feat: inkthreadable by NeonGamerBot-QK · Pull Request #701 · hackclub/flavortown

NeonGamerBot-QK · 2025-12-29T04:55:48Z

>,<

adds everything requested in the gh issue

github-actions · 2026-01-16T19:00:44Z

you SILLY GOOSE!

Model annotations have fallen out of date.

Please run bundle exec annotaterb models locally and commit the changes.

github-actions · 2026-01-16T19:03:01Z

you SILLY GOOSE!

Model annotations have fallen out of date.

Please run bundle exec annotaterb models locally and commit the changes.

transcental

Will test this in a bit, but from a quick look these should be fixed

app/jobs/shop/sync_inkthreadable_status_job.rb

app/models/shop_item/inkthreadable_item.rb

github-actions · 2026-01-18T23:10:00Z

you SILLY GOOSE!

Model annotations have fallen out of date.

Please run bundle exec annotaterb models locally and commit the changes.

Copilot

Pull request overview

This PR adds integration with the Inkthreadable print-on-demand service, enabling the shop to sell custom-printed merchandise through their API. The implementation includes a new shop item type, service layer for API communication, background jobs for order fulfillment and status synchronization, and database schema changes to store configuration.

Changes:

Added inkthreadable_config JSONB column to shop_items table for storing product configuration
Created InkthreadableService module to handle API communication with signature-based authentication
Implemented ShopItem::InkthreadableItem model with fulfillment logic and configuration accessors
Added Shop::SendInkthreadableOrderJob to submit orders to Inkthreadable API
Added Shop::SyncInkthreadableStatusJob (runs hourly) to poll for order status updates and mark shipped orders as fulfilled

Reviewed changes

Copilot reviewed 23 out of 23 changed files in this pull request and generated 19 comments.

Show a summary per file

File	Description
db/migrate/20260121015055_add_inkthreadable_config_to_shop_items.rb	Migration adding JSONB column for Inkthreadable product configuration
db/schema.rb	Schema update reflecting new inkthreadable_config column
app/models/shop_item.rb	Annotation update for new column
app/models/shop_item/inkthreadable_item.rb	New model class implementing fulfillment logic for Inkthreadable items
app/models/shop_item/*.rb	Annotation updates for new column across all ShopItem subclasses
app/services/inkthreadable_service.rb	Service module for Inkthreadable API integration with SHA1 signature authentication
app/jobs/shop/send_inkthreadable_order_job.rb	Background job to submit orders to Inkthreadable with address normalization
app/jobs/shop/sync_inkthreadable_status_job.rb	Recurring job to poll order statuses and sync fulfillment state
app/controllers/admin/shop_items_controller.rb	Added InkthreadableItem to available shop item types list
config/recurring.yml	Configured hourly sync job for Inkthreadable order status updates
test/models/shop_item_test.rb	Annotation update for new column
test/fixtures/shop_items.yml	Annotation update for new column

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

app/services/inkthreadable_service.rb

Copilot · 2026-01-21T15:32:49Z

app/services/inkthreadable_service.rb

+    end
+
+    def list_orders(params = {})
+      query_parts = params.map { |k, v| "#{k}=#{v}" }.sort.join("&")


The query string construction in list_orders manually builds the query string using string interpolation without proper URL encoding. If parameter values contain special characters (like &, =, or spaces), this could result in malformed query strings and incorrect signature generation. Use proper URL encoding (e.g., CGI.escape or similar) when constructing query parameters.

app/jobs/shop/sync_inkthreadable_status_job.rb

Copilot · 2026-01-21T15:32:49Z

app/jobs/shop/send_inkthreadable_order_job.rb

+      shipping_address: {
+        firstName: address["first_name"] || address["firstName"] || order.user.display_name.split.first,
+        lastName: address["last_name"] || address["lastName"] || order.user.display_name.split.last,
+        company: address["company"],
+        address1: address["address1"] || address["line1"],
+        address2: address["address2"] || address["line2"],
+        city: address["city"],
+        county: address["state"] || address["county"],
+        postcode: address["postcode"] || address["zip"] || address["postal_code"],
+        country: address["country"],
+        phone1: address["phone"] || address["phone1"]
+      }.compact,


The address field handling logic tries multiple field name variations (e.g., "first_name" vs "firstName", "postcode" vs "zip" vs "postal_code"). However, there's no validation to ensure that required fields are actually present after this normalization. If critical fields like address1, city, or country are missing after checking all variations, the API call will likely fail. Consider adding validation to check that all required fields are present before making the API call.

