Fix onboarding

[Benbenzhouz]

Fix onboarding！

[Copilot]

Pull request overview

This PR fixes issues with the onboarding flow by improving address parsing flexibility, adding better error handling for OAuth flows, and enabling the application to run in development mode without third-party service credentials.

Key changes:

• Enhanced Australian address parsing with multiple regex patterns and fallback logic to handle various address formats
• Added validation and error handling for Google OAuth authentication failures
• Introduced mock clients for Twilio and Google OAuth to allow development without credentials
• Improved error messages and code formatting consistency

Reviewed changes

Copilot reviewed 8 out of 10 changed files in this pull request and generated 11 comments.

Show a summary per file

File	Description
src/utils/app-config.ts	Adds centralized utility functions for app URL and CORS origin configuration
src/modules/onboarding/onboarding.service.ts	Implements flexible address parsing with multiple regex patterns, manual parsing fallback, and demo step handling
src/modules/health/health.controller.ts	Reformats API decorator parameters for improved readability
src/modules/google-calendar/calendar-oauth.controller.ts	Adds explicit type annotation for frontend URL variable
src/modules/company/schema/company.schema.ts	Removes trailing whitespace
src/modules/auth/strategies/google.strategy.ts	Adds validation for Google profile data and mock credentials for development
src/modules/auth/dto/reset-password.dto.ts	Removes trailing whitespace
src/modules/auth/auth.service.ts	Reorders import statement
src/modules/auth/auth.controller.ts	Adds validation checks for OAuth callback and improves type safety in user object construction
src/lib/twilio/twilio.module.ts	Introduces mock Twilio client for development without credentials

Comments suppressed due to low confidence (2)

src/modules/auth/auth.controller.ts:225

• The pattern process.env.APP_URL ?? 'http://localhost:3000' is duplicated three times in this method (lines 178, 191, and 225). This should be extracted to a single variable at the beginning of the method to avoid repetition and ensure consistency.

  googleAuthRedirect(@Req() req: Request, @Res() res: Response): void {
    // Check if user is authenticated
    if (!req.user) {
      const frontendUrl = process.env.APP_URL ?? 'http://localhost:3000';
      res.redirect(`${frontendUrl}/login?error=oauth_failed`);
      return;
    }

    const { user, token, csrfToken } = req.user as {
      user: Record<string, unknown>;
      token: string;
      csrfToken: string;
    };

    // Validate required fields
    if (!token || !csrfToken) {
      const frontendUrl = process.env.APP_URL ?? 'http://localhost:3000';
      res.redirect(`${frontendUrl}/login?error=oauth_incomplete`);
      return;
    }

    // Manually construct safe user object to preserve ObjectId
    const safeUser = {
      _id: user._id?.toString() ?? (user._id as string | undefined) ?? '',
      email: (user.email as string | undefined) ?? '',
      firstName: (user.firstName as string | undefined) ?? '',
      lastName: (user.lastName as string | undefined) ?? '',
      role: (user.role as EUserRole | undefined) ?? EUserRole.user,
      status: (user.status as UserStatus | undefined) ?? UserStatus.active,
    };

    // Set JWT token as httpOnly cookie
    res.cookie('jwtToken', token, {
      httpOnly: true,
      secure: process.env.NODE_ENV === 'production',
      sameSite: process.env.NODE_ENV === 'production' ? 'strict' : 'lax',
      maxAge: 24 * 60 * 60 * 1000, // 24 hours
      path: '/',
    });

    // Set CSRF token as httpOnly cookie for double submit pattern
    res.cookie('csrfToken', csrfToken, {
      httpOnly: true,
      secure: process.env.NODE_ENV === 'production',
      sameSite: process.env.NODE_ENV === 'production' ? 'strict' : 'lax',
      maxAge: 24 * 60 * 60 * 1000, // 24 hours
      path: '/',
    });

    // Redirect to frontend with user data (CSRF token is in regular cookie)
    const frontendUrl = process.env.APP_URL ?? 'http://localhost:3000';

src/modules/onboarding/onboarding.service.ts:120

• The complex address parsing logic introduced in this PR lacks test coverage. Given the multiple regex patterns, fallback parsing logic, and various edge cases being handled (3-part vs 4-part addresses, state/postcode together vs separated), this functionality should have comprehensive unit tests to ensure all parsing paths work correctly and edge cases are handled properly.

