website/views/company.py (4)

695-697: Remove debug print.

Leftover print floods stdout.

-        elif method == "put":
-            print("*" * 100)
-            return self.put(request, *args, **kwargs)
+        elif method == "put":
+            return self.put(request, *args, **kwargs)

---

1341-1344: Robustly extract organization email domain from URL.

urlparse(...).netloc is empty for bare domains like example.com. Fall back to path.

-        organization_url = organization_obj.url
-        parsed_url = urlparse(organization_url).netloc
-        organization_domain = parsed_url.replace("www.", "").strip()
+        organization_url = organization_obj.url or ""
+        parsed = urlparse(organization_url)
+        host = (parsed.netloc or parsed.path or "").strip()
+        organization_domain = host.replace("www.", "").strip().lower()

---

1485-1488: Improve exception handling and logging.

Avoid broad Exception and use logger.exception for stack traces.

-            except User.DoesNotExist:
-                messages.error(request, "User not found or inactive")
-            except Exception as e:
-                logger.error(f"Error adding role: {str(e)}")
-                messages.error(request, "An error occurred while adding the role. Please try again.")
+            except User.DoesNotExist:
+                messages.error(request, "User not found or inactive")
+            except Exception:
+                logger.exception("Error adding role")
+                messages.error(request, "An error occurred while adding the role. Please try again.")
@@
-            except OrganizationAdmin.DoesNotExist:
-                messages.error(request, "Role not found")
-            except Exception as e:
-                logger.error(f"Error updating role: {str(e)}")
-                messages.error(request, "An error occurred while updating the role. Please try again.")
+            except OrganizationAdmin.DoesNotExist:
+                messages.error(request, "Role not found")
+            except Exception:
+                logger.exception("Error updating role")
+                messages.error(request, "An error occurred while updating the role. Please try again.")
@@
-            except OrganizationAdmin.DoesNotExist:
-                messages.error(request, "Role not found")
-            except Exception as e:
-                logger.error(f"Error removing role: {str(e)}")
-                messages.error(request, "An error occurred while removing the role. Please try again.")
+            except OrganizationAdmin.DoesNotExist:
+                messages.error(request, "Role not found")
+            except Exception:
+                logger.exception("Error removing role")
+                messages.error(request, "An error occurred while removing the role. Please try again.")

As per coding guidelines and static analysis

Also applies to: 1523-1526, 1551-1554

---

1413-1413: Nit: Remove unused args/kwargs in post.

Silences ARG002 and clarifies signature.

-    def post(self, request, id, *args, **kwargs):
+    def post(self, request, id, *_args, **_kwargs):

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting

website/templates/organization/dashboard/organization_manage_domains.html (2)

81-85: Status badge remains broken: is_active still missing from context.

This issue was previously flagged. The template checks domain.is_active, but OrganizationDashboardManageDomainsView.get (lines 659-661 in website/views/company.py) returns domains via values(...) without including is_active, so this condition is always false.

Apply this diff to website/views/company.py to fix:

 domains = domains_query.values(
-    "id", "name", "url", "logo", "has_security_txt", "security_txt_checked_at"
+    "id", "name", "url", "logo", "is_active", "has_security_txt", "security_txt_checked_at"
 ).order_by("name")

---

165-183: Fix innerHTML DOM injection risk flagged by CodeQL.

Using innerHTML to inject form fields (lines 174-178) is a security risk. Even though inputs appear benign, any unescaped content in csrfToken or domainId could be interpreted as HTML/script tags.

Based on static analysis

Apply this diff to use createElement instead:

 function confirmDelete(domainId, domainName) {
-    if (confirm(`Are you sure you want to delete ${domainName}? This action cannot be undone.`)) {
+    if (!confirm(`Are you sure you want to delete ${domainName}? This action cannot be undone.`)) return;
+
         const form = document.createElement('form');
         form.method = 'post';
         form.action = '{% url "add_domain" organization %}';
         
         const csrfElement = document.querySelector('[name=csrfmiddlewaretoken]');
         const csrfToken = csrfElement ? csrfElement.value : '{{ csrf_token|escapejs }}';
         
-        form.innerHTML = `
-            <input type="hidden" name="csrfmiddlewaretoken" value="${csrfToken}">
-            <input type="hidden" name="_method" value="delete">
-            <input type="hidden" name="domain_id" value="${domainId}">
-        `;
+        const csrfField = document.createElement('input');
+        csrfField.type = 'hidden';
+        csrfField.name = 'csrfmiddlewaretoken';
+        csrfField.value = csrfToken;
+
+        const methodField = document.createElement('input');
+        methodField.type = 'hidden';
+        methodField.name = '_method';
+        methodField.value = 'delete';
+
+        const idField = document.createElement('input');
+        idField.type = 'hidden';
+        idField.name = 'domain_id';
+        idField.value = String(domainId);
+
+        form.append(csrfField, methodField, idField);
         
         document.body.appendChild(form);
         form.submit();
-    }
 }

website/views/company.py (3)

1338-1369: Consider the heuristic nature of email domain matching.

The code extracts the domain from organization.url (lines 1341-1346) and matches users with emails ending in @{domain} (lines 1350-1354). This heuristic assumes the organization's URL domain matches their email domain, which may not always be true (e.g., URL example.com but emails @exampleinc.com).

The fallback to all active users (lines 1357-1362, 1365-1369) mitigates this limitation, but consider:

• Adding an explicit email_domain field to the Organization model for precise matching
• Or documenting this heuristic behavior for users

---

1416-1416: Remove unused method parameters.

The args and kwargs parameters are not used in this method.

Based on static analysis

Apply this diff:

-    def post(self, request, id, *args, **kwargs):
+    def post(self, request, id):

---

1459-1466: Consider reactivating inactive roles instead of creating duplicates.

The check at lines 1459-1466 only looks for existing active roles. If a user previously had a role that was deactivated (via remove_role), this logic will create a new OrganizationAdmin record, leaving the inactive one orphaned.

Consider reactivating existing inactive roles:

# Check for existing roles (active or inactive)
existing_role = OrganizationAdmin.objects.filter(
    user=user, organization=organization_obj
).first()

if existing_role:
    if existing_role.is_active:
        messages.error(request, f"{user.username} already has an active role in this organization")
        return redirect("organization_manage_roles", id=id)
    else:
        # Reactivate and update the existing role
        existing_role.is_active = True
        existing_role.role = int(role)
        existing_role.domain = domain
        existing_role.save()
        messages.success(request, f"Reactivated and updated role for {user.username}")
        return redirect("organization_manage_roles", id=id)

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting

website/views/company.py (2)

1341-1369: Consider limiting available_users query scope.

The fallback logic fetches up to 100 active users when no organization domain match exists. For large user bases, this could be inefficient or expose unnecessary user data.

Consider adding a search/autocomplete interface instead of pre-loading all users, or further restricting the fallback query (e.g., users who have interacted with the organization).

---

1416-1416: Remove unused method arguments.

The args and kwargs parameters are unused in the POST method signature.

Based on static analysis

Apply this diff:

-    def post(self, request, id, *args, **kwargs):
+    def post(self, request, id):

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting