQL layer surfaces the configuration problem. Locate the verifyUserSignature
method and replace the early return false branch that checks this.registryUrl
with a thrown error message indicating the missing registryUrl/configuration.
- Around line 136-151: The console logs in verifyUserSignature (and the similar
block at lines 235-260) expose sensitive values—signature, payload excerpts,
signer, and expectedHash—so remove or redact them; replace the detailed
console.log calls around verifyUserSignature and any other logging that prints
payload/signature with metadata-only messages (e.g., log function name,
registryBaseUrl, lengths or presence flags, and a redacted boolean like
hasSignature) and never emit actual signature, expectedHash, payload contents,
or social_connection fields (relation_description, names); ensure
verifySignature calls remain unchanged but only log the safe metadata and the
final validity result.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 64d85578-f81f-457a-894a-ec6176226f4d

📥 Commits

Reviewing files that changed from the base of the PR and between b3b1a01 and ca2740c.

⛔ Files ignored due to path filters (1)

• infrastructure/eid-wallet/src-tauri/gen/android/key-shitore.properties is excluded by !**/gen/**

📒 Files selected for processing (4)

• infrastructure/eid-wallet/src/lib/utils/socialBinding.ts
• infrastructure/eid-wallet/src/routes/(app)/scan-qr/scanLogic.ts
• infrastructure/eid-wallet/src/routes/(auth)/onboarding/+page.svelte
• infrastructure/evault-core/src/services/BindingDocumentService.ts

💤 Files with no reviewable changes (1)

• infrastructure/eid-wallet/src/routes/(auth)/onboarding/+page.svelte

[coodos]

Summary

• Fix social binding bug in scan QR logic and binding document service
• Remove debug push token display section from the onboarding screen
• Remove unused pushToken, pushTokenLoading, pushTokenError variables and NotificationService import from onboarding

Test plan

• Verify onboarding screen no longer shows push token debug info
• Verify social binding flow works correctly after scan QR changes
• Build completes without errors (pnpm build)

Summary by CodeRabbit

• Bug Fixes

  • Enhanced error handling and validation for binding document verification process.

• Chores

  • Removed push token display from the onboarding flow.
  • Added comprehensive debug logging to improve observability of social binding and signing operations.

[coderabbitai]

Warning

Rate limit exceeded

@coodos has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 19 minutes and 53 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 96edc5f1-1015-4540-bc24-37df71a009dd

📥 Commits

Reviewing files that changed from the base of the PR and between a6c8007 and bc5c0a7.

📒 Files selected for processing (1)

• infrastructure/evault-core/src/services/BindingDocumentService.ts

📝 Walkthrough

Walkthrough

Adds debug console logging to social binding signing and verification flows and removes push-token retrieval/display from the onboarding page; no public API changes or control-flow alterations beyond added logs and minor missing-registry handling.

Changes

Cohort / File(s)	Summary
Social binding logging infrastructure/eid-wallet/src/lib/utils/socialBinding.ts, infrastructure/eid-wallet/src/routes/(app)/scan-qr/scanLogic.ts	Inserted console.log statements to emit signing payloads and signature previews before/after signing and prior to mutation submission. No functional changes to signing or mutation logic.
Verification & binding service logging infrastructure/evault-core/src/services/BindingDocumentService.ts	Added defensive checks and extensive debug logs in verifyUserSignature and createBindingDocument, including signer, signature prefix, payload excerpts, registryUrl presence, and final verdict logs; added error logging on exceptions.
Onboarding cleanup infrastructure/eid-wallet/src/routes/(auth)/onboarding/+page.svelte	Removed NotificationService import and all push-token state, retrieval, error handling, and UI output related to push tokens.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• feat: add parties and relation_description to social_connection binding document #909: Adds/newly touches parties and relationDescription fields that are now logged in the social binding signing flow.
• chore: signing bug #315: Modifies QR-scan signing flow; related to logging added around the same signing code paths.
• Feat/signature verification library #464: Introduces signature-verification changes that intersect with added verification logging and error handling.

Suggested labels

evault-refactor

Suggested reviewers

• sosweetham

Poem

🐰 I hop through logs with tiny paws,
I print the payloads, trace the cause,
Signatures shimmer, snippets shown,
Old push tokens softly blown,
Hooray — a cleaner debugging lawn!

🚥 Pre-merge checks | ❌ 3

❌ Failed checks (2 warnings, 1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The PR description is partially complete but does not follow the required template structure with sections like 'Issue Number', 'Type of change', 'How the change has been tested', and a proper 'Change checklist'.	Update the PR description to follow the repository template by adding Issue Number, Type of change (Fix/Chore), How the change has been tested, and completing the Change checklist with all items properly marked.
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check	❓ Inconclusive	The title 'Fix/social binding bug' is vague and does not clearly specify the scope of changes—it mentions fixing a social binding bug but the PR also removes debug push token code from onboarding, making the title incomplete.	Revise the title to be more specific and comprehensive, such as 'Fix social binding bug and remove debug push token code from onboarding' or focus on the primary change if one is deemed more important.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/social-binding-bug

