Typical AI response when using combos/full-review.md on a feature PR.
[TYPE SAFETY] src/services/UserService.ts → getUser returns any instead of User | null → Define return type and handle null case.
[SECURITY] src/routes/users.ts → Line 24: user ID taken from request body instead of auth token for ownership check → Extract user ID from req.auth.userId to prevent IDOR.
[PERFORMANCE] src/routes/users.ts → Line 31: findOne() followed by findRelated() in a loop → Use a single JOIN query or batch with whereIn().
[ARCHITECTURE] src/routes/users.ts → Business logic (validation, transformation) lives in the route handler → Extract to UserService to respect single responsibility.
[TESTING] src/services/UserService.ts → New updateProfile method has no tests → Add unit tests covering: valid update, partial update, non-existent user, duplicate email.
| Category | Count | Top Priority |
|---|---|---|
| Type Safety | 1 | Type getUser return |
| Security | 1 | Fix IDOR vulnerability |
| Performance | 1 | Batch related queries |
| Architecture | 1 | Extract business logic |
| Testing | 1 | Cover updateProfile |
Total: 5. Security fix (IDOR) is critical — address before merge.