Reviewing files that changed from the base of the PR and between 19fb361 and 3598462.

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

• apps/backoffice-v2/package.json (2 hunks)
• apps/backoffice-v2/src/common/components/molecules/ImageEditor/ImageEditor.tsx (3 hunks)
• apps/backoffice-v2/src/common/components/organisms/ImageViewer/ImageViewer.SelectedImage.tsx (3 hunks)
• apps/backoffice-v2/src/common/components/organisms/ImageViewer/ImageViewer.ZoomModal.tsx (2 hunks)
• apps/backoffice-v2/src/common/constants.ts (0 hunks)
• apps/backoffice-v2/src/common/utils/convert-csv-to-pdf-base64-string/convert-csv-to-pdf-base64-string.ts (1 hunks)
• apps/backoffice-v2/src/common/utils/is-csv/is-csv.ts (1 hunks)
• apps/backoffice-v2/src/pages/Entity/components/Case/Case.Documents.Toolbar.tsx (2 hunks)
• apps/backoffice-v2/src/pages/Entity/components/Case/Case.Documents.tsx (2 hunks)
• apps/backoffice-v2/src/pages/Entity/components/Case/hooks/useDocuments/helpers.ts (1 hunks)
• apps/backoffice-v2/src/pages/Entity/components/Case/hooks/useDocuments/useDocumentsLogic.tsx (1 hunks)
• apps/kyb-app/src/components/organisms/UIRenderer/elements/JSONForm/components/DocumentField/DocumentField.tsx (2 hunks)
• services/workflows-service/prisma/data-migrations (1 hunks)

• apps/backoffice-v2/src/common/constants.ts

• services/workflows-service/prisma/data-migrations

• GitHub Check: Analyze (javascript)
• GitHub Check: test_windows
• GitHub Check: build (windows-latest)
• GitHub Check: test_linux

apps/kyb-app/src/components/organisms/UIRenderer/elements/JSONForm/components/DocumentField/DocumentField.tsx (1)

25-25: LGTM! Verify usage of acceptFileFormats.

The new optional property is well-typed and follows naming conventions. Let's verify its usage across the codebase to ensure consistent implementation.

✅ Verification successful

Implementation of acceptFileFormats is verified and correct.

The property is:

• Consistently typed as optional string across components
• Properly passed from DocumentField to FileUploaderField
• Correctly applied to file input's accept attribute
• Covered by unit tests

🏁 Scripts executed

The following scripts were executed for the analysis:

Script:

#!/bin/bash
# Description: Check for consistent usage of acceptFileFormats across the codebase

# Find all TypeScript/JavaScript files that might use DocumentFieldParams
echo "Files referencing DocumentFieldParams:"
rg -l "DocumentFieldParams" --type ts --type tsx

# Find all instances where acceptFileFormats is used
echo -e "\nUsage of acceptFileFormats:"
rg "acceptFileFormats" --type ts --type tsx -C 2

Length of output: 311

---

Script:

#!/bin/bash
# Search for DocumentFieldParams interface and its usage
echo "=== Files containing DocumentFieldParams ==="
rg -p "DocumentFieldParams" --glob "*.{ts,tsx}" -C 2

echo -e "\n=== Usage of acceptFileFormats ==="
rg -p "acceptFileFormats" --glob "*.{ts,tsx}" -C 2

Length of output: 3008

apps/backoffice-v2/src/common/utils/convert-csv-to-pdf-base64-string/convert-csv-to-pdf-base64-string.ts (1)

9-36: ⚠️ Potential issue

Add input validation and error handling.

The current implementation has several security and reliability concerns:

1. No validation of input size
2. Unsafe base64 decoding
3. No handling of malformed CSV data
4. No validation of empty data

Consider this safer implementation:

-export const convertCsvToPdfBase64String = (csvBase64: string) => {
+const MAX_CSV_SIZE = 10 * 1024 * 1024; // 10MB limit
+
+export const convertCsvToPdfBase64String = async (csvBase64: string) => {
+  if (!csvBase64) {
+    throw new Error('No CSV data provided');
+  }
+
   // Extract base64 data from data URI
   const base64Data = csvBase64.split(',')[1] || csvBase64;
 
+  // Check size before decoding
+  const sizeInBytes = (base64Data.length * 3) / 4;
+  if (sizeInBytes > MAX_CSV_SIZE) {
+    throw new Error('CSV file too large');
+  }
+
   // Decode base64 to string
-  const csvString = atob(base64Data);
+  let csvString: string;
+  try {
+    csvString = atob(base64Data);
+  } catch (error) {
+    throw new Error('Invalid base64 data');
+  }
 
