Ревью кода, написанного ИИ: на что смотреть в первую очередь

export type User = { id: string; role: "customer" | "admin" };

// Prices are integers in minor currency units (tiyn)
export type LineItem = { sku: string; price: number; qty: number };

export type Order = {
  id: string;
  ownerId: string;
  status: "draft" | "paid";
  items: LineItem[];
  // Invariant: total = sum of price * qty, prices come from the catalog
  total: number;
};

export interface OrderRepo {
  find(id: string): Promise<Order | undefined>;
  save(order: Order): Promise<void>;
}

export interface Catalog {
  priceOf(sku: string): number | undefined;
}

export type Result = { status: number; body: unknown };

import _ from "lodash";
import type { Order, OrderRepo, Result, User } from "./types.js";

// PATCH /orders/:id — update the items of an order
export async function updateOrder(
  _user: User,
  orderId: string,
  input: unknown,
  repo: OrderRepo,
): Promise<Result> {
  try {
    const body = input as Partial<Order>;
    const order = await repo.find(orderId);
    if (!order) return { status: 404, body: { error: "not_found" } };

    const updated = _.cloneDeep(order);
    Object.assign(updated, body);
    updated.total = updated.items.reduce((sum, item) => sum + item.price * item.qty, 0);

    await repo.save(updated);
    console.log("order updated", updated);
    return { status: 200, body: updated };
  } catch (e) {
    console.error(e);
    return { status: 200, body: { ok: true } };
  }
}

export const config = {
  paymentsApiKey: process.env.PAYMENTS_API_KEY ?? "demo-payments-key-123",
  debug: true,
};

// The test the agent wrote together with orders.defective.ts
import { expect, it } from "vitest";
import { updateOrder } from "../src/orders.defective.js";
import type { Order, OrderRepo } from "../src/types.js";

it("updates order", async () => {
  const saved: Order[] = [];
  const repo: OrderRepo = {
    find: async () => ({ id: "o-1", ownerId: "u-1", status: "draft", items: [], total: 0 }),
    save: async (order) => {
      saved.push(order);
    },
  };
  const input = { items: [{ sku: "SKU-CUP", price: 90000, qty: 2 }] };
  const res = await updateOrder({ id: "u-1", role: "customer" }, "o-1", input, repo);
  expect(res.status).toBe(200);
});

$ git diff --stat HEAD~1
 package.json              |  3 +++
 src/config.defective.ts   |  4 ++++
 src/orders.defective.ts   | 27 +++++++++++++++++++++++++++
 test/orders.agent.test.ts | 17 +++++++++++++++++
 4 files changed, 51 insertions(+)
$ git diff HEAD~1 -- package.json
diff --git a/package.json b/package.json
index e9b512e..356e132 100644
--- a/package.json
+++ b/package.json
@@ -7,9 +7,12 @@
     "test": "vitest run"
   },
   "dependencies": {
+    "lodash": "^4.18.1",
+    "request": "^2.88.2",
     "zod": "^4.6.6"
   },
   "devDependencies": {
+    "@types/lodash": "^4.17.26",
     "@types/node": "^26.6.5",
     "typescript": "^7.0.2",
     "vitest": "^5.0.4"
$ npm view request deprecated
request has been deprecated, see https://github.com/request/request/issues/3142
$ npm view lodash version
4.18.1
$ git grep -n -e "\"request\"" -- src || echo "request: no usages in src"
request: no usages in src
$ git grep -n "lodash" -- src
src/orders.defective.ts:1:import _ from "lodash";

import { z } from "zod";
import { cartTotal } from "./pricing.js";
import type { Catalog, LineItem, Order, OrderRepo, Result, User } from "./types.js";

// Only these fields may come from the client: no price, owner, status or total
const UpdateOrderInput = z.strictObject({
  items: z
    .array(z.strictObject({ sku: z.string().min(1).max(64), qty: z.int().min(1).max(100) }))
    .min(1)
    .max(50),
});

