server/utils/inventoryUtils.js (2)

10-11: ⚠️ Potential issue | 🟡 Minor

qty is never validated — zero or negative values silently corrupt stock.

item.quantity >= qty is always true when qty <= 0, so passing 0 is a no-op and passing a negative value actually increases stock.

🛡️ Proposed guard

 const updateInventoryQuantity = async (pizza, qty) => {
+  if (!qty || qty <= 0) {
+    throw new Error('Quantity must be a positive integer');
+  }
   const { bases, sauces, cheeses, veggies } = pizza;

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@server/utils/inventoryUtils.js` around lines 10 - 11, Validate the incoming
qty before mutating item.quantity: ensure qty is a positive integer (e.g.,
Number.isInteger(qty) && qty > 0) and reject or throw (or return a failure) for
zero/negative/non-integer values so they cannot pass the subsequent check; only
then perform the existing stock check item.quantity >= qty and decrement. Also
update any caller expectations if they relied on zero/no-op behavior.

---

8-45: ⚠️ Potential issue | 🟠 Major

No transaction/rollback — inventory corruption on partial failure.

The function deducts inventory across four collections (bases, sauces, cheeses, veggies) in serial without a MongoDB session/transaction. If, say, a Sauce item is out of stock after the Base was already decremented, the base quantity is permanently reduced even though the order ultimately fails. With enough concurrent orders this will silently corrupt stock levels.

Fix: wrap the entire operation in a mongoose.startSession() transaction so every item.save() is part of the same atomic unit and the whole thing rolls back on any failure.

🔒 Proposed fix — wrap in a Mongoose transaction

+const mongoose = require('mongoose');
 const { Base, Sauce, Cheese, Veggie } = require('../schemas/inventorySchema');

 const updateInventoryQuantity = async (pizza, qty) => {
   const { bases, sauces, cheeses, veggies } = pizza;

-  const updateQuantity = async (item) => {
+  const updateQuantity = async (item, session) => {
     if (item) {
       if (item.quantity >= qty) {
         item.quantity -= qty;
-        const updateditem = await item.save();
+        const updateditem = await item.save({ session });
         return updateditem;
       } else {
         throw new Error(
           `Not enough ${item.item} in inventory! Please update inventory!`
         );
       }
     } else {
       throw new Error('Item Not Found!');
     }
   };

+  const session = await mongoose.startSession();
+  session.startTransaction();
+  try {
     for (const baseId of bases) {
-      const baseItem = await Base.findById(baseId);
-      await updateQuantity(baseItem);
+      const baseItem = await Base.findById(baseId).session(session);
+      await updateQuantity(baseItem, session);
     }
     for (const sauceId of sauces) {
-      const sauceItem = await Sauce.findById(sauceId);
-      await updateQuantity(sauceItem);
+      const sauceItem = await Sauce.findById(sauceId).session(session);
+      await updateQuantity(sauceItem, session);
     }
     for (const cheeseId of cheeses) {
-      const cheeseItem = await Cheese.findById(cheeseId);
-      await updateQuantity(cheeseItem);
+      const cheeseItem = await Cheese.findById(cheeseId).session(session);
+      await updateQuantity(cheeseItem, session);
     }
     for (const veggieId of veggies) {
-      const veggieItem = await Veggie.findById(veggieId);
-      await updateQuantity(veggieItem);
+      const veggieItem = await Veggie.findById(veggieId).session(session);
+      await updateQuantity(veggieItem, session);
     }
+    await session.commitTransaction();
+  } catch (err) {
+    await session.abortTransaction();
+    throw err;
+  } finally {
+    session.endSession();
+  }
 };

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@server/utils/inventoryUtils.js` around lines 8 - 45, The inventory updates
currently call updateQuantity and Model.findById on Base, Sauce, Cheese, Veggie
without a transaction, so partial failures permanently mutate stock; wrap the
entire sequence in a mongoose.startSession() and session.startTransaction(), use
session-aware reads and writes (e.g., Base.findById(id).session(session) or pass
{ session } to queries and call item.save({ session }) inside updateQuantity),
commit the transaction on success and abortTransaction() on any thrown error,
and always end the session in a finally block so all item saves (in
updateQuantity) are atomic and roll back on failure.

client/src/redux/asyncThunks/inventoryThunks.js (2)

115-136: ⚠️ Potential issue | 🔴 Critical

updateStockById passes the Axios config object as the request body — auth header is dropped and update data is never sent.

