FastAPI order service — 4 modules, 2 endpoints, read in full before this page was built.
| Method | Path | In / Out |
|---|---|---|
| POST | /orders |
in
{customer_id: int, items: [{sku, qty, price}]} out {order_id, total, created_at} |
| GET | /orders/{order_id} |
in
order_id: int (path) out {order_id, customer_id, items, total} |
Empty cart crashes total calculation
calculate_total() divides subtotal by len(items) to derive an average that's never actually used, so an empty items list raises ZeroDivisionError and turns into a 500 on POST /orders. This is the failing test above and the deliberate bug in this sample.
Order lookup has no ownership check
GET /orders/{order_id} returns any order for any caller — there's no check that the requester's customer_id matches the order's. Any authenticated (or unauthenticated) client can enumerate order IDs and read other customers' orders.
Money stored as Float, not Decimal
total_amount is a SQLAlchemy Float column. Binary floating point drifts under repeated addition and discount math — small today, compounding as order volume grows.
Drops the unused average-price line entirely and guards the empty-cart case with an early return, instead of computing something that was never used downstream.