"Just make it work" - AI
router.post("/orders", async (req, res) => {
// 🔴 userId from client, spoofable
const { userId, items } = req.body;
// 🔴 DB fails after this = ghost payment
await stripe.charges.create({ amount: calcTotal(items) });
// 🔴 double-click = double charge
const order = await db.insert("orders", { userId, items, status: "paid" });
await mailer.send({ to: req.body.email }); // 🔴 blocks response
res.json(order); // 🔴 leaks internals
});
AFTER AZATI ENGINEERING REVIEW
Typed, safe, auditable
router.post("/orders", auth(), idempotent(), async (req, res, next) => {
const input = OrderSchema.parse(req.body); // ✅ validated and sanitized
const order = await orderService.placeAtomic( // ✅ atomic transaction
req.user.id, input // ✅ userId from token
);
await queue.enqueue("order:confirmation", order.id); // ✅ async
res.status(201).json(toSafeView(order)); // ✅ safe projection
});
