Review a pull request: orders API

Not solved

A PR adds order detail, address change and item removal routes. The list route is scoped to the user — are the new ones?

src/routes/orders.ts0/3 found

		import { Router } from 'express'
		import { db } from '../db'
		import { requireAuth } from '../auth'

		export const orders = Router()
		orders.use(requireAuth)

		// Customers list their own orders
		orders.get('/orders', async (req, res) => {
		const rows = await db.query('SELECT * FROM orders WHERE user_id = $1 ORDER BY created_at DESC', [req.user.id])
		res.json(rows)
		})

	+	orders.get('/orders/:id', async (req, res) => {
	+	const order = await db.one('SELECT * FROM orders WHERE id = $1', [req.params.id])
	+	if (!order) return res.sendStatus(404)
	+	res.json(order)
	+	})
	+
	+	orders.patch('/orders/:id/address', async (req, res) => {
	+	const order = await db.one('SELECT * FROM orders WHERE id = $1 AND user_id = $2', [req.params.id, req.user.id])
	+	if (!order) return res.sendStatus(404)
	+	if (order.status !== 'pending') return res.status(409).json({ error: 'Order already shipped' })
	+	Object.assign(order, req.body)
	+	await db.orders.save(order)
	+	res.json(order)
	+	})
	+
	+	orders.delete('/orders/:orderId/items/:itemId', async (req, res) => {
	+	await db.query('DELETE FROM order_items WHERE id = $1', [req.params.itemId])
	+	res.sendStatus(204)
	+	})

Click a line number to flag a defect. The review code appears when every defect is flagged with no false positives.