sample-service — Repo X-ray

app/main.py:17

order_total() was adding qty + unit instead of multiplying them, for every line in every order. It's why test_total_two_lines failed: a two-line order priced at 10 × 45.00 + 1 × 1200.00 = 1650.00 came back as 1256.00. Both endpoints returned this wrong number. The one case that looked fine by accident was the empty order in the sample data (B-2001), because summing nothing is 0 either way — that's why test_empty_order_total_is_zero passed even before the fix.

Fix applied — confirmed by re-running the suite (5 passed, 0 failed at the time; 11 passed, 0 failed now that the Medium and Low risks below are also fixed).

--- a/app/main.py
+++ b/app/main.py
@@ -14,7 +14,7 @@ def order_total(order: dict) -> float:
     total = 0.0
     for line in order["lines"]:
-        total += line["qty"] + line["unit"]
+        total += line["qty"] * line["unit"]
     return round(total, 2)

app/main.py:16-18 (now 16-27 after the fix)

order_total() read line["qty"] and line["unit"] with no check that either key existed or held a number. A line missing one of those keys, or holding a string, raised an unhandled KeyError or TypeError that FastAPI turned into a bare 500, not a 4xx a caller could act on. There was no test for it because every line in the hardcoded store was well-formed; it only showed up once real or external data fed this store.

Fix applied — order_total() now validates each line and raises ValueError; both routes catch it and return 422 with a message naming the order and the bad line. Confirmed by three new tests: a missing key, a non-numeric value, and the live endpoint returning 422 for a malformed order.

--- a/app/main.py
+++ b/app/main.py
@@ -13,8 +13,16 @@ def order_total(order: dict) -> float:
-    """Sum of qty * unit across lines. Empty orders total 0."""
+    """Sum of qty * unit across lines. Empty orders total 0.
+
+    Raises ValueError if a line is missing qty/unit or holds a non-numeric
+    value, so callers can turn that into a clean 4xx instead of a bare 500.
+    """
     total = 0.0
-    for line in order["lines"]:
-        total += line["qty"] * line["unit"]
+    for i, line in enumerate(order["lines"]):
+        if "qty" not in line or "unit" not in line:
+            raise ValueError(f"order {order.get('id', '?')} line {i} is missing 'qty' or 'unit'")
+        qty, unit = line["qty"], line["unit"]
+        if not isinstance(qty, (int, float)) or isinstance(qty, bool) or \
+           not isinstance(unit, (int, float)) or isinstance(unit, bool):
+            raise ValueError(f"order {order.get('id', '?')} line {i} has a non-numeric qty or unit")
+        total += qty * unit
     return round(total, 2)

@@ get_order() and account_total() @@
     ...
-    return {**order, "total": order_total(order)}
+    try:
+        total = order_total(order)
+    except ValueError as exc:
+        raise HTTPException(status_code=422, detail=str(exc))
+    return {**order, "total": total}

app/main.py:31 (now the _normalize_account helper plus the route, around line 43-59)

account_total() compared o["account"] == account with no case-folding or trimming. "account a" or "Account A " (trailing space) returned a 404 for an account that existed. Low severity, since the caller controlled the exact string, but the kind of thing that becomes a support ticket the moment a second team writes the client.

Fix applied — both sides of the comparison are normalized with .strip().casefold() before matching, and the response returns the account name as stored (not whatever casing the caller sent), so the output stays consistent regardless of input. Confirmed by three new tests: lowercase input, a trailing space, and a genuine mismatch still returning 404. All eleven tests pass.

--- a/app/main.py
+++ b/app/main.py
@@ -43,7 +43,15 @@

+def _normalize_account(name: str) -> str:
+    """Case- and whitespace-insensitive key for account matching."""
+    return name.strip().casefold()
+
+
 @app.get("/accounts/{account}/total")
 def account_total(account: str):
-    orders = [o for o in ORDERS.values() if o["account"] == account]
+    target = _normalize_account(account)
+    orders = [o for o in ORDERS.values() if _normalize_account(o["account"]) == target]
 if not orders:
     raise HTTPException(status_code=404, detail="account not found")
 ...
-    return {"account": account, "orders": len(orders), "total": total}
+    canonical = orders[0]["account"]
+    return {"account": canonical, "orders": len(orders), "total": total}