Repo X-ray

sample-service — a small FastAPI order-lookup service
Using data/sample-service/ — milestone-guardian was not reachable on this machine within two minutes, so this is the bundled fallback.

Modules

app/main.py Whole service: in-memory ORDERS store, order_total() pricing logic, both routes
tests/test_orders.py 5 tests: both endpoints + the pricing function directly

Endpoints

MethodPathInputOutputNotes
GET /orders/{order_id} path param, any string order dict + total 404 if id not in ORDERS
GET /accounts/{account}/total path param, any string {account, orders, total} 404 if no orders match; O(n) scan over all orders

Test summary

5
Pass
0
Fail
5
Total
PASS test_get_order_ok
PASS test_get_order_missing
PASS test_total_two_lines
Was failing (1256.0 != 1650.0) until the fix in Risk #1 below was applied. Re-ran pytest -q after the fix: 5 passed.
PASS test_empty_order_total_is_zero
PASS test_account_total

Top 3 risks, ranked

1
Pricing bug: order_total used addition instead of multiplication — fixed
app/main.py:17

Every order with a quantity or unit price other than 1 was billed wrong; multi-line orders compounded the error. This was the test failure above — confirmed by running pytest -q: 4 passed, 1 failed. The fix below has since been applied to app/main.py and re-verified: 5 passed, 0 failed.

  def order_total(order: dict) -> float:
      total = 0.0
      for line in order["lines"]:
-         total += line["qty"] + line["unit"]
+         total += line["qty"] * line["unit"]
      return round(total, 2)
2
Account lookup has no input validation
app/main.py:29-34

account is an unconstrained path string matched by exact equality against every order. A typo or case mismatch silently 404s with no hint of valid values, and there's no cap on match cost as the store grows — every request scans the full ORDERS dict.

3
In-memory, unkeyed-by-request state
app/main.py:6-10

ORDERS is a module-level dict with no persistence or concurrency guard. Fine for a demo — but every restart loses data, and there's no isolation between requests, which will bite the moment this becomes more than a sample.