Demo Base Kit

[vlussenburg]

✨ PR Description

Purpose: Adds order history functionality and Swagger documentation to the frontend gateway and improves backend data persistence.

Main changes:

• Added /api/orders/history endpoint with frontend UI integration for viewing past orders
• Implemented order storage in H2 database within OrderController for persistent order history
• Added Swagger documentation with swagger-jsdoc and swagger-ui-express for API documentation

Generated by LinearB AI and added by gitStream.
_{AI-generated content may contain inaccuracies. Please verify before using. We'd love your feedback! 🚀}

[gitstream-cm]

✨ PR Review

The PR introduces a comprehensive base kit with database integration, order history functionality, and improved UI. The implementation includes several concerning security and concurrency issues that need attention.

3 issues detected:

🐞 Bug - Concurrent access to the same file without synchronization can lead to data corruption or loss

Details: The file-based billing queue implementation has a race condition where concurrent requests for the same user could corrupt the JSON file or lose data during read-modify-write operations.
File: services/billing-csharp/Controllers/BillingController.cs (56-72)

🔒 Security - String manipulation on untrusted input from external service creates potential injection vulnerability

Details: The token validation logic uses string manipulation with split() and contains() methods that could be vulnerable to injection attacks if the auth service response is compromised or malformed.
File: services/orders-java/src/main/java/com/example/orders/controller/OrderController.java (127-127)

🔒 Security - Global token variable makes it accessible to any script running on the page

Details: The authentication token is stored in a global variable which could be accessed by malicious scripts or browser extensions, potentially leading to session hijacking.
File: frontend/public/app.js (14-14)

Generated by LinearB AI and added by gitStream.
_{AI-generated content may contain inaccuracies. Please verify before using. We'd love your feedback! 🚀}

[gitstream-cm]

🐞 Bug - Race Condition: Add file locking mechanism using FileStream with exclusive access or implement proper synchronization using locks around the file operations.

Suggested change

	private async Task QueueForBillingSystemAsync(string username, object payload)
	{
	Directory.CreateDirectory(StorageDirectory);
	var filePath = Path.Combine(StorageDirectory, $"{username}.json");
	List<object> payloads = new();
	if (System.IO.File.Exists(filePath))
	{
	try
	{
	payloads = JsonSerializer.Deserialize<List<object>>(await System.IO.File.ReadAllTextAsync(filePath)) ?? new();
	}
	catch { }
	}
	payloads.Add(payload);
	await System.IO.File.WriteAllTextAsync(filePath, JsonSerializer.Serialize(payloads, new JsonSerializerOptions { WriteIndented = true }));
	private readonly object _fileLock = new object();
	private async Task QueueForBillingSystemAsync(string username, object payload)
	{
	Directory.CreateDirectory(StorageDirectory);
	var filePath = Path.Combine(StorageDirectory, $"{username}.json");
	await Task.Run(() =>
	{
	lock (_fileLock)
	{
	List<object> payloads = new();
	if (System.IO.File.Exists(filePath))
	{
	try
	{
	payloads = JsonSerializer.Deserialize<List<object>>(System.IO.File.ReadAllText(filePath)) ?? new();
	}
	catch { }
	}
	payloads.Add(payload);
	System.IO.File.WriteAllText(filePath, JsonSerializer.Serialize(payloads, new JsonSerializerOptions { WriteIndented = true }));
	}
	});

[gitstream-cm]

🔒 Security - SQL Injection: Use proper JSON parsing library to parse the auth service response instead of string manipulation methods. Validate the response structure before extracting the username.

Suggested change

	return body.contains("username") ? body.split(":")[1].replaceAll("[\"{} ]", "") : null;
	try {
	org.json.JSONObject jsonResponse = new org.json.JSONObject(body);
	return jsonResponse.has("username") ? jsonResponse.getString("username") : null;
	} catch (org.json.JSONException e) {
	e.printStackTrace();
	return null;
	}

[gitstream-cm]

🔒 Security - Token Exposure: Store the token in a more secure location such as sessionStorage or implement proper token management with secure storage practices.

Suggested change

	token = (await res.json()).token;
	sessionStorage.setItem('authToken', (await res.json()).token);