    'user.address.full': function (answer, update) {
      const trimmedAnswer = answer.trim();

      // Try multiple regex patterns
      let match = this.AU_ADDR_REGEX_STRICT.exec(trimmedAnswer);
      if (!match?.groups) {
        match = this.AU_ADDR_REGEX_FLEXIBLE.exec(trimmedAnswer);
      }
      if (!match?.groups) {
        match = this.AU_ADDR_REGEX_SEPARATED.exec(trimmedAnswer);
      }

      // If regex doesn't match, try to parse manually from comma-separated values
      if (!match?.groups) {
        const parts = trimmedAnswer
          .split(',')
          .map(p => p.trim())
          .filter(p => p);

        if (parts.length >= 3) {
          // Try to extract state and postcode from the last part
          const lastPart = parts[parts.length - 1];
          const statePostcodeMatch = /^([A-Z]{2,3})\s*(\d{4})$/.exec(lastPart);

          if (statePostcodeMatch) {
            // Format: "Street, Suburb, State Postcode" (3 parts) or more
            // For 3 parts: parts[0] is street, parts[1] is suburb
            // For more parts: join all but last 2 as street
            const streetAddress =
              parts.length === 3 ? parts[0] : parts.slice(0, -2).join(', ');
            const suburb = parts[parts.length - 2];
            const state = statePostcodeMatch[1];
            const postcode = statePostcodeMatch[2];

            update.$set['answers.user.address.streetAddress'] = streetAddress;
            update.$set['answers.user.address.suburb'] = suburb;
            update.$set['answers.user.address.state'] = state;
            update.$set['answers.user.address.postcode'] = postcode;
            update.$set['answers.user.address.full'] = answer;
            return;
          }

          // Try to extract state and postcode separately
          if (parts.length >= 4) {
            const stateMatch = /^([A-Z]{2,3})$/.exec(parts[parts.length - 2]);
            const postcodeMatch = /^(\d{4})$/.exec(parts[parts.length - 1]);

            if (stateMatch && postcodeMatch) {
              // Format: "Street, Suburb, State, Postcode" (4 parts) or more
              // For 4 parts: parts[0] is street, parts[1] is suburb
              // For more parts: join all but last 3 as street
              const streetAddress =
                parts.length === 4 ? parts[0] : parts.slice(0, -3).join(', ');
              const suburb = parts[parts.length - 3];
              const state = stateMatch[1];
              const postcode = postcodeMatch[1];

              update.$set['answers.user.address.streetAddress'] = streetAddress;
              update.$set['answers.user.address.suburb'] = suburb;
              update.$set['answers.user.address.state'] = state;
              update.$set['answers.user.address.postcode'] = postcode;
              update.$set['answers.user.address.full'] = answer;
              return;
            }
          }
        }

        // If all parsing attempts fail, throw error
        throw new BadRequestException(
          'Unable to parse address; please check the format. Expected format: "Street Address, Suburb, State Postcode" (e.g., "123 Main St, Sydney, NSW 2000")',
        );
      }

      // Use regex match results
      update.$set['answers.user.address.streetAddress'] =
        match.groups.street.trim();
      update.$set['answers.user.address.suburb'] = match.groups.suburb.trim();
      update.$set['answers.user.address.state'] = match.groups.state;
      update.$set['answers.user.address.postcode'] = match.groups.postcode;
      update.$set['answers.user.address.full'] = answer; // raw string
    },

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.