AI Review Center

Project

Showing AI reviews for avriti-backend

Project AI Score ?

59%

Quality Avg ?

64%

Security Avg ?

45%

Reviews ?

Review Result ?

jattin01/avriti-backend · 1506f478

This commit introduces multiple API controller improvements including validation enhancements for address input, refined cart item price and attribute handling, and a new OrderController for order creation and retrieval. Validation is done properly but could be expanded. Business value is high due to transactional improvements supporting order placement and cart management. Bug risk is moderate due to reliance on input data for pricing, attribute matching, and order population without extensive error handling or verification. Security is moderate but could be improved by sanitizing user provided addresses and validating inputs more strictly. Overall the work seems genuine and useful with some room for strengthening quality and security.

Quality ?

75%

Security ?

50%

Business Value ?

85%

Maintainability ?

68%

Issues & Suggested Fixes ?

1AI detects the issue

2Shows file, line, or evidence

3Suggests the fix to apply

Non Atomic Order Number Generation With Po...

Where app/Http/Controllers/Api/OrderController.php:36-38

Issue / Evidence Non-atomic order number generation with potential for race conditions

Suggested Fix implement a unique constraint in database and handle collisions instead of looping

Missing Validation

Where app/Http/Controllers/Api/OrderController.php:18-29

Issue / Evidence Validation lacks detailed rules for nested billing_address

Suggested Fix add explicit validation similar to shipping_address to improve data integrity

Potential Null Dereference When Product Is...

Where app/Http/Controllers/Api/CartController.php:41-44

Issue / Evidence Potential null dereference when product is not found

Suggested Fix add null checks and error handling when retrieving product and attribute data to reduce bug risk

Attribute Matching Logic Could Be More Rob...

Where app/Http/Controllers/Api/CartController.php:192-211

Issue / Evidence Attribute matching logic could be more robust

Suggested Fix consider enhancing comparison logic and handling edge cases for type and casing

Missing Validation

Where app/Http/Controllers/Api/AddressController.php:49-50

Issue / Evidence Address validation only includes nullable email

Suggested Fix expand validation for other address fields to enforce consistency

Accessing Product Thumbnail Without Null S...

Where app/Http/Controllers/Api/OrderController.php:131-132

Issue / Evidence Accessing product thumbnail without null safety may cause errors

Suggested Fix add null checks before accessing array indices

Input Fields Like Shipping, Tax, Discount...

Where app/Http/Controllers/Api/OrderController.php:42-60

Issue / Evidence Input fields like shipping, tax, discount are taken directly without sanitization or verification

Suggested Fix add checks or sanitization to avoid data issues or injection

Code Change Preview · app/Http/Controllers/Api/AddressController.php ?

Removed / Before Commit

- use App\Http\Controllers\Controller;
- use App\Models\Address;
- use Illuminate\Http\Request;
- use Illuminate\Http\JsonResponse;
- 
- class AddressController extends Controller
- {
- $request->validate([
- 'full_name'    => ['required', 'string'],
- 'phone'        => ['required', 'string'],
- 'address_line1'=> ['required', 'string'],
- 'city'         => ['required', 'string'],
- 'state'        => ['required', 'string'],
- }
- 
- $address = Address::create([
-             ...$request->only(['full_name','phone','address_line1','address_line2','landmark','city','state','pincode','country','address_type']),
- 'customer_id' => $customerId,

Added / After Commit

+ use App\Http\Controllers\Controller;
+ use App\Models\Address;
+ use Illuminate\Http\Request;
+ 
+ class AddressController extends Controller
+ {
+ $request->validate([
+ 'full_name'    => ['required', 'string'],
+ 'phone'        => ['required', 'string'],
+             'email'        => ['nullable', 'email'],
+ 'address_line1'=> ['required', 'string'],
+ 'city'         => ['required', 'string'],
+ 'state'        => ['required', 'string'],
+ }
+ 
+ $address = Address::create([
+             ...$request->only(['full_name','phone','email','address_line1','address_line2','landmark','city','state','pincode','country','address_type']),
+ 'customer_id' => $customerId,

