Board Candidate Transparency Improvements

[rudransh-shrivastava]

Proposed change

Part 2: Partially Resolves #4628

• Submitted claims are now public
• Fix hard to click edit button in candidate pages -- Add Candidate Claim Management Dashboard #5006 (comment)
• add claim.set_status_approved() and bulk_set_status_approved() -- Add Django Model for Claim Reviews #5066 (comment)
• make board field in claim model required and add on delete cascade.
• rename reviewers to claim_reviewers -- Add Django Model for Claim Reviews #5066 (comment)
• address EXIF metadata stripping related review comments -- feat(backend): strip exif metadata from candidate claims #5074 (review)
• use pydantic for GraphQL input validation in all mutations
• add s3 bucket to store claim evidence for staging and production

Won't address:

• Update Claim and Evidence GraphQL Queries To Add Reviews #5069 (comment)
• Update Claim and Evidence GraphQL Queries To Add Reviews #5069 (comment)
  These might require a wider refactor, maybe worth keeping as is for now and refactoring later.

Checklist

• Required: I followed the contributing workflow
• Required: I verified that my code works as intended and resolves the issue as described
• Required: I ran all required checks and tests locally; all warnings addressed and failures resolved
• I used AI for code, documentation, tests, or communication related to this PR

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Summary by CodeRabbit

• New Features

  • Added field-level validation messages for claim, evidence, and review forms.
  • Added stronger input validation, including length limits and URL checks.
  • Added reliable individual and bulk candidate-claim approvals, including saving and locking.

• Bug Fixes

  • Claims are now removed when their associated board is deleted.
  • Improved reviewer access control and evidence upload validation.
  • Improved handling of mutation errors and submission feedback.

• Changes

  • Renamed board reviewers to claim reviewers.
  • Improved image and PDF metadata processing.

• Style

  • Candidate cards no longer enlarge on hover; only the shadow changes.

Walkthrough

Changes

Claim lifecycle and reviewer handling

Layer / File(s)	Summary
Claim relationships and approval methods backend/src/apps/owasp/models/board_candidate_claim.py, backend/src/apps/owasp/migrations/0081_alter_boardcandidateclaim_board_and_more.py, backend/tests/unit/apps/owasp/models/board_candidate_claim_test.py	The board relation is required and cascading. The model adds individual and bulk approval methods.
Approval signal delegation backend/src/apps/owasp/signals/*, backend/tests/unit/apps/owasp/signals/*	Signals now call the model approval helpers. Tests cover qualifying and non-qualifying claims.
Claim reviewer relation migration backend/src/apps/owasp/models/board_of_directors.py, backend/src/apps/owasp/migrations/0082_remove_boardofdirectors_reviewers_and_more.py, backend/src/apps/owasp/admin/board_of_directors.py	The reviewer relation is renamed to claim_reviewers across the model, migration, and admin configuration.
Reviewer authorization paths backend/src/apps/owasp/api/internal/..., backend/src/apps/owasp/models/board_candidate_claim_review.py, backend/tests/unit/apps/owasp/api/internal/..., backend/tests/unit/apps/owasp/models/board_candidate_claim_review_test.py	Reviewer checks use claim_reviewers and access the required board directly. Tests update authorization scenarios.

Mutation validation and field errors

Layer / File(s)	Summary
Shared validation contract backend/src/apps/common/api/internal/mutations/common.py, backend/tests/unit/apps/common/api/internal/mutations/common_test.py	Shared utilities validate Pydantic inputs and convert validation failures into structured field errors.
Validated mutation inputs backend/src/apps/owasp/api/internal/mutations/*.py, backend/tests/unit/apps/owasp/api/internal/mutations/*	Claim, evidence, and review mutations use Pydantic-backed inputs, validated values, length and URL constraints, and field-error result fields.
Frontend field-error handling frontend/src/server/mutations/*, frontend/src/components/*Form.tsx, frontend/src/components/*Actions.tsx, frontend/src/app/board/...	Mutation responses expose field errors. Forms receive controlled backend errors, while pages and actions handle failed payloads directly.

File metadata helper updates

Layer / File(s)	Summary
Public metadata helpers backend/src/apps/owasp/utils/file.py, backend/tests/unit/apps/owasp/utils/file_test.py	Image and PDF metadata helpers are public. Supported image extensions derive from IMAGE_CONTENT_TYPE_MAP. Tests use named EXIF constants and public helper names.

