membase support

[hchen2020]

PR Type

Enhancement

---

Description

• Implement ICypherGraphService interface for graph database operations

• Add Cypher query execution support with parameters and results mapping

• Introduce graph node merge and delete operations via Membase API

• Refactor node models to support flexible properties and timestamps

• Enhance IMembaseApi with query execution and async method naming

---

Diagram Walkthrough

flowchart LR
  A["ICypherGraphService<br/>Interface"] -->|"implemented by"| B["MembaseService"]
  B -->|"uses"| C["IMembaseApi"]
  C -->|"calls"| D["Membase REST API"]
  E["GraphQueryResult<br/>GraphNode Models"] -->|"used by"| B
  F["CypherQueryRequest<br/>CypherQueryResponse"] -->|"exchanged with"| C

Loading

File Walkthrough

	Relevant files
Enhancement	9 files ICypherGraphService.cs New graph service interface with query execution                  +14/-0    CyperGraphModels.cs Graph query result and node model definitions                        +24/-0    CypherQueryRequest.cs New Cypher query request model with parameters                      +17/-0    CypherQueryResponse.cs New Cypher query response and notification models                +17/-0    Node.cs Change Properties from Dictionary to object type                  +1/-1      NodeCreationModel.cs Support flexible properties and optional timestamp              +4/-3      NodeUpdateModel.cs Support flexible properties and optional timestamp              +7/-4      IMembaseApi.cs Add Cypher query execution and merge node endpoints            +14/-4    MembaseService.cs Implement ICypherGraphService with query and node operations +48/-1
Configuration changes	2 files MembasePlugin.cs Register MembaseService as ICypherGraphService dependency +2/-7      Using.cs Add global using statements for new dependencies                  +8/-0

---

[qodo-code-review]

PR Compliance Guide 🔍

Below is a summary of compliance checks for this PR:

Security Compliance
🟢	No security concerns identified No security vulnerabilities detected by AI analysis. Human verification advised for critical code.
Ticket Compliance
⚪	🎫 No ticket provided Create ticket/issue
Codebase Duplication Compliance
⚪	Codebase context is not defined Follow the guide to enable codebase context checks.
Custom Compliance
🟢	Generic: Meaningful Naming and Self-Documenting Code Objective: Ensure all identifiers clearly express their purpose and intent, making code self-documenting Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
🔴	Generic: Robust Error Handling and Edge Case Management Objective: Ensure comprehensive error handling that provides meaningful context and graceful degradation Status: No error handling: Service methods call external API without try/catch, input validation, or handling of null/empty args and response errors, leading to silent failures. Referred Code public async Task<GraphQueryResult> Execute(string graphId, string query, Dictionary<string, object>? args = null) { var response = await _membase.CypherQueryAsync(graphId, new CypherQueryRequest { Query = query, Parameters = args ?? [] }); return new GraphQueryResult { Columns = response.Columns, Items = response.Data }; } public async Task<GraphNode> MergeNode(string graphId, GraphNode node) { var newNode = await _membase.MergeNodeAsync(graphId, node.Id, new NodeUpdateModel { Id = node.Id, Labels = [.. node.Labels], ... (clipped 12 lines) Learn more about managing compliance generic rules or creating your own custom rules
⚪	Generic: Comprehensive Audit Trails Objective: To create a detailed and reliable record of critical system actions for security analysis and compliance. Status: Missing audit logs: Critical graph operations (Cypher execution, node merge, node delete) are introduced without any auditing or logging of user, action, or outcome. Referred Code public async Task<GraphQueryResult> Execute(string graphId, string query, Dictionary<string, object>? args = null) { var response = await _membase.CypherQueryAsync(graphId, new CypherQueryRequest { Query = query, Parameters = args ?? [] }); return new GraphQueryResult { Columns = response.Columns, Items = response.Data }; } public async Task<GraphNode> MergeNode(string graphId, GraphNode node) { var newNode = await _membase.MergeNodeAsync(graphId, node.Id, new NodeUpdateModel { Id = node.Id, Labels = [.. node.Labels], ... (clipped 12 lines) Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Secure Error Handling Objective: To prevent the leakage of sensitive system information through error messages while providing sufficient detail for internal debugging. Status: Uncontrolled exceptions: External API exceptions may propagate without being mapped to safe user-facing messages; code lacks safeguards to prevent leaking internal details. Referred Code public async Task<GraphQueryResult> Execute(string graphId, string query, Dictionary<string, object>? args = null) { var response = await _membase.CypherQueryAsync(graphId, new CypherQueryRequest { Query = query, Parameters = args ?? [] }); return new GraphQueryResult { Columns = response.Columns, Items = response.Data }; } public async Task<GraphNode> MergeNode(string graphId, GraphNode node) { var newNode = await _membase.MergeNodeAsync(graphId, node.Id, new NodeUpdateModel { Id = node.Id, Labels = [.. node.Labels], ... (clipped 12 lines) Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Secure Logging Practices Objective: To ensure logs are useful for debugging and auditing without exposing sensitive information like PII, PHI, or cardholder data. Status: Secret in header: API key is injected into Authorization header without evidence of redaction or secure logging controls, which may risk accidental exposure if headers are logged. Referred Code services .AddRefitClient<IMembaseApi>(new RefitSettings { AuthorizationHeaderValueGetter = (message, cancellation) => Task.FromResult($"Bearer {dbSettings.ApiKey}") }) .ConfigureHttpClient(c => c.BaseAddress = new Uri(dbSettings.Host)); services.AddScoped<ICypherGraphService, MembaseService>(); Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Security-First Input Validation and Data Handling Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent vulnerabilities Status: Missing validation: Methods accept externally influenced inputs (graphId, query, parameters) and forward them without validation or constraints beyond parameterization, requiring review of Membase API safeguards. Referred Code public async Task<GraphQueryResult> Execute(string graphId, string query, Dictionary<string, object>? args = null) { var response = await _membase.CypherQueryAsync(graphId, new CypherQueryRequest { Query = query, Parameters = args ?? [] }); return new GraphQueryResult { Columns = response.Columns, Items = response.Data }; Learn more about managing compliance generic rules or creating your own custom rules