   // Parse CSV string to array using PapaParse
-  const { data } = Papa.parse(csvString, {
+  const { data, errors } = Papa.parse(csvString, {
     header: true,
     skipEmptyLines: true,
   });
 
+  if (errors.length > 0) {
+    throw new Error(`CSV parsing failed: ${errors[0].message}`);
+  }
+
+  if (!Array.isArray(data) || data.length === 0) {
+    throw new Error('No valid data found in CSV');
+  }
+
   // Create new PDF document
   const doc = new jsPDF() as jsPDFWithPlugin;
 
+  const headers = Object.keys(data[0] as object);
+  if (headers.length === 0) {
+    throw new Error('No columns found in CSV');
+  }
+
   // Add table to PDF using autoTable
   doc.autoTable({
-    head: [Object.keys(data[0] as object)], // Column headers
+    head: [headers],
     body: data.map(row => Object.values(row as object)), // Row data
     startY: 10,
     margin: { top: 10 },
     styles: { fontSize: 8 },
     headStyles: { fillColor: [66, 66, 66] },
   });
 
-  return doc.output('datauristring');
+  try {
+    return doc.output('datauristring');
+  } catch (error) {
+    throw new Error('Failed to generate PDF');
+  }
 };

Let's verify the CSV parsing capabilities with different file formats:

apps/backoffice-v2/src/common/components/molecules/ImageEditor/ImageEditor.tsx (2)

3-3: LGTM: Import added for CSV handling.

The isCsv utility import aligns with the new CSV document rendering feature.

---

51-54: LGTM: ReactCrop handling for CSV files.

The disabled state and className conditions correctly handle CSV files similar to PDFs, preventing crop operations on document types that shouldn't support it.

apps/backoffice-v2/src/common/components/organisms/ImageViewer/ImageViewer.SelectedImage.tsx (2)

1-1: LGTM: Import added for CSV handling.

The isCsv utility import aligns with the new CSV document rendering feature.

---

64-65: LGTM: Added displayName for debugging.

Adding the displayName property improves component identification in React DevTools.

apps/backoffice-v2/src/pages/Entity/components/Case/Case.Documents.Toolbar.tsx (1)

7-7: LGTM: Import added for CSV handling.

The isCsv utility import aligns with the new CSV document rendering feature.

apps/backoffice-v2/src/pages/Entity/components/Case/hooks/useDocuments/useDocumentsLogic.tsx (1)

14-16: Verify CSV to PDF conversion performance impact.

The conversion of CSV documents to PDF format is memoized, but we should ensure this doesn't impact performance with large CSV files.

Let's check for potential performance bottlenecks:

✅ Verification successful

CSV to PDF conversion implementation is performance-optimized ✅

The conversion implementation is lightweight and well-optimized:

• Uses efficient native browser APIs for base64 processing
• Properly memoized to prevent unnecessary conversions
• Only processes CSV documents, leaving others unchanged

🏁 Scripts executed

The following scripts were executed for the analysis:

Script:

#!/bin/bash
# Search for CSV file size limits or handling
rg -A 5 "convertCsvToPdfBase64String|convertCsvDocumentsToPdf" 

# Look for any performance-related comments or tests
rg -l "performance|benchmark" --type ts --type tsx

Length of output: 3789

apps/backoffice-v2/src/pages/Entity/components/Case/Case.Documents.tsx (1)

8-8: LGTM! Import of CSV utility aligns with feature requirements.

The addition of the isCsv utility supports the new CSV document handling feature.

apps/backoffice-v2/package.json (1)

119-120: Verify security of new dependencies and consider version pinning.

The new dependencies for CSV handling look appropriate, but:

1. Consider pinning exact versions to prevent unexpected updates
2. Need to verify these versions for security vulnerabilities

Run the following script to check for known vulnerabilities:

Also applies to: 128-128, 178-178

✅ Verification successful

Dependencies are secure, but consider version pinning

The current versions of jspdf (2.5.2) and jspdf-autotable (3.8.4) are free from known vulnerabilities. However, consider pinning exact versions by removing the caret (^) prefix to prevent unexpected updates:

    "jspdf": "2.5.2",
    "jspdf-autotable": "3.8.4",

🏁 Scripts executed

The following scripts were executed for the analysis:

Script:

#!/bin/bash
# Description: Check for security advisories in new dependencies

# Check for vulnerabilities in new packages
for pkg in "jspdf" "jspdf-autotable" "papaparse"; do
  echo "Checking $pkg..."
  gh api graphql -f query='{
    securityVulnerabilities(first: 5, ecosystem: NPM, package: "'$pkg'") {
      nodes {
        advisory {
          summary
          severity
          publishedAt
        }
        vulnerableVersionRange
        firstPatchedVersion {
          identifier
        }
      }
    }
  }'
done

Length of output: 2482