Candidate card styling

Layer / File(s)	Summary
Candidate card hover behavior frontend/src/app/board/[year]/candidates/page.tsx	The hover scale transform is removed. Shadow transitions remain, with pressed-state scaling reset.

Estimated code review effort: 4 (Complex) | ~60 minutes

Possibly related PRs

• OWASP/Nest#5006: Introduces overlapping claim-management and GraphQL review workflows.
• OWASP/Nest#5066: Introduces the claim-review approval flow and reviewer relationship changes.
• OWASP/Nest#5069: Modifies the same claim-review GraphQL authorization and mutation paths.

Suggested labels: makefile

Suggested reviewers: arkid15r

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The PR addresses the listed model, reviewer, approval, EXIF, and validation objectives, but the linked issue still requires S3 claim-evidence storage.	Implement the S3 bucket and claim-evidence storage requirement, or link a separate PR that explicitly completes it.
Docstring Coverage	⚠️ Warning	Docstring coverage is 24.69% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Out of Scope Changes check	✅ Passed	The reviewed changes align with the linked issue objectives and do not show unrelated code changes.
Description check	✅ Passed	The description clearly relates to the changeset and lists the main board candidate, claim review, validation, and frontend improvements.
Title check	✅ Passed	The title concisely summarizes the main changes, which improve board candidate transparency and claim review management.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

❌ Patch coverage is 99.13420% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 98.46%. Comparing base (31d5327) to head (6264edb).
⚠️ Report is 2 commits behind head on feature/bod-candidate-transparency.

Files with missing lines	Patch %	Lines
...ternal/mutations/board_candidate_claim_evidence.py	97.56%	0 Missing and 1 partial ⚠️
...wasp/api/internal/queries/board_candidate_claim.py	80.00%	1 Missing ⚠️

Additional details and impacted files

@@                          Coverage Diff                           @@
##           feature/bod-candidate-transparency    #5384      +/-   ##
======================================================================
- Coverage                               98.46%   98.46%   -0.01%     
======================================================================
  Files                                     564      572       +8     
  Lines                                   18521    18780     +259     
  Branches                                 2645     2661      +16     
======================================================================
+ Hits                                    18237    18491     +254     
- Misses                                    163      166       +3     
- Partials                                  121      123       +2     

Flag	Coverage Δ
backend	98.93% <98.96%> (+0.01%)	⬆️
frontend	97.13% <100.00%> (-0.06%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
...d/src/apps/common/api/internal/mutations/common.py	100.00% <100.00%> (ø)
backend/src/apps/owasp/admin/board_of_directors.py	100.00% <100.00%> (ø)
...sp/api/internal/mutations/board_candidate_claim.py	84.86% <100.00%> (+2.75%)	⬆️
...internal/mutations/board_candidate_claim_review.py	100.00% <100.00%> (ø)
...nd/src/apps/owasp/api/internal/mutations/common.py	100.00% <100.00%> (ø)
.../owasp/api/internal/nodes/board_candidate_claim.py	90.90% <100.00%> (-0.76%)	⬇️
...pps/owasp/api/internal/nodes/board_of_directors.py	100.00% <ø> (ø)
...internal/queries/board_candidate_claim_evidence.py	100.00% <ø> (ø)
...end/src/apps/owasp/models/board_candidate_claim.py	100.00% <100.00%> (ø)
.../apps/owasp/models/board_candidate_claim_review.py	100.00% <100.00%> (ø)
... and 10 more

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 8cf2032...6264edb. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@backend/src/apps/owasp/models/board_candidate_claim.py`:
- Around line 174-185: Update BoardCandidateClaim.bulk_set_status_approved to
approve only claims currently in SUBMITTED status, either by rejecting invalid
claims before the bulk operation or using conditional database updates. Ensure
skipped non-SUBMITTED rows are not marked APPROVED in memory and preserve
accurate handling of claims not updated.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 9b854f58-509d-4271-92ee-c231cb81a0e0

📥 Commits

Reviewing files that changed from the base of the PR and between 122882d and c378e38.

