Add a quantity field to the item create modal form. #615
Conversation
WalkthroughThis PR introduces a new Changes
Sequence Diagram(s)sequenceDiagram
participant U as User
participant CM as CreateModal.vue
participant API as API Server
participant IR as ItemsRepository
participant DB as Database
U->>CM: Enter item details (including quantity)
CM->>API: Send item creation request with quantity
API->>IR: Call Create(data) with quantity
IR->>DB: Execute insert query with SetQuantity(data.Quantity)
DB-->>IR: Return created record
IR-->>API: Return item details
API-->>CM: Return success response
Assessment against linked issues
Possibly related PRs
Security Recommendations
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
⏰ Context from checks skipped due to timeout of 90000ms (7)
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Inline review comments failed to post. This is likely due to GitHub's limits when posting large numbers of comments. If you are seeing this consistently it is likely a permissions issue. Please check "Moderation" -> "Code review limits" under your organization settings.
Actionable comments posted: 1
🔭 Outside diff range comments (1)
backend/internal/data/repo/repo_items.go (1)
63-579: 💡 Verification agent❓ Verification inconclusive
Ensure the API is secured against negative quantities
While the UI uses a number input which might prevent negative values, the API should validate input to prevent setting negative quantities which would make no sense for inventory items.
🏁 Script executed:
#!/bin/bash # Check if there's any validation for negative quantities in the codebase grep -r "Quantity" --include="*.go" backend/internal/api/ grep -r "quantity.*valid" --include="*.go" backend/Length of output: 166
Security Concern: Enforce Non-Negative Quantities in API
The current implementation of the data models (e.g., in
backend/internal/data/repo/repo_items.go) shows that theQuantityfield is defined as anintwithout any explicit validation against negative values. Although the UI may restrict input, this leaves the API vulnerable if a negative value is passed directly.
- Issue: No validation is present on the backend to reject negative quantities.
- Recommendation:
- Add a validation rule (such as
validate:"min=0") directly to the JSON binding struct fields (for example inItemUpdateand other related input structs).- Alternatively, include a middleware or business logic check in the API endpoints that handle item creation or update to ensure the quantity is not negative.
This change will strengthen the API’s security posture by ensuring that negative quantities cannot be set, thereby preventing potential discrepancies in inventory data.
🧹 Nitpick comments (1)
frontend/components/Item/CreateModal.vue (1)
15-19: Consider adding input validation constraintsWhile the field uses
type="number", it doesn't have min/max constraints or step validation. According to the PR description, non-integer inputs should be flagged.<FormTextField v-model="form.quantity" :label="$t('components.item.create_modal.item_quantity')" type="number" + min="1" + step="1" />
🛑 Comments failed to post (1)
backend/internal/data/repo/repo_items.go (1)
63-63: 💡 Verification agent
🧩 Analysis chain
Consider adding input validation for quantity
The
Quantityfield in theItemCreatestruct does not have any validation constraints. Consider adding validation to ensure that quantity is a positive integer.Run this script to check how input validation is handled for other fields in the codebase:
🏁 Script executed:
#!/bin/bash # Check how validation is handled for other fields in ItemCreate grep -r "validate:\"" --include="*.go" backend/internal/data/repo/Length of output: 1826
Action Required: Add Validation to Quantity Field
It appears that all other fields in the
ItemCreatestruct already enforce validation rules (for example, theNameandDescriptionfields use tags likevalidate:"required,min=1,max=255"). However, theQuantityfield is missing a similar validation tag to ensure it holds only positive values.
Proposed Change:
Update the declaration of theQuantityfield inbackend/internal/data/repo/repo_items.go(around line 63) to:Quantity int `json:"quantity" validate:"min=1"`This change enforces that any provided quantity is at least 1 (i.e., a positive integer).
Security Recommendation:
Always validate and sanitize user inputs to prevent any unexpected behavior or potential attack vectors. In this case, ensuring thatQuantityis non-negative not only upholds business logic but also minimizes risks such as integer underflow/overflow issues.
What type of PR is this?
What this PR does / why we need it:
This PR adds a quantity field to the item create modal form to allow people set the quantity of the item being added without needing to left the form and access the edit item form to change the quantity.
Which issue(s) this PR fixes:
Fixes #614
Special notes for your reviewer:
The definition of the ItemCreate interface inside the file backend/internal/data/repo/repo_items.go was changed to add the quantity field.
This definition is used to create the following files:
(with task swag)
backend/app/api/static/docs/docs.go
backend/app/api/static/docs/swagger.json
backend/app/api/static/docs/swagger.yaml
(with task typescript-types)
frontend/lib/api/types/data-contracts.ts
I needed to use task -f to force the task to be run and the files cited above to be correctly generated.
Testing
Try to create an item, for me the text field validates correctly the entries if the user type a value that is not an integer, but in the language that my operational system is configured not the language Homebox is configured.
Try to create an item with the default quantity.
Try to create an item with another quantity.
I did not added any additional validation that the edit item page doesn't do.
Summary by CodeRabbit