Conversation
📝 WalkthroughWalkthroughMaven dependency for FiscalAPI library updated from version 4.0.272 to 4.0.372. Controllers refactored to use BigDecimal for numeric values. Four new endpoints added to handle Carta Porte and payroll CFDI complement construction. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
src/main/java/com/fiscalapi/samples/spring/controller/InvoicesController.java (2)
1351-1561: Consider extracting common Carta Porte construction logic.The two Carta Porte endpoints (
crearFacturaCartaPorteandcrearFacturaCartaPortePorReferencias) share approximately 90% of their code for building theCartaPortecomplement (ubicaciones, mercancias, autotransporte, tiposFigura). Only the issuer/recipient setup differs.While this is a demo application prioritizing simplicity, extracting the common logic into a helper method would reduce duplication and make the examples easier to maintain.
♻️ Suggested helper method
private CartaPorte buildCartaPorteComplement() { CartaPorte cartaPorte = new CartaPorte(); cartaPorte.setTranspInternacId("No"); cartaPorte.setTotalDistRec(new BigDecimal("1")); // ... all the ubicaciones, mercancias, autotransporte, tiposFigura setup return cartaPorte; }Then in each endpoint:
CartaPorte cartaPorte = buildCartaPorteComplement(); Complement complement = new Complement(); complement.setCartaPorte(cartaPorte); invoice.setComplement(complement);Also applies to: 1563-1751
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@src/main/java/com/fiscalapi/samples/spring/controller/InvoicesController.java` around lines 1351 - 1561, Duplicate CartaPorte construction appears in crearFacturaCartaPorte and crearFacturaCartaPortePorReferencias; extract the shared setup into a private helper (e.g., buildCartaPorteComplement) that creates and returns a fully populated CartaPorte (ubicaciones, mercancias, autotransporte, tiposFigura) and replace the in-place construction in both methods by calling that helper and attaching it via new Complement().setCartaPorte(...), leaving only issuer/recipient differences in each endpoint.
1753-1948: Similar duplication exists in payroll complement endpoints.The payroll complement endpoints (
crearNominaComplementoandcrearNominaComplementoPorReferencias) also share most of their code for building earnings, deductions, and thePayrollobject. The same helper method approach could be applied here.Also applies to: 1950-2105
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@src/main/java/com/fiscalapi/samples/spring/controller/InvoicesController.java` around lines 1753 - 1948, The two endpoints crearNominaComplemento and crearNominaComplementoPorReferencias duplicate construction of Payroll, PayrollEarnings (earningList + otherPayments) and deductions; extract reusable builders (e.g., buildPayrollEarnings(), buildPayrollDeductions(), buildPayroll(LocalDateTime paymentDate, LocalDateTime start, LocalDateTime end)) that return PayrollEarnings, List<PayrollDeduction> and Payroll respectively, then call those helpers from both controller methods and set complement.setPayroll(...) before create(invoice); use the types Payroll, PayrollEarnings, PayrollEarning, PayrollEarningOtherPayment, PayrollDeduction to locate where to move the logic.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@pom.xml`:
- Line 47: The pom.xml currently pins the fiscalapi dependency to a non-existent
version "4.0.372"; update the <version> element for the fiscalapi dependency to
a valid published release (e.g., "4.0.272") so Maven can resolve the artifact,
then run mvn dependency:resolve or a build to verify the change; ensure the
changed <version> element is the one associated with the fiscalapi dependency.
In
`@src/main/java/com/fiscalapi/samples/spring/controller/InvoicesController.java`:
- Around line 71-73: The InvoicesController currently embeds sensitive test
cert/key strings in the fields escuelaKemperBase64Cert and
escuelaKemperBase64Key; externalize them into configuration and inject them
instead. Add properties like fiscalapi.escuelaKemper.base64Cert and
fiscalapi.escuelaKemper.base64Key to application.properties (or environment),
create a configuration or use `@Value` to bind them, and replace the hardcoded
fields in InvoicesController with injected values (referencing the field names
escuelaKemperBase64Cert and escuelaKemperBase64Key and the class
InvoicesController) so the secrets are no longer in source.
---
Nitpick comments:
In
`@src/main/java/com/fiscalapi/samples/spring/controller/InvoicesController.java`:
- Around line 1351-1561: Duplicate CartaPorte construction appears in
crearFacturaCartaPorte and crearFacturaCartaPortePorReferencias; extract the
shared setup into a private helper (e.g., buildCartaPorteComplement) that
creates and returns a fully populated CartaPorte (ubicaciones, mercancias,
autotransporte, tiposFigura) and replace the in-place construction in both
methods by calling that helper and attaching it via new
Complement().setCartaPorte(...), leaving only issuer/recipient differences in
each endpoint.
- Around line 1753-1948: The two endpoints crearNominaComplemento and
crearNominaComplementoPorReferencias duplicate construction of Payroll,
PayrollEarnings (earningList + otherPayments) and deductions; extract reusable
builders (e.g., buildPayrollEarnings(), buildPayrollDeductions(),
buildPayroll(LocalDateTime paymentDate, LocalDateTime start, LocalDateTime end))
that return PayrollEarnings, List<PayrollDeduction> and Payroll respectively,
then call those helpers from both controller methods and set
complement.setPayroll(...) before create(invoice); use the types Payroll,
PayrollEarnings, PayrollEarning, PayrollEarningOtherPayment, PayrollDeduction to
locate where to move the logic.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 41ee0355-7915-40dd-8c45-45975fba15ee
📒 Files selected for processing (3)
pom.xmlsrc/main/java/com/fiscalapi/samples/spring/controller/InvoicesController.javasrc/main/java/com/fiscalapi/samples/spring/controller/ProductController.java
| <groupId>com.fiscalapi</groupId> | ||
| <artifactId>fiscalapi</artifactId> | ||
| <version>4.0.272</version> | ||
| <version>4.0.372</version> |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Check if fiscalapi 4.0.372 exists on Maven Central
curl -s "https://search.maven.org/solrsearch/select?q=g:com.fiscalapi+AND+a:fiscalapi&rows=5&wt=json" | jq '.response.docs[] | {id, latestVersion}'Repository: FiscalAPI/fiscalapi-samples-spring
Length of output: 60
🏁 Script executed:
cat -n pom.xml | head -60Repository: FiscalAPI/fiscalapi-samples-spring
Length of output: 2356
🏁 Script executed:
# Check if there are repository declarations in pom.xml
grep -n "repository" pom.xml
# Also check for settings.xml or other configuration
ls -la | grep -E "settings|pom"
# Search for any README or documentation about dependencies
find . -name "README*" -o -name "*.md" | head -5Repository: FiscalAPI/fiscalapi-samples-spring
Length of output: 212
🏁 Script executed:
cat README.mdRepository: FiscalAPI/fiscalapi-samples-spring
Length of output: 9030
🌐 Web query:
FiscalAPI fiscalapi java maven 4.0.372 version release
💡 Result:
No evidence found of a FiscalAPI Java Maven release version 4.0.372. The FiscalAPI Java SDK (groupId: com.fiscalapi, artifactId: fiscalapi) exists on Maven Central repositories, with documented versions up to 4.0.272 as of recent listings. The GitHub repository github.com/FiscalAPI/fiscalapi-java shows last activity around Aug 2025 but no published releases or changelog mentioning 4.0.372. Similar versioning patterns appear in Python (up to 4.0.360) and .NET SDKs, suggesting 4.0.372 may not be released or is unreleased/private. Official site fiscalapi.com provides the API service for Mexican CFDI electronic invoicing, with SDKs in multiple languages including Java under MPL-2.0 license. Maven dependency example: <dependency><groupId>com.fiscalapi</groupId><artifactId>fiscalapi</artifactId><version>4.0.272</version></dependency>. Check https://repo1.maven.org/maven2/com/fiscalapi/fiscalapi/ for available versions.