Removed / Before Commit

- ->where('attribute_name', $request->attribute_name)
- ->first();
- 
- if ($existing) {
- $existing->increment('quantity', $quantity);
- $item = $existing->fresh('product.variant');
- } else {
- $item = CartItem::create([
-                 'customer_id'      => $customerId,
-                 'product_id'       => $request->product_id,
-                 'attribute_name'   => $request->attribute_name,
-                 'attribute_value'  => $request->attribute_value,
-                 'quantity'         => $quantity,
- ]);
- $item->load('product.variant');
- }
- $customerId = $request->user()->id;
-

Added / After Commit

+ ->where('attribute_name', $request->attribute_name)
+ ->first();
+ 
+         // resolve variant_id, sku, price from product attributes
+         $product = Product::with('variant')->find($request->product_id);
+         $attrData = $this->findAttribute($product, $request->attribute_name, $request->attribute_value);
+         $price    = (float) ($attrData['selling_price'] ?? 0);
+ 
+ if ($existing) {
+ $existing->increment('quantity', $quantity);
+             $existing->update([
+                 'price'    => $price,
+                 'subtotal' => round($price * ($existing->quantity), 2),
+                 'sku'      => $attrData['sku'] ?? $existing->sku,
+             ]);
+ $item = $existing->fresh('product.variant');
+ } else {
+ $item = CartItem::create([

Removed / Before Commit

Added / After Commit

+ <?php
+ 
+ namespace App\Http\Controllers\Api;
+ 
+ use App\Http\Controllers\Controller;
+ use App\Models\Order;
+ use App\Models\CartItem;
+ use App\Models\Product;
+ use Illuminate\Http\JsonResponse;
+ use Illuminate\Http\Request;
+ use Illuminate\Support\Str;
+ 
+ class OrderController extends Controller
+ {
+     public function store(Request $request): JsonResponse
+     {
+         $request->validate([
+             'shipping_address'           => ['required', 'array'],

Removed / Before Commit

- class Address extends Model
- {
- protected $fillable = [
-         'customer_id', 'full_name', 'phone', 'address_line1', 'address_line2',
- 'landmark', 'city', 'state', 'pincode', 'country', 'address_type', 'is_default',
- ];

Added / After Commit

+ class Address extends Model
+ {
+ protected $fillable = [
+         'customer_id', 'full_name', 'phone', 'email', 'address_line1', 'address_line2',
+ 'landmark', 'city', 'state', 'pincode', 'country', 'address_type', 'is_default',
+ ];

Removed / Before Commit

- protected $fillable = [
- 'customer_id',
- 'product_id',
- 'attribute_name',
- 'attribute_value',
- 'quantity',
- ];
- 
- public function product(): BelongsTo
- {
- return $this->belongsTo(Product::class);
- }
- }

Added / After Commit

+ protected $fillable = [
+ 'customer_id',
+ 'product_id',
+         'variant_id',
+ 'attribute_name',
+ 'attribute_value',
+         'sku',
+         'price',
+ 'quantity',
+         'subtotal',
+ ];
+ 
+ public function product(): BelongsTo
+ {
+ return $this->belongsTo(Product::class);
+ }
+ 
+     public function variant(): BelongsTo

Removed / Before Commit

Added / After Commit

+ <?php
+ 
+ namespace App\Models;
+ 
+ use Illuminate\Database\Eloquent\Model;
+ use Illuminate\Database\Eloquent\Relations\HasMany;
+ use Illuminate\Database\Eloquent\Relations\BelongsTo;
+ 
+ class Order extends Model
+ {
+     protected $fillable = [
+         'order_number',
+         'customer_id',
+         'shipping_address_id',
+         'billing_address_id',
+         'shipping_address_json',
+         'billing_address_json',
+         'shipping_email',

Removed / Before Commit

Added / After Commit

+ <?php
+ 
+ namespace App\Models;
+ 
+ use Illuminate\Database\Eloquent\Model;
+ use Illuminate\Database\Eloquent\Relations\BelongsTo;
+ 
+ class OrderItem extends Model
+ {
+     protected $fillable = [
+         'order_id',
+         'product_id',
+         'variant_id',
+         'product_name',
+         'variant_name',
+         'attribute_name',
+         'attribute_value',
+         'sku',