Compliance status legend

🟢 - Fully Compliant
🟡 - Partial Compliant
🔴 - Not Compliant
⚪ - Requires Further Human Verification
🏷️ - Compliance label

[qodo-code-review]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
Possible issue	Return the updated node from API Modify the MergeNode method to create and return a new GraphNode from the result of the _membase.MergeNodeAsync API call, instead of incorrectly returning the original input node. src/Plugins/BotSharp.Plugin.Membase/Services/MembaseService.cs [34-45] public async Task<GraphNode> MergeNode(string graphId, GraphNode node) { - var newNode = await _membase.MergeNodeAsync(graphId, node.Id, new NodeUpdateModel + var updatedNode = await _membase.MergeNodeAsync(graphId, node.Id, new NodeUpdateModel { Id = node.Id, Labels = [.. node.Labels], Properties = node.Properties, Time = node.Time }); - return node; + return new GraphNode + { + Id = updatedNode.Id, + Labels = updatedNode.Labels, + Properties = updatedNode.Properties, + Time = updatedNode.Time + }; } Apply / Chat Suggestion importance[1-10]: 9 __ Why: The suggestion correctly identifies a significant bug where the method returns the original input object instead of the updated one from the API call, which would lead to stale data being used by the caller.	High
	Return accurate deletion status Update the DeleteNode method to inspect the IActionResult returned by _membase.DeleteNodeAsync and return true only if the API call was successful, providing an accurate deletion status. src/Plugins/BotSharp.Plugin.Membase/Services/MembaseService.cs [47-51] public async Task<bool> DeleteNode(string graphId, string nodeId) { - await _membase.DeleteNodeAsync(graphId, nodeId); - return true; + var result = await _membase.DeleteNodeAsync(graphId, nodeId); + return result is OkResult; } Apply / Chat Suggestion importance[1-10]: 8 __ Why: The suggestion correctly points out that the method's return value is misleading by always being true, and proposes a valid improvement to check the API response for a success status, thus providing accurate feedback on the deletion operation.	Medium
Learned best practice	Add input and response null checks Validate inputs and API responses before use to prevent null dereferences; add null/empty checks and short-circuit with safe defaults. src/Plugins/BotSharp.Plugin.Membase/Services/MembaseService.cs [19-32] public async Task<GraphQueryResult> Execute(string graphId, string query, Dictionary<string, object>? args = null) { - var response = await _membase.CypherQueryAsync(graphId, new CypherQueryRequest + if (string.IsNullOrWhiteSpace(graphId)) throw new ArgumentException("graphId is required", nameof(graphId)); + if (string.IsNullOrWhiteSpace(query)) throw new ArgumentException("query is required", nameof(query)); + var request = new CypherQueryRequest { Query = query, Parameters = args ?? [] - }); - + }; + var response = await _membase.CypherQueryAsync(graphId, request); + if (response == null) + { + return new GraphQueryResult { Columns = Array.Empty<string>(), Items = Array.Empty<Dictionary<string, object?>>() }; + } return new GraphQueryResult { - Columns = response.Columns, - Items = response.Data + Columns = response.Columns ?? Array.Empty<string>(), + Items = response.Data ?? Array.Empty<Dictionary<string, object?>>() }; } Apply / Chat Suggestion importance[1-10]: 6 __ Why: Relevant best practice - Guard against nulls and invalid states before access to avoid NullReferenceExceptions.	Low
More