Handoff Report — Milestone 2: Backend & DB Review (Reviewer 2 - v2)

This handoff report summarizes the findings of Reviewer 2 (v2) for Milestone 2.

1. Observation

The following file observations and logs were recorded:

Non-Atomic PUT Updates: In apps/backend/src/routes/menus.ts, the Menu record is updated/created outside the database transaction block (lines 97-101), while MenuItems are created/deleted/updated inside the transaction (lines 103-153).
Missing POST Fields: In apps/backend/src/routes/menus.ts (lines 32-73), the POST /menus endpoint's validation schema and DB query do not include or map the payload and isActive fields.
Missing validation on PATCH: In apps/backend/src/routes/menus.ts (lines 183-228), the PATCH /items/:id/translations endpoint does not pass a TypeBox validation schema to Elysia.
Relative Import Failures: apps/backend/src/routes/menus.ts (lines 2-3) uses:
```
import prisma from "../lib/prisma";
import { adminOnly } from "../middleware/auth";
```
This causes typescript compilation errors under the NodeNext ECMAScript Module Resolution, yielding error TS2835: Relative import paths need explicit file extensions....
GET Mock/Status Mismatch: In apps/backend/src/routes/menus.ts (lines 26-28), GET /menus/:name returns a mock object without an id field and 200 OK status when the menu is not found:
```
return { name, items: [], payload: null, rootImage: null, isActive: false };
```
Missing Type Property: In packages/types/index.ts (lines 205-211), the Menu interface lacks the isActive property.
Translation Corrupting Merging: In apps/mcp-server/menu-tools.ts (line 284), translations are merged using { ...nextNode.translations }. If translations is an array (e.g. [{ langCode: "th", label: "..." }]), it creates index keys ({ "0": ... }) in the translatable object.

2. Logic Chain

If a PUT request experiences a database failure during transaction execution (such as MenuItem insertion failure), the preceding Menu update/creation has already committed on the standard prisma client. Therefore, the rollback is partial and database consistency is violated.
Under NodeNext resolution, relative paths must include extensions. Thus, import statements without .js break the production build compilation.
Spreading an array inside an object converts the array elements into index properties. If translations is an array of objects, { ...nextNode.translations } yields { "0": { langCode: "th", label: "..." } }, which corrupts the structure and causes storefront translation retrieval failures.
Returning a 200 status with an id-less mock object for non-existent resources breaks frontend type assumptions and impedes 404 error handling in the client.

3. Caveats

The review was restricted to the backend and MCP server layers. Frontend UI components and layouts (in apps/website and apps/spa) were not inspected.

4. Conclusion

The M2 backend changes do not fully meet correctness, robustness, type-safety, and schema conformance criteria. The verdict is FAIL. Major fixes are required for transaction safety, import compliance, TypeBox route validation, and translation merging logic.

5. Verification Method

Type Safety Verification: Run bunx tsc -p apps/backend/tsconfig.json --noEmit from the root directory and ensure no errors are reported in the menu routes.
API Behavior Verification: Start the backend and run the challenger script: bun apps/backend/test_menu_api_challenger.ts Confirm that duplicate name checks and atomic PUT operations are correct.

3.6 KiB Raw Blame History