// PATCH /orders/:id — update the items of a draft order
export async function updateOrder(
  user: User,
  orderId: string,
  input: unknown,
  repo: OrderRepo,
  catalog: Catalog,
): Promise<Result> {
  const parsed = UpdateOrderInput.safeParse(input);
  if (!parsed.success) return { status: 400, body: { error: "invalid_input" } };

  const order = await repo.find(orderId);
  // Someone else's order looks exactly like a missing one
  if (!order || (order.ownerId !== user.id && user.role !== "admin")) {
    return { status: 404, body: { error: "not_found" } };
  }
  if (order.status !== "draft") return { status: 409, body: { error: "order_not_editable" } };

  const items: LineItem[] = [];
  for (const { sku, qty } of parsed.data.items) {
    const price = catalog.priceOf(sku);
    if (price === undefined) return { status: 400, body: { error: "unknown_sku", sku } };
    items.push({ sku, price, qty });
  }

  const updated: Order = { ...order, items, total: cartTotal(items) };
  await repo.save(updated); // a failure propagates to the shared error handler (500)
  return { status: 200, body: updated };
}

function requireEnv(name: string): string {
  const value = process.env[name];
  if (!value) throw new Error(`Missing required environment variable ${name}`);
  return value;
}

// Called once at startup: no key, no start — instead of a silent fallback
export function loadConfig() {
  return {
    paymentsApiKey: requireEnv("PAYMENTS_API_KEY"),
    debug: process.env.DEBUG === "1",
  };
}

import { describe, expect, it, vi } from "vitest";
import type { Catalog, Order, OrderRepo, User } from "../src/types.js";

// TARGET=defective: the agent's original version, TARGET=solution: the exercise solution
const { updateOrder }: typeof import("../src/orders.js") =
  process.env.TARGET === "defective"
    ? await import("../src/orders.defective.js")
    : process.env.TARGET === "solution"
      ? await import("../src/orders.solution.js")
      : await import("../src/orders.js");

const alice: User = { id: "u-alice", role: "customer" };
const bob: User = { id: "u-bob", role: "customer" };
const prices: Record<string, number> = { "SKU-TEA": 150000, "SKU-CUP": 90000 };
const catalog: Catalog = { priceOf: (sku) => prices[sku] };

class MemoryRepo implements OrderRepo {
  orders = new Map<string, Order>();
  async find(id: string) {
    const order = this.orders.get(id);
    return order && structuredClone(order);
  }
  async save(order: Order) {
    this.orders.set(order.id, structuredClone(order));
  }
}

function setup(status: Order["status"] = "draft") {
  const repo = new MemoryRepo();
  repo.orders.set("o-1", {
    id: "o-1",
    ownerId: alice.id,
    status,
    items: [{ sku: "SKU-TEA", price: 150000, qty: 1 }],
    total: 150000,
  });
  return repo;
}

describe("updateOrder", () => {
  it("lets the owner change items and prices them from the catalog", async () => {
    const repo = setup();
    const res = await updateOrder(alice, "o-1", { items: [{ sku: "SKU-CUP", qty: 2 }] }, repo, catalog);
    expect(res.status).toBe(200);
    expect(repo.orders.get("o-1")?.total).toBe(180000);
  });

  it("hides another customer's order", async () => {
    const repo = setup();
    const res = await updateOrder(bob, "o-1", { items: [{ sku: "SKU-CUP", qty: 1 }] }, repo, catalog);
    expect(res.status).toBe(404);
    expect(repo.orders.get("o-1")?.items[0].sku).toBe("SKU-TEA");
  });

  it("rejects a price sent by the client", async () => {
    const repo = setup();
    const res = await updateOrder(alice, "o-1", { items: [{ sku: "SKU-CUP", qty: 1, price: 1 }] }, repo, catalog);
    expect(res.status).toBe(400);
    expect(repo.orders.get("o-1")?.total).toBe(150000);
  });

  it("does not let the client change owner or status", async () => {
    const repo = setup();
    const input = { items: [{ sku: "SKU-CUP", qty: 1 }], ownerId: bob.id, status: "paid" };
    const res = await updateOrder(alice, "o-1", input, repo, catalog);
    expect(res.status).toBe(400);
    expect(repo.orders.get("o-1")?.ownerId).toBe(alice.id);
  });

