Code Review

Findings from automated code review using Biome, ast-grep, and Knip across the Booking Platform monorepo.

Severity Levels

Severity	Description	Action
Critical	Security vulnerabilities, data loss risks	Fix immediately
High	Bugs, performance issues, broken features	Fix soon
Medium	Code quality, maintainability concerns	Fix this sprint
Low	Style, documentation, minor improvements	Fix later

Tools Used

Tool	Purpose	Config
Biome	Linting & formatting	biome.jsonc
ast-grep	Structural code analysis	sgconfig.yml + rules/
Knip	Unused code detection	knip.json
TypeScript (tsc)	Type checking	tsconfig.json
Lefthook	Git hooks enforcement	lefthook.yml

ast-grep Rules

Always-On Rules (35 rule files)

These rules run on every scan and enforce project-wide standards:

Rule	Description
component-pascal-case	Components must use PascalCase
imports-at-top	Import statements must be at the top of the file
no-any-db-types	Database types must not use any
no-apps-import-in-integrations	Integrations must not import from apps/
no-biome-ignore	No biome-ignore comments
no-client-secret-exposure	Client-side code must not expose secrets
no-custom-auth	Must use Supabase for authentication
no-cypress	Use Playwright, not Cypress
no-direct-esbuild	Use Vite, not esbuild directly
no-eslint-prettier	Use Biome, not ESLint/Prettier
no-hardcoded-ai-model	AI model names must not be hardcoded
no-hardcoded-stripe-secret	Stripe secrets must not be hardcoded
no-inline-styles	Use UnoCSS, not inline styles
no-jest	Use Vitest, not Jest
no-manual-validation	Use Zod for validation
no-node-builtin-imports	Avoid Node.js builtin imports
no-node-require	No require() calls
no-plain-css-imports	Use UnoCSS, not plain CSS imports
no-raw-sql	Use Drizzle ORM, not raw SQL
no-react-native	Use Capacitor, not React Native
no-react-patterns	Avoid React patterns in SolidJS code
no-styled-components	Use UnoCSS, not styled-components
no-ts-ignore	No @ts-ignore or @ts-nocheck
no-webpack-rollup	Use Vite, not Webpack/Rollup directly
pg-table-uuid-pk	PostgreSQL tables must use UUID primary keys

Model Decision Rules (27 rule files)

These rules require contextual judgment:

Rule	Description
no-bypass-permission	Must not bypass RBAC permission checks
no-client-openai-key	OpenAI API key must not be exposed to client
no-committed-secrets	No secrets in committed files
no-orpc-middleware-bypass	Must not bypass oRPC middleware
no-raw-http-endpoints	Use oRPC, not raw HTTP endpoints
no-store-credit-card	Never store credit card information

Glob Rules (19 rule files)

File-pattern-specific rules:

Rule	Scope	Description
no-any-component-props	Components	Component props must not use any
no-component-route-imports-in-lib	Lib files	Library files must not import route components
no-cross-module-internal-imports	Modules	No cross-module internal imports
no-react-router	Routes	Use TanStack Router, not React Router
route-requires-permission	Routes	Route files must include permission checks
schema-required-columns	Schema	Database schema must define required columns

Biome Configuration

Biome is configured with the following domains:

Domain	Level	Purpose
drizzle	recommended	Drizzle ORM best practices
moonrepo	recommended	Moonrepo monorepo patterns
types	recommended	TypeScript type safety
solid	recommended	SolidJS-specific rules
test	recommended	Testing best practices

Git Hooks (Lefthook)

Hook	Triggers	Actions
pre-commit	On commit	Biome lint + format (parallel, stage_fixed: true)
pre-push	On push	Typecheck + test (parallel)
pre-merge-commit	On merge	Typecheck

Review Checklist

Security

• [ ] No secrets or API keys committed to repository
• [ ] Supabase service role key only used on server
• [ ] Stripe secret key only used on server
• [ ] RBAC permission checks on all routes and API handlers
• [ ] No @ts-ignore or @ts-nocheck in production code
• [ ] No raw SQL — use Drizzle ORM
• [ ] No custom authentication — use Supabase

Code Quality

• [ ] All files under 250 lines
• [ ] TypeScript strict mode enabled
• [ ] Zod schemas for all API inputs and database writes
• [ ] No any types — use proper type inference
• [ ] Imports at the top of the file
• [ ] Components use PascalCase
• [ ] No React patterns in SolidJS code

Architecture

• [ ] No cross-module internal imports
• [ ] Integrations do not import from apps/
• [ ] oRPC for all API handlers — no raw HTTP endpoints
• [ ] oRPC middleware not bypassed
• [ ] Route files include permission checks
• [ ] Database tables use UUID primary keys

Testing

• [ ] Vitest for unit/integration tests
• [ ] Playwright for E2E tests
• [ ] No Jest or Cypress
• [ ] Test files match src/**/*.{test,spec}.{ts,tsx}

Styling

• [ ] UnoCSS for all styling
• [ ] No inline styles (unless dynamically computed)
• [ ] No plain CSS imports
• [ ] No styled-components

Build & Tooling

• [ ] Vite for builds — no Webpack/Rollup directly
• [ ] Bun as runtime and package manager — no Node.js/npm
• [ ] Biome for linting — no ESLint/Prettier
• [ ] No require() calls — use ESM imports

Running Reviews

# Run all checks
bun run check

# Run lint only
bun run lint

# Run typecheck only
bun run typecheck

# Run ast-grep scan
bun run scan

# Run Knip (unused code detection)
bun run knip

# Run full verify (check + test + build)
bun run verify

Test Results

⏳

Loading test results...

Latest Remediation (August 2026)

Health Score: 6.2/10 → 8.7/10

Dimension	Before	After	Key Fixes
Security	6/10	9/10	MFA enforcement, fail-closed auth, webhook secret production enforcement, payload redaction
Type Safety	5/10	9/10	Eliminated z.any(), LINE Pay Zod validation, typed output schemas, barrel exports complete
Business Logic	6/10	9/10	Booking cart availability validation, loyalty duplicate prevention, cancellation input validation, payment amount validation
Infrastructure	7/10	8/10	FCM token cleanup, Redis error logging, retry strategy
Code Quality	7/10	9/10	Library coverage maximized, custom reimplementations removed, consistent error handling
Deployment	6/10	8/10	Typecheck enforcement in CI, production env validation

Verification Evidence

Check	Status	Details
Typecheck	Pass	All packages pass with constrained settings
Lint (Biome)	Pass	7271 files, 0 errors, 16 warnings
Scan (ast-grep)	Pass	No violations
Tests	Pass	2,843 tests across 276 files
Build	Pass	integrations/shared (14 files), integrations/google-maps-booking (4 files)

Test Breakdown

Package	Files	Tests	Status
database	130	918 passed, 19 skipped	Pass
auth	30	378	Pass
infrastructure	28	355	Pass
config	26	251	Pass
user	12	182	Pass
notifications	12	154	Pass
payments	13	244	Pass
bookings	15	203	Pass
billing	4	56	Pass
settings	6	102	Pass

---

Related Documentation

• Test Results — Detailed test results
• Project Overview — Architecture and tech stack
• Development — Contributing and testing guides