📒 Files selected for processing (7)

• backend/src/apps/owasp/models/board_candidate_claim.py
• backend/src/apps/owasp/signals/board_candidate_claim_review.py
• backend/src/apps/owasp/signals/board_of_directors.py
• backend/tests/unit/apps/owasp/models/board_candidate_claim_test.py
• backend/tests/unit/apps/owasp/signals/board_candidate_claim_review_test.py
• backend/tests/unit/apps/owasp/signals/board_of_directors_test.py
• frontend/src/app/board/[year]/candidates/page.tsx

[cubic-dev-ai]

All reported issues were addressed across 7 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@backend/src/apps/owasp/migrations/0081_alter_boardcandidateclaim_board_and_more.py`:
- Around line 17-25: Before the AlterField operation for
BoardCandidateClaim.board, add a data migration that checks every target
database for claims with board_id IS NULL and assigns each orphan to a valid
board or deletes it according to the application’s intended policy. Ensure the
cleanup completes before applying the non-nullable CASCADE ForeignKey
constraint.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 3260addc-f65b-49d4-bae9-9eaede1ad7f1

📥 Commits

Reviewing files that changed from the base of the PR and between c378e38 and 82e6975.

📒 Files selected for processing (7)

• backend/src/apps/owasp/api/internal/mutations/board_candidate_claim_review.py
• backend/src/apps/owasp/api/internal/nodes/board_candidate_claim.py
• backend/src/apps/owasp/migrations/0081_alter_boardcandidateclaim_board_and_more.py
• backend/src/apps/owasp/models/board_candidate_claim.py
• backend/src/apps/owasp/models/board_candidate_claim_review.py
• backend/tests/unit/apps/owasp/models/board_candidate_claim_review_test.py
• backend/tests/unit/apps/owasp/models/board_candidate_claim_test.py

[cubic-dev-ai]

All reported issues were addressed across 7 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

0 issues found across 15 files (changes from recent commits).

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@backend/src/apps/owasp/migrations/0082_remove_boardofdirectors_reviewers_and_more.py`:
- Around line 14-28: Replace the RemoveField/AddField operations in migration
0082 with a data-preserving rename of the BoardOfDirectors reviewers relation to
claim_reviewers. Use RenameState/SeparateState and an explicit RunSQL as needed
so the existing many-to-many through-table and reviewer assignments are
retained, while the final migration state exposes the new field definition.

In `@backend/src/apps/owasp/models/board_of_directors.py`:
- Around line 33-35: Update the migration affecting BoardOfDirectors to replace
the reviewers removal and claim_reviewers addition with a data-preserving
RenameField operation, then use a separate AlterField for the verbose name or
help text. Keep the model’s claim_reviewers field and existing runtime
references unchanged.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 3617b298-5e5f-4bf0-85ee-d5c108315848

📥 Commits

Reviewing files that changed from the base of the PR and between 82e6975 and dc12dde.

📒 Files selected for processing (16)

• backend/data/bod.dump
• backend/src/apps/owasp/admin/board_of_directors.py
• backend/src/apps/owasp/api/internal/mutations/board_candidate_claim_review.py
• backend/src/apps/owasp/api/internal/nodes/board_candidate_claim.py
• backend/src/apps/owasp/api/internal/nodes/board_of_directors.py
• backend/src/apps/owasp/api/internal/queries/board_candidate_claim.py
• backend/src/apps/owasp/api/internal/queries/board_candidate_claim_evidence.py
• backend/src/apps/owasp/migrations/0082_remove_boardofdirectors_reviewers_and_more.py
• backend/src/apps/owasp/models/board_candidate_claim_review.py
• backend/src/apps/owasp/models/board_of_directors.py
• backend/tests/unit/apps/owasp/admin/board_of_directors_test.py
• backend/tests/unit/apps/owasp/api/internal/nodes/board_candidate_claim_test.py
• backend/tests/unit/apps/owasp/api/internal/nodes/board_of_directors_test.py
• backend/tests/unit/apps/owasp/api/internal/queries/board_candidate_claim_evidence_test.py
• backend/tests/unit/apps/owasp/api/internal/queries/board_candidate_claim_test.py
• backend/tests/unit/apps/owasp/models/board_candidate_claim_review_test.py

[cubic-dev-ai]

0 issues found across 3 files (changes from recent commits).

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[cubic-dev-ai]

All reported issues were addressed across 5 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 7 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

0 issues found across 7 files (changes from recent commits).

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[cubic-dev-ai]

All reported issues were addressed across 5 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
1.3% Duplication on New Code

See analysis details on SonarQube Cloud

[cubic-dev-ai]

0 issues found across 1 file (changes from recent commits).

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}