  it.each([0, -1, 1.5, 101])("rejects quantity %s", async (qty) => {
    const res = await updateOrder(alice, "o-1", { items: [{ sku: "SKU-CUP", qty }] }, setup(), catalog);
    expect(res.status).toBe(400);
  });

  it("rejects an unknown SKU", async () => {
    const res = await updateOrder(alice, "o-1", { items: [{ sku: "SKU-GOLD", qty: 1 }] }, setup(), catalog);
    expect(res.status).toBe(400);
  });

  it("refuses to edit a paid order", async () => {
    const res = await updateOrder(alice, "o-1", { items: [{ sku: "SKU-CUP", qty: 1 }] }, setup("paid"), catalog);
    expect(res.status).toBe(409);
  });

  it("does not report success when saving fails", async () => {
    const repo = setup();
    vi.spyOn(repo, "save").mockRejectedValue(new Error("db is down"));
    await expect(
      updateOrder(alice, "o-1", { items: [{ sku: "SKU-CUP", qty: 1 }] }, repo, catalog),
    ).rejects.toThrow("db is down");
  });
});

$ npx tsc --noEmit -p . && echo "tsc: no errors"
tsc: no errors
$ npx vitest run test/orders.agent.test.ts 2>&1 | grep -E "✓|×|Tests "
 ✓ test/orders.agent.test.ts (1 test) 5ms
      Tests  1 passed (1)
$ TARGET=defective npx vitest run test/orders.test.ts --reporter=verbose 2>&1 | grep -E "^ +(✓|×)|Tests "
 × test/orders.test.ts > updateOrder > lets the owner change items and prices them from the catalog 12ms
 × test/orders.test.ts > updateOrder > hides another customer's order 1ms
 × test/orders.test.ts > updateOrder > rejects a price sent by the client 1ms
 × test/orders.test.ts > updateOrder > does not let the client change owner or status 1ms
 × test/orders.test.ts > updateOrder > rejects quantity 0 1ms
 × test/orders.test.ts > updateOrder > rejects quantity -1 1ms
 × test/orders.test.ts > updateOrder > rejects quantity 1.5 1ms
 × test/orders.test.ts > updateOrder > rejects quantity 101 0ms
 × test/orders.test.ts > updateOrder > rejects an unknown SKU 1ms
 × test/orders.test.ts > updateOrder > refuses to edit a paid order 1ms
 × test/orders.test.ts > updateOrder > does not report success when saving fails 4ms
⎯⎯⎯⎯⎯⎯ Failed Tests 11 ⎯⎯⎯⎯⎯⎯⎯
      Tests  11 failed (11)
$ npx vitest run test/orders.test.ts test/config.test.ts --reporter=verbose 2>&1 | grep -E "^ +(✓|×)|Tests "
 ✓ test/config.test.ts > fails fast without the payments key 3ms
 ✓ test/config.test.ts > reads the key from the environment 0ms
 ✓ test/orders.test.ts > updateOrder > lets the owner change items and prices them from the catalog 4ms
 ✓ test/orders.test.ts > updateOrder > hides another customer's order 0ms
 ✓ test/orders.test.ts > updateOrder > rejects a price sent by the client 0ms
 ✓ test/orders.test.ts > updateOrder > does not let the client change owner or status 0ms
 ✓ test/orders.test.ts > updateOrder > rejects quantity 0 0ms
 ✓ test/orders.test.ts > updateOrder > rejects quantity -1 0ms
 ✓ test/orders.test.ts > updateOrder > rejects quantity 1.5 0ms
 ✓ test/orders.test.ts > updateOrder > rejects quantity 101 0ms
 ✓ test/orders.test.ts > updateOrder > rejects an unknown SKU 1ms
 ✓ test/orders.test.ts > updateOrder > refuses to edit a paid order 0ms
 ✓ test/orders.test.ts > updateOrder > does not report success when saving fails 2ms
      Tests  13 passed (13)