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 4

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@infrastructure/eid-wallet/src/lib/utils/socialBinding.ts`:
- Around line 307-315: The console.log in createSocialConnectionDoc currently
prints sensitive fields (normalizedSubject, normalizedSigner, subjectName,
parties, relationDescription and a fragment of signatureHash); remove this
detailed log and replace it with a fully redacted diagnostic (e.g., log only an
operation identifier, the count of parties, and a redaction marker) so no PII or
signature material is emitted; ensure any remaining log references only
non-sensitive metadata (e.g., parties.length, "social-binding created attempt",
and a hashed or fixed redaction token) and do not include signatureHash or
subjectName.
In `@infrastructure/eid-wallet/src/routes/`(app)/scan-qr/scanLogic.ts:
- Around line 730-748: The debug logs in the social-binding flow leak sensitive
social-graph fields (doc, canonicalPayload/payload, signerEname, requesterEname,
requesterName, relationDescription) and also expose a signature preview from
sig; modify the code around globalState.walletSdkAdapter.signPayload to remove
these detailed console.log calls and instead either (a) completely drop logging
in production, or (b) guard minimal redacted logging behind a debug flag (e.g.,
only log non-sensitive counters or lengths such as payloadLength and
signatureLength) so no names, parties, relation text, or signature fragments are
printed; update/remove the two console.log blocks that reference doc, payload,
signerEname, requesterName, relationDescription, and sig accordingly.
In `@infrastructure/evault-core/src/services/BindingDocumentService.ts`:
- Around line 130-133: The code in BindingDocumentService.verifyUserSignature
currently returns false when this.registryUrl is missing, which masks
configuration errors as signature failures; change this to throw a clear error
(e.g., new Error or a custom Error) when this.registryUrl is not set so the
GraphQL layer surfaces the configuration problem. Locate the verifyUserSignature
method and replace the early return false branch that checks this.registryUrl
with a thrown error message indicating the missing registryUrl/configuration.
- Around line 136-151: The console logs in verifyUserSignature (and the similar
block at lines 235-260) expose sensitive values—signature, payload excerpts,
signer, and expectedHash—so remove or redact them; replace the detailed
console.log calls around verifyUserSignature and any other logging that prints
payload/signature with metadata-only messages (e.g., log function name,
registryBaseUrl, lengths or presence flags, and a redacted boolean like
hasSignature) and never emit actual signature, expectedHash, payload contents,
or social_connection fields (relation_description, names); ensure
verifySignature calls remain unchanged but only log the safe metadata and the
final validity result.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 64d85578-f81f-457a-894a-ec6176226f4d

📥 Commits

Reviewing files that changed from the base of the PR and between b3b1a01 and ca2740c.

⛔ Files ignored due to path filters (1)

• infrastructure/eid-wallet/src-tauri/gen/android/key-shitore.properties is excluded by !**/gen/**

📒 Files selected for processing (4)

• infrastructure/eid-wallet/src/lib/utils/socialBinding.ts
• infrastructure/eid-wallet/src/routes/(app)/scan-qr/scanLogic.ts
• infrastructure/eid-wallet/src/routes/(auth)/onboarding/+page.svelte
• infrastructure/evault-core/src/services/BindingDocumentService.ts

💤 Files with no reviewable changes (1)

• infrastructure/eid-wallet/src/routes/(auth)/onboarding/+page.svelte

[coodos]

Summary

• Fix social binding bug in scan QR logic and binding document service
• Remove debug push token display section from the onboarding screen
• Remove unused pushToken, pushTokenLoading, pushTokenError variables and NotificationService import from onboarding

Test plan

• Verify onboarding screen no longer shows push token debug info
• Verify social binding flow works correctly after scan QR changes
• Build completes without errors (pnpm build)

Summary by CodeRabbit

• Bug Fixes

  • Enhanced error handling and validation for binding document verification process.

• Chores

  • Removed push token display from the onboarding flow.
  • Added comprehensive debug logging to improve observability of social binding and signing operations.

[coderabbitai]

Warning

Rate limit exceeded

@coodos has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 19 minutes and 53 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 96edc5f1-1015-4540-bc24-37df71a009dd

📥 Commits

Reviewing files that changed from the base of the PR and between a6c8007 and bc5c0a7.

📒 Files selected for processing (1)

• infrastructure/evault-core/src/services/BindingDocumentService.ts

📝 Walkthrough

Walkthrough

Adds debug console logging to social binding signing and verification flows and removes push-token retrieval/display from the onboarding page; no public API changes or control-flow alterations beyond added logs and minor missing-registry handling.

