code-update-quality

[vlussenburg]

✨ PR Description

Purpose and impact:
This PR enhances security, improves error handling, and adds date tracking for billing operations across multiple services.

Main changes:

• Removes admin credentials from auth service and adds error logging
• Adds date field to billing requests and stores charge history
• Fixes token formatting in frontend and adds placeholder for order history

Generated by LinearB AI and added by gitStream.
_{AI-generated content may contain inaccuracies. Please verify before using. We’d love your feedback! 🚀}

[gitstream-cm]

This PR contains a TODO statement. Please check to see if they should be removed.

[gitstream-cm]

This PR affects one or more sensitive files and requires review from the security team.

[gitstream-cm]

Please mark which AI tools you used for this PR by checking the appropriate boxes:

• GitHub Copilot
• Cursor
• ChatGPT
• Tabnine
• JetBrains AI Assistant
• VSCode IntelliCode
• Claude
• Gemini
• Other AI tool
• No AI tools were used

Tip: If you want to avoid this comment in the future, you can add a label of the format 🤖 ai-* when creating your PR.

[gitstream-cm]

✨ PR Review

General Feedback

This PR includes several changes across the codebase including adding error logging, implementing a history feature in the billing service, and adding date tracking to charges. However, there are several issues that need addressing: a typo in the "date" field being sent as "dats" in OrderController, a missing space in the Authorization header in the frontend code, and removed admin credentials which may impact existing functionality.

File: services/orders-java/src/main/java/com/example/orders/controller/OrderController.java
Bug - Field Name Mismatch

Details

Problem: Field Name Mismatch - The OrderController is adding a timestamp field named "dats" but the BillingController expects a field named "date". This mismatch will cause the date information to be lost between services.
Fix: Correct the field name in OrderController to match the expected "date" field name in BillingController.
Why: The field name "dats" in OrderController doesn't match the "date" field name expected by BillingController.

JSONObject payload = new JSONObject();
 payload.put("username", username);
 payload.put("productId", productId);
 payload.put("quantity", quantity);
-payload.put("dats", Instant.now().toString());
+payload.put("date", Instant.now().toString());

File: frontend/public/app.js
Bug - Missing Space in Authorization Header

Details

Problem: Missing Space in Authorization Header - The Authorization header value is missing a space between "Bearer" and the token value, which will cause authentication failures.
Fix: Add a space between "Bearer" and the token value in the Authorization header.
Why: The Authorization header format is incorrect as it's missing a required space between the Bearer prefix and the token.

headers: {
   "Content-Type": "application/json",
-  "Authorization": "Bearer" + token
+  "Authorization": "Bearer " + token
 },
 body: JSON.stringify({ productId, quantity }),

File: services/auth-python/app/auth.py
Security - Removed Admin User

Details

Problem: Removed Admin User - The PR removes the admin user credentials from the USER_DB dictionary. This could break existing functionality that depends on admin access.
Fix: Preserve the admin user unless there's a specific reason to remove it, or ensure all systems are updated to handle the removal.
Why: Removing existing user credentials without proper migration can break authentication for services that rely on those credentials.

USER_DB = {
     "alice": "password123",
-    "bob": "hunter2"
+    "bob": "hunter2",
+    "admin": "admin"
 }

Generated by LinearB AI and added by gitStream.
_{AI-generated content may contain inaccuracies. Please verify before using. We’d love your feedback! 🚀}

[gitstream-cm]

🥷 Code experts: cghyzel, amitmohleji

cghyzel, amitmohleji have most 👩‍💻 activity in the files.
cghyzel, amitmohleji have most 🧠 knowledge in the files.

See details

frontend/public/app.js

Activity based on git-commit:

	cghyzel	amitmohleji
MAY
APR
MAR		33 additions & 0 deletions
FEB
JAN
DEC

Knowledge based on git-blame:
amitmohleji: 100%

frontend/public/index.html

Activity based on git-commit:

	cghyzel	amitmohleji
MAY
APR
MAR		20 additions & 0 deletions
FEB
JAN
DEC

Knowledge based on git-blame:
amitmohleji: 100%

services/auth-python/app/auth.py

Activity based on git-commit:

	cghyzel	amitmohleji
MAY
APR	33 additions & 0 deletions
MAR
FEB
JAN
DEC

Knowledge based on git-blame:
cghyzel: 100%

services/billing-csharp/Controllers/BillingController.cs

Activity based on git-commit:

	cghyzel	amitmohleji
MAY
APR
MAR	45 additions & 0 deletions
FEB
JAN
DEC

Knowledge based on git-blame:
cghyzel: 100%

services/orders-java/src/main/java/com/example/orders/controller/OrderController.java

Activity based on git-commit:

	cghyzel	amitmohleji
MAY	75 additions & 0 deletions
APR
MAR
FEB
JAN
DEC

Knowledge based on git-blame:
cghyzel: 100%

To learn more about /:\ gitStream - Visit our Docs

[gitstream-cm]

✨ PR Review

General Feedback

This PR includes several updates across Java, C#, JavaScript, and Python services that improve error handling and add timestamp functionality. While there are some good improvements to response payloads and data capture, there are several critical issues including a misspelled field name in JSON payload, a broken authentication token header format, and exposed stack traces that could reveal sensitive implementation details.