Removed / Before Commit

Added / After Commit

+ <?php
+ 
+ use Illuminate\Database\Migrations\Migration;
+ use Illuminate\Database\Schema\Blueprint;
+ use Illuminate\Support\Facades\Schema;
+ 
+ return new class extends Migration
+ {
+     public function up(): void
+     {
+         Schema::table('addresses', function (Blueprint $table) {
+             $table->string('email')->nullable()->after('phone');
+         });
+     }
+ 
+     public function down(): void
+     {
+         Schema::table('addresses', function (Blueprint $table) {

Removed / Before Commit

- \ No newline at end of file

Added / After Commit

+ <?php
+ 
+ use Illuminate\Database\Migrations\Migration;
+ use Illuminate\Database\Schema\Blueprint;
+ use Illuminate\Support\Facades\Schema;
+ 
+ return new class extends Migration
+ {
+     public function up(): void
+     {
+         Schema::table('cart_items', function (Blueprint $table) {
+ 
+             $table->unsignedBigInteger('variant_id')
+                   ->nullable()
+                   ->after('product_id');
+ 
+             $table->string('sku')
+                   ->nullable()

Removed / Before Commit

Added / After Commit

+ <?php
+ 
+ use Illuminate\Database\Migrations\Migration;
+ use Illuminate\Database\Schema\Blueprint;
+ use Illuminate\Support\Facades\Schema;
+ 
+ return new class extends Migration
+ {
+     /**
+      * Run the migrations.
+      */
+     public function up(): void
+     {
+         Schema::create('orders', function (Blueprint $table) {
+             $table->id();
+             $table->string('order_number')->unique();
+             $table->foreignId('customer_id')->constrained('customers')->onDelete('cascade');
+

Removed / Before Commit

Added / After Commit

+ <?php
+ 
+ use Illuminate\Database\Migrations\Migration;
+ use Illuminate\Database\Schema\Blueprint;
+ use Illuminate\Support\Facades\Schema;
+ 
+ return new class extends Migration
+ {
+     /**
+      * Run the migrations.
+      */
+     public function up(): void
+     {
+         Schema::create('order_items', function (Blueprint $table) {
+             $table->id();
+             $table->foreignId('order_id')->constrained('orders')->onDelete('cascade');
+ 
+             $table->unsignedBigInteger('product_id')->nullable();

Removed / Before Commit

- use App\Http\Controllers\Api\ServiceController;
- use App\Http\Controllers\Api\ContactController;
- use App\Http\Controllers\Api\AddressController;
- 
- Route::post('/register', [AuthController::class, 'apiRegister'])->name('api.register');
- Route::post('/login', [AuthController::class, 'apiLogin'])->name('api.login');
- Route::delete('/addresses/{id}', [AddressController::class, 'destroy']);
- Route::patch('/addresses/{id}/default', [AddressController::class, 'setDefault']);
- 
- Route::get('/cart', [CartController::class, 'index']);
- Route::post('/cart/add', [CartController::class, 'add']);
- Route::post('/cart/merge', [CartController::class, 'merge']);

Added / After Commit

+ use App\Http\Controllers\Api\ServiceController;
+ use App\Http\Controllers\Api\ContactController;
+ use App\Http\Controllers\Api\AddressController;
+ use App\Http\Controllers\Api\OrderController;
+ 
+ Route::post('/register', [AuthController::class, 'apiRegister'])->name('api.register');
+ Route::post('/login', [AuthController::class, 'apiLogin'])->name('api.login');
+ Route::delete('/addresses/{id}', [AddressController::class, 'destroy']);
+ Route::patch('/addresses/{id}/default', [AddressController::class, 'setDefault']);
+ 
+         Route::post('/order', [OrderController::class, 'store']);
+         Route::get('/orders', [OrderController::class, 'index']);
+         Route::get('/orders/{id}', [OrderController::class, 'show']);
+ 
+ Route::get('/cart', [CartController::class, 'index']);
+ Route::post('/cart/add', [CartController::class, 'add']);
+ Route::post('/cart/merge', [CartController::class, 'merge']);