feat: add input validation for bet creation#34
Conversation
Added input validation to ensure valid bet creation, preventing identical teams, empty inputs, and invalid predictions.
📝 WalkthroughWalkthroughAdded stricter input validation and sanitization in Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 190f71a5e5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if team1 == team2: | ||
| raise Exception("Teams cannot be the same") |
There was a problem hiding this comment.
The new if team1 == team2: guard has no indented body because raise Exception("Teams cannot be the same") is aligned with the if, which makes this module fail to parse with an IndentationError and prevents the contract from loading at all. In this state, none of the contract methods can run, so this is a release-blocking regression.
Useful? React with 👍 / 👎.
| if not team1 or not team2: | ||
| raise Exception("Team names cannot be empty") | ||
|
|
||
| if predicted_winner not in [team1, team2, "draw"]: |
There was a problem hiding this comment.
This check only allows team1, team2, or draw, but the contract and existing callers use numeric winner codes ("1", "2", "0"): for example tests invoke create_bet(..., "1"), and resolve_bet compares bet.real_winner (stored as numeric string from _check_match) against bet.predicted_winner. As written, valid client inputs are rejected and scoring logic becomes inconsistent unless all related code is migrated together.
Useful? React with 👍 / 👎.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@contracts/football_bets.py`:
- Around line 61-68: Fix the incorrect indentation in the validation block that
causes a SyntaxError: ensure the "raise Exception('Teams cannot be the same')"
is indented under its if team1 == team2: and that the following validation
statements checking team1/team2 emptiness and predicted_winner membership are
indented to the same method scope (i.e., inside the function/method where team1,
team2, and predicted_winner are defined). Locate the block that references
team1, team2, and predicted_winner and adjust indentation so all three if
statements and their raises are at the method level (not class level) and
properly nested.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 54a511d1-3b25-4539-8689-21afeeaf1d9a
📒 Files selected for processing (1)
contracts/football_bets.py
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@contracts/football_bets.py`:
- Around line 74-81: Normalize and validate team names by trimming whitespace
and normalizing case before checks: compute normalized_team1 =
team1.strip().lower() and normalized_team2 = team2.strip().lower(), then check
emptiness with if not normalized_team1 or not normalized_team2 and equality with
if normalized_team1 == normalized_team2; keep the existing predicted_winner
validation as-is. Apply the same normalization and checks to the other
occurrence referenced (the block around the symbols handling team1/team2 at
lines ~94-105) so both validation sites use stripped, lowercased comparisons.
- Around line 118-123: The code indexes
self.bets[gl.message.sender_address][bet_id] directly which can raise an
unhandled lookup error if the sender or the bet_id is missing; update the
resolve path in the method to first check that gl.message.sender_address exists
in self.bets and that bet_id exists in self.bets[gl.message.sender_address]
(e.g., using "in" checks or dict.get) and raise a clear Exception like "Bet not
found" or "No bets for sender" before checking .has_resolved, then proceed to
raise "Bet already resolved" only after the existence checks pass.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: a3f00005-ccf8-4a58-ae3d-198b2dd074df
📒 Files selected for processing (1)
contracts/football_bets.py
There was a problem hiding this comment.
🧹 Nitpick comments (1)
contracts/football_bets.py (1)
41-48: Minor: JSON example uses Python type hints instead of concrete values.The prompt shows
"score": strand"winner": intwhich aren't valid JSON. While LLMs typically interpret this correctly as type documentation, using concrete example values would be clearer:{ "score": "2-1", "winner": 1 }This is a low-risk observation since
response_format="json"is specified and the code handles the parsed result correctly.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@contracts/football_bets.py` around lines 41 - 48, The JSON example in the prompt passed to gl.nondet.exec_prompt uses Python type hints ("score": str, "winner": int) which aren't valid JSON; update the example in the prompt string (the one constructed for variable task before calling gl.nondet.exec_prompt with response_format="json") to use concrete sample values such as "score": "2-1" and "winner": 1 so the LLM sees a valid JSON example while leaving response_format="json" and the surrounding call to gl.nondet.exec_prompt unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@contracts/football_bets.py`:
- Around line 41-48: The JSON example in the prompt passed to
gl.nondet.exec_prompt uses Python type hints ("score": str, "winner": int) which
aren't valid JSON; update the example in the prompt string (the one constructed
for variable task before calling gl.nondet.exec_prompt with
response_format="json") to use concrete sample values such as "score": "2-1" and
"winner": 1 so the LLM sees a valid JSON example while leaving
response_format="json" and the surrounding call to gl.nondet.exec_prompt
unchanged.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: f1880545-a21c-471c-8d1a-68cec89f231f
📒 Files selected for processing (1)
contracts/football_bets.py
1 participant
Added input validation to ensure valid bet creation, preventing identical teams, empty inputs, and invalid predictions.
Summary by CodeRabbit