Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 35 additions & 1 deletion .gitignore
Original file line number Diff line number Diff line change
@@ -1 +1,35 @@
*.local
*.local

# Logs
logs
*.log
npm-debug.log*
yarn-debug.log*
yarn-error.log*
pnpm-debug.log*
lerna-debug.log*

node_modules
dist
dist-ssr
*.local

# Editor directories and files
.vscode/*
!.vscode/extensions.json
.idea
.DS_Store
*.suo
*.ntvs*
*.njsproj
*.sln
*.sw?

.env



kjn

backend/config/config.prod.yml
backend/config/*.prod.yml
18 changes: 0 additions & 18 deletions backend/config/config.prod.yml

This file was deleted.

6 changes: 2 additions & 4 deletions backend/go.mod
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,8 @@ go 1.24
toolchain go1.24.4

require (
github.com/casbin/casbin/v2 v2.132.0
github.com/casbin/mongodb-adapter/v3 v3.7.0
Comment on lines +8 to +9
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🌐 Web query:

casbin/casbin v2 latest version 2025 security advisories

💡 Result:

Summary (as of Dec 12, 2025):

  • Latest casbin/casbin v2 release: v2.134.0 (released Nov 14, 2025). [1]
  • Security advisories in 2025 for casbin/casbin: I found no GitHub Advisory / NVD CVE entries or project security advisories specifically for casbin/casbin in 2025. Snyk and the GitHub Advisory Database show no recorded vulnerabilities for the casbin packages for 2025. [2][3]

Sources

  1. Casbin v2.134.0 (release mirror listing, Nov 14, 2025). [SourceForge]. [4]
  2. Snyk package page for casbin — no known security issues (last updated 2025). [5]
  3. GitHub Advisory Database / search (no casbin/casbin advisories found for 2025). [6]

If you want, I can (a) check the casbin/casbin GitHub releases/tags page directly and link specific tags, or (b) run a deeper scan across NVD, GitHub Advisories, and vendor advisories for any related ecosystem packages (node-casbin, jcasbin, casbin-adapters). Which would you prefer?


🌐 Web query:

casbin mongodb-adapter v3 latest version 2025 security advisories

💡 Result:

Short answer: There is no published "casbin-mongodb-adapter v3" on npm as of Dec 12, 2025 — the casbin-mongodb-adapter package latest release is 1.3.0 and Snyk lists no direct vulnerabilities for it. Relevant MongoDB server/driver CVEs (which affect the underlying database, not the adapter code itself) include CVE-2024-1351 and CVE-2025-6713 — you should track/apply MongoDB/driver fixes if you use MongoDB. [1][2][3][4]

Sources

  • casbin-mongodb-adapter (package info, latest 1.3.0; no direct vulnerabilities reported). [1]
  • casbin adapters list (official docs). [2]
  • CVE-2024-1351 (MongoDB TLS/peer-certificate validation advisory). [3]
  • CVE-2025-6713 (MongoDB CVE record). [4]

🏁 Script executed:

# Check pkg.go.dev for current versions and check go.dev for security info
curl -s "https://pkg.go.dev/github.com/casbin/casbin/v2" 2>/dev/null | grep -i "v2\." | head -20 || echo "Cannot fetch pkg.go.dev"

Repository: AOSSIE-Org/DebateAI

Length of output: 3334


Update casbin dependencies to current versions and verify mongodb-adapter version.

The casbin/casbin/v2 dependency at v2.132.0 is outdated; the latest version is v2.135.0 (released Nov 2025). Additionally, casbin/mongodb-adapter/v3 v3.7.0 does not exist—the MongoDB adapter latest release is v1.3.0. No security vulnerabilities are reported for either package in 2025, but the versions should be corrected and updated to current releases.

🤖 Prompt for AI Agents
In backend/go.mod around lines 8-9, the casbin and MongoDB adapter module
versions are incorrect: change github.com/casbin/casbin/v2 to the current
v2.135.0 and replace the nonexistent github.com/casbin/mongodb-adapter/v3 entry
with the correct adapter module/version (github.com/casbin/mongodb-adapter or
github.com/casbin/mongodb-adapter/v1) pinned to v1.3.0; after editing go.mod run
`go get github.com/casbin/casbin/v2@v2.135.0
github.com/casbin/mongodb-adapter@v1.3.0` (or include /v1 if your imports use
it), then run `go mod tidy` and `go test` / `go build` to verify imports and
update go.sum.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

# Search for issue #131 references in the repository to understand the actual problem
find . -type f -name "*.md" -o -name "*.txt" -o -name "*.go" | head -20

Repository: AOSSIE-Org/DebateAI

Length of output: 833


🏁 Script executed:

# Look for PR description or issue context in common locations
ls -la | grep -i readme
git log --oneline -20 2>/dev/null || echo "Git not available"

Repository: AOSSIE-Org/DebateAI

Length of output: 171


🏁 Script executed:

# Search for casbin usage in the codebase to understand if promotion is necessary
rg "casbin" --type go -l

Repository: AOSSIE-Org/DebateAI

Length of output: 90


🏁 Script executed:

# Check the full go.mod to understand dependency context
head -100 backend/go.mod

Repository: AOSSIE-Org/DebateAI

Length of output: 3433


🏁 Script executed:

# Search for any MongoDB or adapter usage
rg "mongodb" --type go -l

Repository: AOSSIE-Org/DebateAI

Length of output: 1530


🏁 Script executed:

# Check the rbac.go file to see how casbin is being used
cat -n backend/middlewares/rbac.go | head -50

Repository: AOSSIE-Org/DebateAI

Length of output: 1834


🏁 Script executed:

# Search more thoroughly for mongodb-adapter usage
rg "mongodb-adapter|mongodb" -i --type go

Repository: AOSSIE-Org/DebateAI

Length of output: 9131


🏁 Script executed:

# Check if there's a CHANGELOG or PR description
find . -name "CHANGELOG*" -o -name "*.md" | grep -v node_modules | head -10
cat README.md | head -100

Repository: AOSSIE-Org/DebateAI

Length of output: 2680


🏁 Script executed:

# Look for recent changes to go.mod to understand context
git log --oneline backend/go.mod 2>/dev/null | head -10 || echo "Git unavailable"

Repository: AOSSIE-Org/DebateAI

Length of output: 111


🏁 Script executed:

# Search for any imports of the mongodb-adapter package in the codebase
rg "mongodb-adapter" -i

Repository: AOSSIE-Org/DebateAI

Length of output: 426


Clarify why backend dependency promotion is included in this frontend-rendering PR.

These dependencies are actively used in backend/middlewares/rbac.go (Casbin for access control, MongoDB adapter for policy storage), but the PR title focuses on fixing frontend rendering in development. The changes promote casbin/casbin/v2 and mongodb-adapter/v3 from indirect to direct dependencies—a backend infrastructure change.

Explain:

  1. Whether this backend change is a prerequisite for the frontend rendering fix or included by mistake
  2. Why this promotion was necessary (e.g., does the development environment require direct RBAC initialization?)

github.com/gin-contrib/cors v1.7.2
github.com/gin-gonic/gin v1.10.0
github.com/golang-jwt/jwt/v5 v5.2.2
Expand All @@ -23,13 +25,10 @@ require (
cloud.google.com/go/auth v0.15.0 // indirect
cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
cloud.google.com/go/compute/metadata v0.6.0 // indirect
cloud.google.com/go/longrunning v0.5.7 // indirect
github.com/bmatcuk/doublestar/v4 v4.6.1 // indirect
github.com/bytedance/sonic v1.11.6 // indirect
github.com/bytedance/sonic/loader v0.1.1 // indirect
github.com/casbin/casbin/v2 v2.132.0 // indirect
github.com/casbin/govaluate v1.3.0 // indirect
github.com/casbin/mongodb-adapter/v3 v3.7.0 // indirect
github.com/cespare/xxhash/v2 v2.3.0 // indirect
github.com/cloudwego/base64x v0.1.4 // indirect
github.com/cloudwego/iasm v0.2.0 // indirect
Expand Down Expand Up @@ -57,7 +56,6 @@ require (
github.com/modern-go/reflect2 v1.0.2 // indirect
github.com/montanaflynn/stats v0.7.1 // indirect
github.com/pelletier/go-toml/v2 v2.2.2 // indirect
github.com/redis/go-redis/v9 v9.16.0 // indirect
github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
github.com/ugorji/go/codec v1.2.12 // indirect
github.com/xdg-go/pbkdf2 v1.0.0 // indirect
Expand Down
3 changes: 1 addition & 2 deletions backend/go.sum
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,6 @@ cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIi
cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
cloud.google.com/go/compute/metadata v0.6.0 h1:A6hENjEsCDtC1k8byVsgwvVcioamEHvZ4j01OwKxG9I=
cloud.google.com/go/compute/metadata v0.6.0/go.mod h1:FjyFAW1MW0C203CEOMDTu3Dk1FlqW3Rga40jzHL4hfg=
cloud.google.com/go/longrunning v0.5.7 h1:WLbHekDbjK1fVFD3ibpFFVoyizlLRl73I7YKuAKilhU=
cloud.google.com/go/longrunning v0.5.7/go.mod h1:8GClkudohy1Fxm3owmBGid8W0pSgodEMwEAztp38Xng=
github.com/bmatcuk/doublestar/v4 v4.6.1 h1:FH9SifrbvJhnlQpztAx++wlkk70QBf0iBWDwNy7PA4I=
github.com/bmatcuk/doublestar/v4 v4.6.1/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
github.com/bsm/ginkgo/v2 v2.12.0 h1:Ny8MWAHyOepLGlLKYmXG4IEkioBysk6GpaRTLC8zwWs=
Expand Down Expand Up @@ -62,6 +60,7 @@ github.com/goccy/go-json v0.10.2 h1:CrxCmQqYDkv1z7lO7Wbh2HN93uovUHgrECaO5ZrCXAU=
github.com/goccy/go-json v0.10.2/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=
github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
github.com/golang/mock v1.4.4 h1:l75CXGRSwbaYNpl/Z2X1XIIAMSCquvXgpVZDhwEIJsc=
github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4=
github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
Expand Down
Loading