Line 129:

const { data } = await axios.put(`${import.meta.env.VITE_SERVER_URL}/stocks/${id}`, config);

axios.put(url, data, config) takes data as the second argument and config as the third. Passing config as the second argument means:

1. The Authorization header is silently placed in the request body instead of the request headers — the server will reject this as unauthenticated.
2. No actual stock update payload is ever sent.
3. The thunk argument is only id (Line 117) — there is no provision for accepting update fields at all.

🐛 Proposed fix

-export const updateStockById = createAsyncThunk(
-  'inventory/updateStockById',
-  async (id, { rejectWithValue, getState }) => {
+export const updateStockById = createAsyncThunk(
+  'inventory/updateStockById',
+  async ({ id, ...updateData }, { rejectWithValue, getState }) => {
     try {
       const {
         admin: { adminUserInfo },
       } = getState();

       const config = {
         headers: {
           Authorization: `Bearer ${adminUserInfo.token}`,
         },
       };

-      const { data } = await axios.put(`${import.meta.env.VITE_SERVER_URL}/stocks/${id}`, config);
+      const { data } = await axios.put(
+        `${import.meta.env.VITE_SERVER_URL}/stocks/${id}`,
+        updateData,
+        config
+      );

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@client/src/redux/asyncThunks/inventoryThunks.js` around lines 115 - 136, The
thunk updateStockById is incorrectly treating the Axios config as the request
body and doesn't accept update payloads; change the async thunk signature to
accept an object like ({ id, updates }) or (payload) so you have both id and
update data, then call axios.put with axios.put(url, updates, config) (ensure
config contains Authorization from adminUserInfo.token). Also update the
returned value to return data.data || data and keep
rejectWithValue(extractErrorMessage(error)) unchanged.

---

1-3: ⚠️ Potential issue | 🔴 Critical

extractErrorMessage is used but never imported — all error paths will throw ReferenceError.

Every catch block in this file calls extractErrorMessage(error) (Lines 35, 72, 109, 133, 160), but the function is not imported. The only imports are createAsyncThunk and axios. At runtime, any failed request will crash with ReferenceError: extractErrorMessage is not defined rather than dispatching the rejection.

🐛 Proposed fix — add the missing import

 import { createAsyncThunk } from '@reduxjs/toolkit';
 import axios from 'axios';
+import { extractErrorMessage } from '../../utils/errorUtils';

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@client/src/redux/asyncThunks/inventoryThunks.js` around lines 1 - 3, The file
uses extractErrorMessage in every catch block (within async thunks created by
createAsyncThunk) but it is not imported, causing a ReferenceError on failures;
fix by adding an import for extractErrorMessage at the top of inventoryThunks.js
(alongside createAsyncThunk and axios) importing it from the module that exports
it (the same utils/error helper module used elsewhere in the codebase) so all
calls to extractErrorMessage(error) in the catch blocks resolve correctly.

server/schemas/inventorySchema.js (1)

3-61: 🛠️ Refactor suggestion | 🟠 Major

All four schemas are structurally identical — extract a factory function.

Every schema has the same fields, options, and index calls repeated four times. Any future field addition (e.g., unit, sku) requires four parallel changes.

