Issue 20: Remove raw SQL usage from the codebase

WebGoatCore/Controllers/CartController.cs

@@ -35,15 +35,24 @@ public IActionResult AddOrder(int productId, short quantity)
             }
 
             var product = _productRepository.GetProductById(productId);
-            var orderDetail = new OrderDetail()
+
+            if(!cart.OrderDetails.ContainsKey(productId))
             {
-                Discount = 0.0F,
-                ProductId = productId,
-                Quantity = quantity,
-                Product = product,
-                UnitPrice = product.UnitPrice
-            };
-            cart.OrderDetails.Add(orderDetail);
+                var orderDetail = new OrderDetail()
+                {
+                    Discount = 0.0F,
+                    ProductId = productId,
+                    Quantity = quantity,
+                    Product = product,
+                    UnitPrice = product.UnitPrice
+                };
+                cart.OrderDetails.Add(orderDetail.ProductId, orderDetail);
+            }
+            else
+            {
+                var originalOrder = cart.OrderDetails[productId];
+                originalOrder.Quantity += quantity;
+            }
 
             HttpContext.Session.Set("Cart", cart);
 
@@ -57,13 +66,12 @@ public IActionResult RemoveOrder(int productId)
             {
                 if (HttpContext.Session.TryGet<Cart>("Cart", out var cart))
                 {
-                    var orderDetail = cart.OrderDetails.First(od => od.ProductId == productId);
-                    if (orderDetail == null)
+                    if (!cart.OrderDetails.ContainsKey(productId))
                     {
                         return View("RemoveOrderError", string.Format("Product {0} was not found in your cart.", productId));
                     }
 
-                    cart.OrderDetails.Remove(orderDetail);
+                    cart.OrderDetails.Remove(productId);
                     HttpContext.Session.Set("Cart", cart);
 
                     Response.Redirect("~/ViewCart.aspx");

WebGoatCore/Controllers/CheckoutController.cs

@@ -141,7 +141,7 @@ public IActionResult Checkout(CheckoutViewModel model)
                 ShipRegion = model.Region,
                 ShipPostalCode = model.PostalCode,
                 ShipCountry = model.Country,
-                OrderDetails = model.Cart.OrderDetails,
+                OrderDetails = model.Cart.OrderDetails.Values.ToList(),
                 CustomerId = customer.CustomerId,
                 OrderDate = DateTime.Now,
                 RequiredDate = DateTime.Now.AddDays(7),

WebGoatCore/Models/Cart.cs

@@ -5,14 +5,15 @@ namespace WebGoatCore.Models
 {
     public class Cart
     {
-        public List<OrderDetail> OrderDetails { get; set; }
+        //public List<OrderDetail> OrderDetails { get; set; }
+        public IDictionary<int, OrderDetail> OrderDetails { get; set; }
 
         public decimal SubTotal =>
-            OrderDetails.Sum(od => od.ExtendedPrice);
+            OrderDetails.Values.Sum(od => od.ExtendedPrice);
 
         public Cart()
         {
-            OrderDetails = new List<OrderDetail>();
+            OrderDetails = new Dictionary<int, OrderDetail>();
         }
     }
 }

WebGoatCore/Views/Shared/_CartPartial.cshtml

@@ -9,7 +9,7 @@
             <th>Quantity</th>
             <th>Extended Price</th>
         </tr>
-        @foreach (var order in Model.OrderDetails)
+        @foreach (var order in Model.OrderDetails.Values)
         {
             <tr class="itemRow">
                 <td class="productId">@order.ProductId</td>