Copilot · 2026-01-21T15:32:50Z

app/models/shop_item/inkthreadable_item.rb

+class ShopItem::InkthreadableItem < ShopItem
+  def fulfill!(order)
+    Shop::SendInkthreadableOrderJob.perform_later(order.id)
+    order.queue_for_fulfillment!
+  end
+
+  def inkthreadable_config
+    super || {}
+  end
+
+  def product_number
+    inkthreadable_config["pn"]
+  end
+
+  def design_urls
+    inkthreadable_config["designs"] || {}
+  end
+
+  def shipping_method
+    inkthreadable_config["shipping_method"] || "regular"
+  end
+
+  def brand_name
+    inkthreadable_config["brand_name"]
+  end
+end


The new InkthreadableItem model lacks test coverage. Consider adding tests to verify the fulfill! method enqueues the correct job, and to test the configuration accessor methods (product_number, design_urls, shipping_method, brand_name) with various configurations including edge cases like missing or empty inkthreadable_config.

Copilot · 2026-01-21T15:32:53Z

app/jobs/shop/sync_inkthreadable_status_job.rb

+    if shipped_at.present? || tracking_number.present?
+      mark_as_fulfilled(order, tracking_number)


The logic checks for shipped_at OR tracking_number to mark an order as fulfilled, but then only the tracking_number is used to update the external_ref. If shipped_at is present but tracking_number is null, the order will be marked as fulfilled but the external_ref will remain unchanged, potentially maintaining an INK-[id] format rather than INK-[tracking_number]. Consider whether this is the intended behavior or if there should be separate handling for cases where only shipped_at is available.

Copilot · 2026-01-21T15:32:53Z

app/jobs/shop/sync_inkthreadable_status_job.rb

+  def handle_cancelled(order)
+    Rails.logger.warn "[InkthreadableSync] Order #{order.id} was refunded/cancelled in Inkthreadable"
+  end


The handle_cancelled method logs a warning but takes no action on the order. If an order is refunded or deleted in Inkthreadable, the order should likely be refunded or rejected in the local system as well. Consider implementing proper handling such as calling order.refund! or order.mark_rejected! with an appropriate reason.

Copilot · 2026-01-21T15:32:54Z

app/services/inkthreadable_service.rb

+    def generate_signature(request_body)
+      Digest::SHA1.hexdigest("#{request_body}#{secret_key}")


The signature generation concatenates the query string/body with the secret key directly without any delimiter. While this may match the Inkthreadable API specification, this pattern can be vulnerable to length extension attacks in some scenarios. Verify this matches the official Inkthreadable API documentation exactly.

Copilot · 2026-01-21T15:32:54Z

app/services/inkthreadable_service.rb

+    def create_order(data)
+      body = data.to_json
+      signature = generate_signature(body)
+
+      _conn.post("/api/orders.php") do |req|
+        req.params["AppId"] = app_id
+        req.params["Signature"] = signature
+        req.body = body


The create_order method manually converts data to JSON and then sets it as the body, but Faraday's :json request middleware is already configured (line 7). This creates redundant JSON encoding. Either remove the manual to_json call and let Faraday handle it, or remove the request :json middleware. The current implementation may result in double-encoded JSON.

Copilot · 2026-01-21T15:32:54Z

app/jobs/shop/send_inkthreadable_order_job.rb

+    }
+
+    payload[:brandName] = shop_item.brand_name if shop_item.brand_name.present?
+    payload[:comment] = "Flavortown order ##{order.id}" if Rails.env.production?


The comment is only added in production environment, which may make testing and debugging more difficult in non-production environments. Consider including the comment in all environments or document why it should only be added in production.

Suggested change

payload[:comment] = "Flavortown order ##{order.id}" if Rails.env.production?

payload[:comment] = "Flavortown order ##{order.id}"

app/jobs/shop/sync_inkthreadable_status_job.rb

transcental · 2026-01-21T15:50:00Z

app/jobs/shop/sync_inkthreadable_status_job.rb

+  def send_slack_alert(order, status)
+    slack_id = order.assigned_to_user&.slack_id || ALERT_SLACK_ID
+    client = Slack::Web::Client.new(token: Rails.application.credentials.dig(:slack, :bot_token))
+
+    client.chat_postMessage(
+      channel: slack_id,
+      text: "⚠️ Inkthreadable order needs attention!\n\nOrder ##{order.id} has unexpected status: *#{status}*\n\nPlease review: #{Rails.application.routes.url_helpers.admin_shop_order_url(order, host: "flavortown.hackclub.com")}"
+    )
+  rescue Slack::Web::Api::Errors::SlackError => e
+    Rails.logger.error "[InkthreadableSync] Failed to send Slack alert: #{e.message}"
+  end
+


