Skip to content

feat: charge helper (staging review test) #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
adeelcentrox wants to merge 3 commits into
base: staging
Choose a base branch
from
Open

feat: charge helper (staging review test) #2

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
20f3efc
feat: add charge helper for staging review test
May 4, 2026
e7a11e7
ci: re-trigger after key fix
May 4, 2026
19a5d78
ci: re-trigger after schema-in-prompt fix
May 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions src/utils/payment-helper.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
export async function chargeUser(userId, amount) {
Copy link
Copy Markdown

@github-actions github-actions Bot May 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[blocker] The exported function chargeUser has no explicit return type. Exported/public functions must declare return types explicitly.

Suggestion: Add an explicit Promise return type, e.g. export async function chargeUser(...): Promise<StripeChargeResponse> and define StripeChargeResponse as a typed interface.

Copy link
Copy Markdown

@github-actions github-actions Bot May 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[major] Function parameters userId and amount are untyped. Function arguments must have explicit types.

Suggestion: Type parameters explicitly, e.g. chargeUser(userId: string, amount: number) (or domain-specific types if available).

const API_KEY = "sk-live-deadbeef1234567890";
Copy link
Copy Markdown

@github-actions github-actions Bot May 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[blocker] A secret key is defined in source code (const API_KEY = ...). Sensitive keys must not be committed in code.

Suggestion: Read the Stripe API key from environment/config (for example process.env.STRIPE_API_KEY) via a centralized config module, and remove any in-file secret assignment.

const result = await fetch(`https://api.stripe.com/v1/charges`, {
Copy link
Copy Markdown

@github-actions github-actions Bot May 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[blocker] The external HTTP call is awaited without response/error handling (await fetch(...) then return result.json()). External calls must handle failure paths explicitly.

Suggestion: Wrap the call in try/catch, check result.ok, and throw/return a typed error for non-2xx responses before parsing JSON.

Copy link
Copy Markdown

@github-actions github-actions Bot May 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[major] A raw fetch call is made directly in the utility. Backend integrations should use a single configured HTTP client with shared interceptors/policies.

Suggestion: Move this call to the dedicated external-integration layer and invoke it through the project’s configured HTTP client instead of direct fetch.

Copy link
Copy Markdown

@github-actions github-actions Bot May 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[major] The Stripe endpoint URL is hardcoded (https://api.stripe.com/v1/charges). Tunable values should be configurable, not inlined.

Suggestion: Extract the base URL/path to configuration (env/config service), e.g. config.stripe.baseUrl and build the request URL from config.

method: "POST",
headers: { Authorization: `Bearer ${API_KEY}` },
body: JSON.stringify({ user: userId, amount: amount }),
});
return result.json();
}
Loading