File: services/orders-java/src/main/java/com/example/orders/controller/OrderController.java
Bug - Misspelled Field Name

Details

Problem: Misspelled Field Name - The field name 'dats' in the payload JSON object is misspelled and doesn't match the expected field name 'date' in the BillingController.cs receiver. This will cause the timestamp information to be lost during the billing process.
Fix: Correct the field name from 'dats' to 'date' to match the receiving controller's property name
Why: Inconsistent field naming breaks the contract between services and will cause data to be missing

public class OrderController {
     JSONObject payload = new JSONObject();
     payload.put("username", username);
     payload.put("productId", productId);
     payload.put("quantity", quantity);
-    payload.put("dats", Instant.now().toString());
+    payload.put("date", Instant.now().toString());

File: frontend/public/app.js
Bug - Broken Authentication

Details

Problem: Broken Authentication - The Authorization header format is incorrect - there's no space between 'Bearer' and the token value. This will cause authentication to fail as authorization headers require proper formatting to be parsed correctly.
Fix: Add a space between 'Bearer' and the token value in the Authorization header
Why: The authorization header format "Bearer" + token is missing a space, which breaks the standard format and will cause authentication failures

async function placeOrder() {
     method: "POST",
     headers: {
       "Content-Type": "application/json",
-      "Authorization": "Bearer" + token
+      "Authorization": "Bearer " + token
     },
     body: JSON.stringify({ productId, quantity }),
   });

File: services/orders-java/src/main/java/com/example/orders/controller/OrderController.java
Security - Exposed Exception Details

Details

Problem: Exposed Exception Details - The code now prints stack traces to standard output when exceptions occur. This could expose sensitive implementation details or system configuration in production environments that may be exploitable.
Fix: Replace direct stack trace printing with proper logging that respects the environment (dev/prod) context
Why: Printing stack traces can leak sensitive implementation details that could aid attackers in exploiting the system

public class OrderController {
         String body = authResponse.getBody();
         return body.contains("username") ? body.split(":")[1].replaceAll("[\"{} ]", "") : null;
     } catch (Exception e) {
-        e.printStackTrace();
+        logger.error("Error authenticating user", e);
         return null;
     }
 }

Generated by LinearB AI and added by gitStream.
_{AI-generated content may contain inaccuracies. Please verify before using. We’d love your feedback! 🚀}

[gitstream-cm]

This PR is missing a Jira ticket reference in the title or description.
Please add a Jira ticket reference to the title or description of this PR.

[gitstream-cm]

Hello vlussenburg 👋 Thanks for making your first PR, and welcome to our project!
Our mentor team has automatically been assigned to review this PR and guide you through the process.
Please reach out to that team if you have questions about the next steps.

[gitstream-cm]

🥷 Code experts: cghyzel, amitmohleji

cghyzel, amitmohleji have most 👩‍💻 activity in the files.
cghyzel, amitmohleji have most 🧠 knowledge in the files.

See details

frontend/public/app.js

Activity based on git-commit:

	cghyzel	amitmohleji
MAY
APR
MAR		33 additions & 0 deletions
FEB
JAN
DEC

Knowledge based on git-blame:
amitmohleji: 100%

frontend/public/index.html

Activity based on git-commit:

	cghyzel	amitmohleji
MAY
APR
MAR		20 additions & 0 deletions
FEB
JAN
DEC

Knowledge based on git-blame:
amitmohleji: 100%

services/auth-python/app/auth.py

Activity based on git-commit:

	cghyzel	amitmohleji
MAY
APR	33 additions & 0 deletions
MAR
FEB
JAN
DEC

Knowledge based on git-blame:
cghyzel: 100%

services/billing-csharp/Controllers/BillingController.cs

Activity based on git-commit:

	cghyzel	amitmohleji
MAY
APR
MAR	45 additions & 0 deletions
FEB
JAN
DEC

Knowledge based on git-blame:
cghyzel: 100%

services/orders-java/src/main/java/com/example/orders/controller/OrderController.java

Activity based on git-commit:

	cghyzel	amitmohleji
MAY	75 additions & 0 deletions
APR
MAR
FEB
JAN
DEC

Knowledge based on git-blame:
cghyzel: 100%

To learn more about /:\ gitStream - Visit our Docs