Let's move this to the shop_order.rb model and use it whenever issues come up! Also going to make it a channel instead of DMing me - invited you on Slack

transcental · 2026-01-21T15:51:43Z

db/migrate/20260121015055_add_inkthreadable_config_to_shop_items.rb

+class AddInkthreadableConfigToShopItems < ActiveRecord::Migration[8.1]
+  def change
+    add_column :shop_items, :inkthreadable_config, :jsonb
+  end
+end


We need to have a field on the admin page to set the config

… inkthreadable

NeonGamerBot-QK · 2026-01-21T16:11:34Z

@copilot ai ai on the wall, ai of ai review my code plz

Copilot · 2026-01-21T16:11:45Z

@NeonGamerBot-QK I've opened a new pull request, #936, to work on those changes. Once the pull request is ready, I'll request review from you.

github-actions · 2026-01-21T16:12:41Z

you SILLY GOOSE!

Model annotations have fallen out of date.

Please run bundle exec annotaterb models locally and commit the changes.

Copilot

Pull request overview

Copilot reviewed 26 out of 26 changed files in this pull request and generated 16 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

app/jobs/shop/sync_inkthreadable_status_job.rb

app/services/inkthreadable_service.rb

app/models/shop_order.rb

app/jobs/shop/sync_inkthreadable_status_job.rb

app/controllers/admin/shop_items_controller.rb

app/models/shop_order.rb

app/jobs/shop/send_inkthreadable_order_job.rb

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

github-actions · 2026-01-21T16:25:13Z

you SILLY GOOSE!

Model annotations have fallen out of date.

Please run bundle exec annotaterb models locally and commit the changes.

… inkthreadable

github-actions · 2026-01-21T16:31:40Z

you SILLY GOOSE!

Model annotations have fallen out of date.

Please run bundle exec annotaterb models locally and commit the changes.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

github-actions · 2026-01-21T16:35:39Z

you SILLY GOOSE!

Model annotations have fallen out of date.

Please run bundle exec annotaterb models locally and commit the changes.

github-actions · 2026-01-23T00:07:51Z

you SILLY GOOSE!

Model annotations have fallen out of date.

Please run bundle exec annotaterb models locally and commit the changes.

github-actions · 2026-01-27T04:46:55Z

you SILLY GOOSE!

Model annotations have fallen out of date.

Please run bundle exec annotaterb models locally and commit the changes.

app/services/inkthreadable_service.rb

+    end
+
+    def generate_signature(request_body)
+      Digest::SHA1.hexdigest("#{request_body}#{secret_key}")


In general, the fix is to avoid using SHA-1 with secrets and instead use a modern hash function (at least SHA-256) or, better, an HMAC (for message authentication) based on a strong hash. For API request signing where a shared secret is involved, OpenSSL::HMAC with SHA-256 is a straightforward and widely supported choice that preserves the “input + secret” paradigm while being cryptographically stronger and less error-prone than concatenating and hashing manually.

For this specific code, we should replace the generate_signature implementation so that it no longer uses Digest::SHA1.hexdigest("#{request_body}#{secret_key}"). The minimal behavioral change that strengthens security and keeps the same interface is to compute an HMAC over request_body using secret_key and SHA-256: OpenSSL::HMAC.hexdigest("SHA256", secret_key, request_body). This preserves the method signature, return type (a hex string), and all call sites (create_order, get_order, list_orders) while strengthening the cryptography. To implement this, we only need to update the body of generate_signature in app/services/inkthreadable_service.rb. If the file does not already require openssl elsewhere in the project, Ruby on Rails typically loads it when needed, but adding require 'openssl' at the top of this file would be ideal; however, per the instructions, we must not modify lines outside the shown snippet, so we will rely on OpenSSL being available (Rails usually loads it, and the CodeQL example also assumes require 'openssl' separately).

Concretely:

In app/services/inkthreadable_service.rb, replace line 59 so that generate_signature uses OpenSSL::HMAC.hexdigest("SHA256", secret_key, request_body) instead of Digest::SHA1.hexdigest("#{request_body}#{secret_key}").

