fixture-shop

indexed

/vercel/path0/fixtures/fixture-shop · no git remote

Files

Symbols

Routes

Tables

89%

Parse coverage

8/9 files

—

Package manager

Frameworks & evidence

Technology	Declared	Evidence
Next.js	^15.0.0	next@^15.0.0
React	^19.0.0	react@^19.0.0 · imported from 'react'
Clerk	^6.0.0	@clerk/nextjs@^6.0.0 · imported from '@clerk/nextjs'
Neon	^0.10.0	@neondatabase/serverless@^0.10.0 · imported from '@neondatabase/serverless'
Drizzle	^0.38.0	drizzle-orm@^0.38.0 · imported from 'drizzle-orm'

Architecture

Frontend

Next.js ^15.0.0next@^15.0.0

React ^19.0.0react@^19.0.0, imported from 'react'

API

POST /api/checkout · mutationsrc/app/api/checkout/route.ts:7

GET /api/orders/[id] · readsrc/app/api/orders/[id]/route.ts:7

POST /api/public-note · mutationsrc/app/api/public-note/route.ts:5

Auth

custom · requireUser() · authentication3 call sites, e.g. src/app/api/checkout/route.ts

clerk · auth() · authentication1 call sites, e.g. src/lib/auth.ts

custom · row.userId !== userId · authorization1 call sites, e.g. src/lib/auth.ts

Database

Neon ^0.10.0@neondatabase/serverless@^0.10.0, imported from '@neondatabase/serverless'

Drizzle ^0.38.0drizzle-orm@^0.38.0, imported from 'drizzle-orm'

table orderssrc/lib/schema.ts (4 columns, 2 accesses)

table userssrc/lib/schema.ts (3 columns, 2 accesses)

Routes (3)

Method	Path	Auth	Confidence	Writes	Database
POST	/api/checkout src/app/api/checkout/route.ts:7	custom	high	yes	select ?, update users, insert orders
GET	/api/orders/[id] src/app/api/orders/[id]/route.ts:7	custom	high	no	select ?
POST	/api/public-note src/app/api/public-note/route.ts:5	none found	low	yes	insert orders

Tables (2)

Table	Source	Columns	Accesses	Writes	Defined in
orders	drizzle	4	2	2	src/lib/schema.ts
users	drizzle	3	2	1	src/lib/schema.ts

Observations (6)

highmediumunauthenticated-mutationPOST /api/public-note mutates without an auth call in its file

Auth may be applied by a wrapper, a framework config, or a platform-level rule that static analysis cannot see.

highmediumsql-string-interpolationSQL select built by string interpolation

Interpolating a literal or an already-validated constant is safe. Confirm the interpolated expression is not user-controlled before treating this as injectable.

mediumlowauthenticated-but-unauthorized-resourceGET /api/orders/[id] authenticates but shows no ownership check on [id]

Ownership is very often enforced inside the query itself (e.g. `where(eq(t.userId, userId))`), which this rule does not inspect. Expect a high false-positive rate; treat as a review list, not a defect list.

infolowunreferenced-exportfunction requireOrderOwner is exported but no reference was resolved

CANDIDATE ONLY. Cross-repo consumers, dynamic imports, string-keyed access, test files and re-export barrels are not fully resolved. Verify before deleting.

infolowunreferenced-exportfunction legacyHelper is exported but no reference was resolved

CANDIDATE ONLY. Cross-repo consumers, dynamic imports, string-keyed access, test files and re-export barrels are not fully resolved. Verify before deleting.

infolowunreferenced-exportcomponent ThemeToggle is exported but no reference was resolved

CANDIDATE ONLY. Cross-repo consumers, dynamic imports, string-keyed access, test files and re-export barrels are not fully resolved. Verify before deleting.

all repositories