Citations:
- 1: https://libraries.io/maven/com.fiscalapi:fiscalapi
- 2: https://repo1.maven.org/maven2/com/fiscalapi
- 3: https://github.com/FiscalAPI
- 4: https://github.com/Fiscalapi
- 5: https://central.sonatype.com/namespace/com.fiscalapi
Update fiscalapi version to a valid, published release.
The specified version 4.0.372 does not exist in Maven Central or any public Maven repository. The latest published version is 4.0.272. Update the dependency to use an existing, stable version.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@pom.xml` at line 47, The pom.xml currently pins the fiscalapi dependency to a
non-existent version "4.0.372"; update the <version> element for the fiscalapi
dependency to a valid published release (e.g., "4.0.272") so Maven can resolve
the artifact, then run mvn dependency:resolve or a build to verify the change;
ensure the changed <version> element is the one associated with the fiscalapi
dependency.
| private String escuelaKemperBase64Cert = "MIIFsDCCA5igAwIBAgIUMzAwMDEwMDAwMDA1MDAwMDM0MTYwDQYJKoZIhvcNAQELBQAwggErMQ8wDQYDVQQDDAZBQyBVQVQxLjAsBgNVBAoMJVNFUlZJQ0lPIERFIEFETUlOSVNUUkFDSU9OIFRSSUJVVEFSSUExGjAYBgNVBAsMEVNBVC1JRVMgQXV0aG9yaXR5MSgwJgYJKoZIhvcNAQkBFhlvc2Nhci5tYXJ0aW5lekBzYXQuZ29iLm14MR0wGwYDVQQJDBQzcmEgY2VycmFkYSBkZSBjYWxpejEOMAwGA1UEEQwFMDYzNzAxCzAJBgNVBAYTAk1YMRkwFwYDVQQIDBBDSVVEQUQgREUgTUVYSUNPMREwDwYDVQQHDAhDT1lPQUNBTjERMA8GA1UELRMIMi41LjQuNDUxJTAjBgkqhkiG9w0BCQITFnJlc3BvbnNhYmxlOiBBQ0RNQS1TQVQwHhcNMjMwNTE4MTE0MzUxWhcNMjcwNTE4MTE0MzUxWjCB1zEnMCUGA1UEAxMeRVNDVUVMQSBLRU1QRVIgVVJHQVRFIFNBIERFIENWMScwJQYDVQQpEx5FU0NVRUxBIEtFTVBFUiBVUkdBVEUgU0EgREUgQ1YxJzAlBgNVBAoTHkVTQ1VFTEEgS0VNUEVSIFVSR0FURSBTQSBERSBDVjElMCMGA1UELRMcRUtVOTAwMzE3M0M5IC8gVkFEQTgwMDkyN0RKMzEeMBwGA1UEBRMVIC8gVkFEQTgwMDkyN0hTUlNSTDA1MRMwEQYDVQQLEwpTdWN1cnNhbCAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtmecO6n2GS0zL025gbHGQVxznPDICoXzR2uUngz4DqxVUC/w9cE6FxSiXm2ap8Gcjg7wmcZfm85EBaxCx/0J2u5CqnhzIoGCdhBPuhWQnIh5TLgj/X6uNquwZkKChbNe9aeFirU/JbyN7Egia9oKH9KZUsodiM/pWAH00PCtoKJ9OBcSHMq8Rqa3KKoBcfkg1ZrgueffwRLws9yOcRWLb02sDOPzGIm/jEFicVYt2Hw1qdRE5xmTZ7AGG0UHs+unkGjpCVeJ+BEBn0JPLWVvDKHZAQMj6s5Bku35+d/MyATkpOPsGT/VTnsouxekDfikJD1f7A1ZpJbqDpkJnss3vQIDAQABox0wGzAMBgNVHRMBAf8EAjAAMAsGA1UdDwQEAwIGwDANBgkqhkiG9w0BAQsFAAOCAgEAFaUgj5PqgvJigNMgtrdXZnbPfVBbukAbW4OGnUhNrA7SRAAfv2BSGk16PI0nBOr7qF2mItmBnjgEwk+DTv8Zr7w5qp7vleC6dIsZFNJoa6ZndrE/f7KO1CYruLXr5gwEkIyGfJ9NwyIagvHHMszzyHiSZIA850fWtbqtythpAliJ2jF35M5pNS+YTkRB+T6L/c6m00ymN3q9lT1rB03YywxrLreRSFZOSrbwWfg34EJbHfbFXpCSVYdJRfiVdvHnewN0r5fUlPtR9stQHyuqewzdkyb5jTTw02D2cUfL57vlPStBj7SEi3uOWvLrsiDnnCIxRMYJ2UA2ktDKHk+zWnsDmaeleSzonv2CHW42yXYPCvWi88oE1DJNYLNkIjua7MxAnkNZbScNw01A6zbLsZ3y8G6eEYnxSTRfwjd8EP4kdiHNJftm7Z4iRU7HOVh79/lRWB+gd171s3d/mI9kte3MRy6V8MMEMCAnMboGpaooYwgAmwclI2XZCczNWXfhaWe0ZS5PmytD/GDpXzkX0oEgY9K/uYo5V77NdZbGAjmyi8cE2B2ogvyaN2XfIInrZPgEffJ4AB7kFA2mwesdLOCh0BLD9itmCve3A1FGR4+stO2ANUoiI3w3Tv2yQSg4bjeDlJ08lXaaFCLW2peEXMXjQUk7fmpb5MNuOUTW6BE="; | ||
| private String escuelaKemperBase64Key = "MIIFDjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIAgEAAoIBAQACAggAMBQGCCqGSIb3DQMHBAgwggS/AgEAMASCBMh4EHl7aNSCaMDA1VlRoXCZ5UUmqErAbucoZQObOaLUEm+I+QZ7Y8Giupo+F1XWkLvAsdk/uZlJcTfKLJyJbJwsQYbSpLOCLataZ4O5MVnnmMbfG//NKJn9kSMvJQZhSwAwoGLYDm1ESGezrvZabgFJnoQv8Si1nAhVGTk9FkFBesxRzq07dmZYwFCnFSX4xt2fDHs1PMpQbeq83aL/PzLCce3kxbYSB5kQlzGtUYayiYXcu0cVRu228VwBLCD+2wTDDoCmRXtPesgrLKUR4WWWb5N2AqAU1mNDC+UEYsENAerOFXWnmwrcTAu5qyZ7GsBMTpipW4Dbou2yqQ0lpA/aB06n1kz1aL6mNqGPaJ+OqoFuc8Ugdhadd+MmjHfFzoI20SZ3b2geCsUMNCsAd6oXMsZdWm8lzjqCGWHFeol0ik/xHMQvuQkkeCsQ28PBxdnUgf7ZGer+TN+2ZLd2kvTBOk6pIVgy5yC6cZ+o1Tloql9hYGa6rT3xcMbXlW+9e5jM2MWXZliVW3ZhaPjptJFDbIfWxJPjz4QvKyJk0zok4muv13Iiwj2bCyefUTRz6psqI4cGaYm9JpscKO2RCJN8UluYGbbWmYQU+Int6LtZj/lv8p6xnVjWxYI+rBPdtkpfFYRp+MJiXjgPw5B6UGuoruv7+vHjOLHOotRo+RdjZt7NqL9dAJnl1Qb2jfW6+d7NYQSI/bAwxO0sk4taQIT6Gsu/8kfZOPC2xk9rphGqCSS/4q3Os0MMjA1bcJLyoWLp13pqhK6bmiiHw0BBXH4fbEp4xjSbpPx4tHXzbdn8oDsHKZkWh3pPC2J/nVl0k/yF1KDVowVtMDXE47k6TGVcBoqe8PDXCG9+vjRpzIidqNo5qebaUZu6riWMWzldz8x3Z/jLWXuDiM7/Yscn0Z2GIlfoeyz+GwP2eTdOw9EUedHjEQuJY32bq8LICimJ4Ht+zMJKUyhwVQyAER8byzQBwTYmYP5U0wdsyIFitphw+/IH8+v08Ia1iBLPQAeAvRfTTIFLCs8foyUrj5Zv2B/wTYIZy6ioUM+qADeXyo45uBLLqkN90Rf6kiTqDld78NxwsfyR5MxtJLVDFkmf2IMMJHTqSfhbi+7QJaC11OOUJTD0v9wo0X/oO5GvZhe0ZaGHnm9zqTopALuFEAxcaQlc4R81wjC4wrIrqWnbcl2dxiBtD73KW+wcC9ymsLf4I8BEmiN25lx/OUc1IHNyXZJYSFkEfaxCEZWKcnbiyf5sqFSSlEqZLc4lUPJFAoP6s1FHVcyO0odWqdadhRZLZC9RCzQgPlMRtji/OXy5phh7diOBZv5UYp5nb+MZ2NAB/eFXm2JLguxjvEstuvTDmZDUb6Uqv++RdhO5gvKf/AcwU38ifaHQ9uvRuDocYwVxZS2nr9rOwZ8nAh+P2o4e0tEXjxFKQGhxXYkn75H3hhfnFYjik/2qunHBBZfcdG148MaNP6DjX33M238T9Zw/GyGx00JMogr2pdP4JAErv9a5yt4YR41KGf8guSOUbOXVARw6+ybh7+meb7w4BeTlj3aZkv8tVGdfIt3lrwVnlbzhLjeQY6PplKp3/a5Kr5yM0T4wJoKQQ6v3vSNmrhpbuAtKxpMILe8CQoo="; | ||
|
|
There was a problem hiding this comment.
Hardcoded credentials in source code.
While this is a sample/demo application with test credentials (as noted in the file header), hardcoding private keys and certificates in source code is a security risk that could be accidentally replicated in production code. Consider externalizing these to configuration properties or environment variables, even in sample code, to promote better practices.
💡 Suggested approach
+ `@Value`("${fiscalapi.escuelaKemper.base64Cert}")
+ private String escuelaKemperBase64Cert;
+
+ `@Value`("${fiscalapi.escuelaKemper.base64Key}")
+ private String escuelaKemperBase64Key;
- private String escuelaKemperBase64Cert = "MIIFsD...";
- private String escuelaKemperBase64Key = "MIIFDj...";Then add to application.properties:
fiscalapi.escuelaKemper.base64Cert=MIIFsD...
fiscalapi.escuelaKemper.base64Key=MIIFDj...🧰 Tools
🪛 Betterleaks (1.1.1)
[high] 72-72: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In
`@src/main/java/com/fiscalapi/samples/spring/controller/InvoicesController.java`
around lines 71 - 73, The InvoicesController currently embeds sensitive test
cert/key strings in the fields escuelaKemperBase64Cert and
escuelaKemperBase64Key; externalize them into configuration and inject them
instead. Add properties like fiscalapi.escuelaKemper.base64Cert and
fiscalapi.escuelaKemper.base64Key to application.properties (or environment),
create a configuration or use `@Value` to bind them, and replace the hardcoded
fields in InvoicesController with injected values (referencing the field names
escuelaKemperBase64Cert and escuelaKemperBase64Key and the class
InvoicesController) so the secrets are no longer in source.
1 participant
Summary by CodeRabbit
New Features
Chores