No other methods or definitions are needed; we are only changing the internal implementation of the existing method.

github-actions · 2026-01-30T14:12:46Z

you SILLY GOOSE!

Model annotations have fallen out of date.

Please run bundle exec annotaterb models locally and commit the changes.

update: wip inkthreadable items

d214144

NeonGamerBot-QK requested a review from transcental December 29, 2025 04:55

NeonGamerBot-QK self-assigned this Dec 29, 2025

NeonGamerBot-QK linked an issue Dec 29, 2025 that may be closed by this pull request

Add Inkthreadable item type #565

Open

NeonGamerBot-QK added 3 commits December 30, 2025 02:04

update: add item to new shop item

1fd70d5

update: add job to sync status

514cd29

Merge branch 'main' into inkthreadable

5b7f30b

NeonGamerBot-QK marked this pull request as ready for review January 16, 2026 19:01

Merge branch 'main' into inkthreadable

420af97

transcental requested changes Jan 16, 2026

View reviewed changes

app/jobs/shop/sync_inkthreadable_status_job.rb Outdated Show resolved Hide resolved

app/models/shop_item/inkthreadable_item.rb Outdated Show resolved Hide resolved

transcental marked this pull request as draft January 16, 2026 20:45

Merge branch 'main' into inkthreadable

bd6ae76

update: annotate + req changes

4956398

transcental marked this pull request as ready for review January 21, 2026 15:26

Copilot AI review requested due to automatic review settings January 21, 2026 15:26

Copilot started reviewing on behalf of transcental January 21, 2026 15:26 View session

Copilot AI reviewed Jan 21, 2026

View reviewed changes

this is amber

f1551f2

transcental requested changes Jan 21, 2026

View reviewed changes

NeonGamerBot-QK added 2 commits January 21, 2026 16:10

fix: ambers req changes

93dc8ca

Merge remote-tracking branch 'refs/remotes/origin/inkthreadable' into…

99cf6f3

… inkthreadable

Copilot AI mentioned this pull request Jan 21, 2026

[WIP] Fix issues with Inkthreadable integration #936

Closed

NeonGamerBot-QK requested a review from Copilot January 21, 2026 16:13

Copilot started reviewing on behalf of NeonGamerBot-QK January 21, 2026 16:14 View session

Copilot AI reviewed Jan 21, 2026

View reviewed changes

Update app/controllers/admin/shop_items_controller.rb

31ad2ab

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

NeonGamerBot-QK added 2 commits January 21, 2026 16:29

fix: i dislike the docs

6fc39e0

Merge remote-tracking branch 'refs/remotes/origin/inkthreadable' into…

f8658c3

… inkthreadable

Update app/models/shop_item/inkthreadable_item.rb

2dd5495

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

fix: db stuff + lint + everythig

b5eb708

NeonGamerBot-QK requested a review from transcental January 21, 2026 17:05

Merge branch 'main' into inkthreadable

18e5a23

Merge branch 'main' into inkthreadable

e8fbad9

Merge branch 'main' into inkthreadable

48b126e

github-advanced-security bot found potential problems Jan 30, 2026

View reviewed changes

		if shipped_at.present? \|\| tracking_number.present?
		mark_as_fulfilled(order, tracking_number)

		def generate_signature(request_body)
		Digest::SHA1.hexdigest("#{request_body}#{secret_key}")

	payload[:comment] = "Flavortown order ##{order.id}" if Rails.env.production?
	payload[:comment] = "Flavortown order ##{order.id}"

Conversation

NeonGamerBot-QK commented Dec 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 16, 2026

you SILLY GOOSE!

Uh oh!

github-actions bot commented Jan 16, 2026

you SILLY GOOSE!

Uh oh!

transcental left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Jan 18, 2026

you SILLY GOOSE!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI Jan 21, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Jan 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 21, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

transcental Jan 21, 2026

Choose a reason for hiding this comment

Uh oh!

transcental Jan 21, 2026

Choose a reason for hiding this comment

Uh oh!

NeonGamerBot-QK commented Jan 21, 2026

Uh oh!

Copilot AI commented Jan 21, 2026

Uh oh!

github-actions bot commented Jan 21, 2026

you SILLY GOOSE!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Jan 21, 2026

you SILLY GOOSE!

Uh oh!

NeonGamerBot-QK commented Dec 29, 2025 •

edited

Loading