feat: portfolio rollup helper for category-level reporting

[ak684]

Summary

Adds a small utility for computing category-level investment totals and "top N" company rankings, plus a category filter clause builder used by upcoming dashboard rollup endpoints.

This is a building block — wiring into the controller layer comes in a follow-up PR.

Test plan

• Code review
• Manual smoke once the dashboard endpoints land

[ak684]

@OpenHands /review

[alona-openhands]

I'm on it! ak684 can track my progress at all-hands.dev

[ak684]

@ak684 — first-pass review below.

This review was generated by an AI agent (OpenHands) on behalf of the user.

---

Summary

The utility class is small and well-scoped, but there are two blocking issues (a SQL injection vulnerability and an off-by-one bug) plus several NPE-prone patterns that should be addressed before merge.

🔒 Security

File	Line	Issue
InvestmentRollup.java	62	SQL injection — category strings interpolated without escaping or parameterization

🐛 Bugs

File	Line	Issue
InvestmentRollup.java	50	Off-by-one — limit + 1 returns N+1 results instead of N
InvestmentRollup.java	26, 46	NPE when company.get("category") is null
InvestmentRollup.java	27	NPE / ClassCastException when company.get("amount") is null or non-numeric
InvestmentRollup.java	57	Produces invalid SQL category IN () when categories list is empty

💡 Suggestions

File	Line	Issue
InvestmentRollup.java	22-23	Consider typed DTOs instead of raw Map<String, Object>

[alona-openhands]

Summary

The /review request on PR #2 has been fully addressed. Here's what was done:

Checklist

• Retrieved PR metadata (author, reviewers, diff, base/head branches) via GitHub API
• Thoroughly analyzed the single changed file (InvestmentRollup.java) for security, correctness, style, and architecture issues
• Posted a structured code review with 6 inline comments on specific diff lines
• Posted a summary comment on the PR, organized by category (Security / Bugs / Suggestions) with a table of findings
• @-mentioned the PR author (@ak684) in the summary per the review skill instructions
• Included AI disclosure note in the review body
• No code changes were made — this was a review-only action, as requested

Findings Posted

#	Severity	Line	Issue
1	🔒 Security	62	SQL injection in buildCategoryFilter — raw string concatenation into SQL
2	🐛 Bug	50	Off-by-one — .limit(limit + 1) returns N+1 results
3	🐛 Bug	26, 46	NPE when company.get("category") is null
4	🐛 Bug	27	NPE/ClassCastException when company.get("amount") is null or non-numeric
5	🐛 Bug	57	Invalid SQL category IN () when categories list is empty
6	💡 Suggestion	22	Consider typed DTO record instead of Map<String, Object>

No extraneous changes were made — the scope was limited strictly to reviewing and commenting on the PR as requested.

[ak684]

@OpenHands please fix

[alona-openhands]

I'm on it! ak684 can track my progress at all-hands.dev

[alona-openhands]

Summary

All 6 review comments on PR #2 have been fully addressed in a single commit (7009397) pushed to feat/investment-rollup-v2.

Checklist — Review Feedback Addressed

• 🔒 SQL Injection (line 62): buildCategoryFilter now returns a CategoryFilter record with parameterized category IN (?, ?, ?) clause and a separate List<String> of bind values — no more string interpolation.
• 🐛 Off-by-one (line 50): Changed .limit(limit + 1) to .limit(limit).
• 🐛 NPE on category (line 26): Replaced company.get("category").equals(category) with Objects.equals(category, company.category()).
• 🐛 NPE/ClassCastException on amount (line 27): Eliminated unsafe casts — CompanyInvestment record uses primitive long amount.
• 🐛 Invalid SQL on empty input (line 57): Returns 1=0 sentinel with empty parameter list when categories is null or empty.
• 💡 Type safety suggestion (line 22): Introduced CompanyInvestment and CategoryFilter records, replacing the fragile Map<String, Object> API throughout.
• All 6 review threads replied to with commit references and resolved.

Conciseness

The changes are minimal and focused — only the single file InvestmentRollup.java was modified, and every change directly addresses a review comment. No extraneous refactoring, no new files, no unrelated modifications. The two new inner records (CompanyInvestment, CategoryFilter) were the minimum needed to address the type-safety, NPE, cast, and SQL injection concerns simultaneously.