Changes

Cohort / File(s)	Summary
Social binding logging infrastructure/eid-wallet/src/lib/utils/socialBinding.ts, infrastructure/eid-wallet/src/routes/(app)/scan-qr/scanLogic.ts	Inserted console.log statements to emit signing payloads and signature previews before/after signing and prior to mutation submission. No functional changes to signing or mutation logic.
Verification & binding service logging infrastructure/evault-core/src/services/BindingDocumentService.ts	Added defensive checks and extensive debug logs in verifyUserSignature and createBindingDocument, including signer, signature prefix, payload excerpts, registryUrl presence, and final verdict logs; added error logging on exceptions.
Onboarding cleanup infrastructure/eid-wallet/src/routes/(auth)/onboarding/+page.svelte	Removed NotificationService import and all push-token state, retrieval, error handling, and UI output related to push tokens.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• feat: add parties and relation_description to social_connection binding document #909: Adds/newly touches parties and relationDescription fields that are now logged in the social binding signing flow.
• chore: signing bug #315: Modifies QR-scan signing flow; related to logging added around the same signing code paths.
• Feat/signature verification library #464: Introduces signature-verification changes that intersect with added verification logging and error handling.

Suggested labels

evault-refactor

Suggested reviewers

• sosweetham

Poem

🐰 I hop through logs with tiny paws,
I print the payloads, trace the cause,
Signatures shimmer, snippets shown,
Old push tokens softly blown,
Hooray — a cleaner debugging lawn!

🚥 Pre-merge checks | ❌ 3

❌ Failed checks (2 warnings, 1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The PR description is partially complete but does not follow the required template structure with sections like 'Issue Number', 'Type of change', 'How the change has been tested', and a proper 'Change checklist'.	Update the PR description to follow the repository template by adding Issue Number, Type of change (Fix/Chore), How the change has been tested, and completing the Change checklist with all items properly marked.
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check	❓ Inconclusive	The title 'Fix/social binding bug' is vague and does not clearly specify the scope of changes—it mentions fixing a social binding bug but the PR also removes debug push token code from onboarding, making the title incomplete.	Revise the title to be more specific and comprehensive, such as 'Fix social binding bug and remove debug push token code from onboarding' or focus on the primary change if one is deemed more important.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/social-binding-bug

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 4

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@infrastructure/eid-wallet/src/lib/utils/socialBinding.ts`:
- Around line 307-315: The console.log in createSocialConnectionDoc currently
prints sensitive fields (normalizedSubject, normalizedSigner, subjectName,
parties, relationDescription and a fragment of signatureHash); remove this
detailed log and replace it with a fully redacted diagnostic (e.g., log only an
operation identifier, the count of parties, and a redaction marker) so no PII or
signature material is emitted; ensure any remaining log references only
non-sensitive metadata (e.g., parties.length, "social-binding created attempt",
and a hashed or fixed redaction token) and do not include signatureHash or
subjectName.
In `@infrastructure/eid-wallet/src/routes/`(app)/scan-qr/scanLogic.ts:
- Around line 730-748: The debug logs in the social-binding flow leak sensitive
social-graph fields (doc, canonicalPayload/payload, signerEname, requesterEname,
requesterName, relationDescription) and also expose a signature preview from
sig; modify the code around globalState.walletSdkAdapter.signPayload to remove
these detailed console.log calls and instead either (a) completely drop logging
in production, or (b) guard minimal redacted logging behind a debug flag (e.g.,
only log non-sensitive counters or lengths such as payloadLength and
signatureLength) so no names, parties, relation text, or signature fragments are
printed; update/remove the two console.log blocks that reference doc, payload,
signerEname, requesterName, relationDescription, and sig accordingly.
In `@infrastructure/evault-core/src/services/BindingDocumentService.ts`:
- Around line 130-133: The code in BindingDocumentService.verifyUserSignature
currently returns false when this.registryUrl is missing, which masks
configuration errors as signature failures; change this to throw a clear error
(e.g., new Error or a custom Error) when this.registryUrl is not set so the
GraphQL layer surfaces the configuration problem. Locate the verifyUserSignature
method and replace the early return false branch that checks this.registryUrl
with a thrown error message indicating the missing registryUrl/configuration.
- Around line 136-151: The console logs in verifyUserSignature (and the similar
block at lines 235-260) expose sensitive values—signature, payload excerpts,
signer, and expectedHash—so remove or redact them; replace the detailed
console.log calls around verifyUserSignature and any other logging that prints
payload/signature with metadata-only messages (e.g., log function name,
registryBaseUrl, lengths or presence flags, and a redacted boolean like
hasSignature) and never emit actual signature, expectedHash, payload contents,
or social_connection fields (relation_description, names); ensure
verifySignature calls remain unchanged but only log the safe metadata and the
final validity result.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 64d85578-f81f-457a-894a-ec6176226f4d

📥 Commits

Reviewing files that changed from the base of the PR and between b3b1a01 and ca2740c.

⛔ Files ignored due to path filters (1)

• infrastructure/eid-wallet/src-tauri/gen/android/key-shitore.properties is excluded by !**/gen/**

📒 Files selected for processing (4)

• infrastructure/eid-wallet/src/lib/utils/socialBinding.ts
• infrastructure/eid-wallet/src/routes/(app)/scan-qr/scanLogic.ts
• infrastructure/eid-wallet/src/routes/(auth)/onboarding/+page.svelte
• infrastructure/evault-core/src/services/BindingDocumentService.ts

💤 Files with no reviewable changes (1)

• infrastructure/eid-wallet/src/routes/(auth)/onboarding/+page.svelte