♻️ Proposed refactor

 const mongoose = require('mongoose');

+function createInventorySchema() {
+  const schema = new mongoose.Schema(
+    {
+      item: { type: String, required: true },
+      quantity: { type: Number, required: true },
+      price: { type: Number, required: true },
+      threshold: { type: Number, default: 10 },
+    },
+    { timestamps: true }
+  );
+  schema.index({ item: 1 });
+  schema.index({ quantity: 1 });
+  return schema;
+}
+
-const baseSchema = new mongoose.Schema( ... );
-baseSchema.index({ item: 1 });
-baseSchema.index({ quantity: 1 });
-
-const sauceSchema = new mongoose.Schema( ... );
-sauceSchema.index({ item: 1 });
-sauceSchema.index({ quantity: 1 });
-
-const cheeseSchema = new mongoose.Schema( ... );
-cheeseSchema.index({ item: 1 });
-cheeseSchema.index({ quantity: 1 });
-
-const veggieSchema = new mongoose.Schema( ... );
-veggieSchema.index({ item: 1 });
-veggieSchema.index({ quantity: 1 });

 module.exports = {
-  Base: mongoose.model('Base', baseSchema),
-  Sauce: mongoose.model('Sauce', sauceSchema),
-  Cheese: mongoose.model('Cheese', cheeseSchema),
-  Veggie: mongoose.model('Veggie', veggieSchema),
+  Base: mongoose.model('Base', createInventorySchema()),
+  Sauce: mongoose.model('Sauce', createInventorySchema()),
+  Cheese: mongoose.model('Cheese', createInventorySchema()),
+  Veggie: mongoose.model('Veggie', createInventorySchema()),
 };

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@server/schemas/inventorySchema.js` around lines 3 - 61, The four schemas
(baseSchema, sauceSchema, cheeseSchema, veggieSchema) are identical; create a
factory function (e.g., createInventorySchema or buildInventorySchema) that
returns a new mongoose.Schema with the shared fields, options (timestamps), and
index calls, and then replace the duplicated declarations with four calls to
this factory to produce baseSchema, sauceSchema, cheeseSchema, and veggieSchema
so future field changes only need to be made in one place.

server/controllers/inventoryControllers.js (1)

86-122: ⚠️ Potential issue | 🟡 Minor

updateStockById only updates quantity, ignoring other fields from the request body.

The createStock handler accepts item, price, quantity, and threshold, but updateStockById hardcodes only quantity = req.body.quantity. If an admin needs to correct a price or threshold, there's no path to do so without a delete-and-recreate. This smells like an incomplete implementation.

Also, the nested if (updatedBase) / if (updatedSauce) checks are unreachable failure paths — save() either succeeds or throws in Mongoose, so the implicit else (no response sent) is dead code that would leave the request hanging if somehow reached.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@server/controllers/inventoryControllers.js` around lines 86 - 122,
updateStockById currently only sets quantity and has redundant post-save
truthiness checks that are unnecessary; update it to apply all updatable fields
from req.body (at minimum item, price, quantity, threshold) to the found
document (Base, Sauce, Cheese, or Veggie) before saving, e.g. merge/assign only
allowed keys from req.body into the model instance, call await instance.save(),
then send a single res.status(200).json(...) response with an appropriate
message; remove the unreachable if (updatedX) branches and ensure the 404 path
remains when none of Base/Sauce/Cheese/Veggie is found.

client/src/components/ui/Admin/Dashboard/Modals/StockCreateModal.jsx (1)

51-54: ⚠️ Potential issue | 🟠 Major

Bug: Modal closes and inventory refreshes even when createStock fails.

With Redux Toolkit's createAsyncThunk, dispatch(createStock(stockData)) returns a promise that always resolves — even when the thunk calls rejectWithValue. The .then() callback therefore fires unconditionally, closing the modal and refreshing inventory regardless of whether the creation succeeded.

You need .unwrap() to re-throw on rejection:

🐛 Fix: use unwrap() for proper error propagation

-    dispatch(createStock(stockData)).then(() => {
-      dispatch(listInventory({}));
-      handleModalClose();
-    });
+    dispatch(createStock(stockData))
+      .unwrap()
+      .then(() => {
+        dispatch(listInventory({}));
+        handleModalClose();
+      })
+      .catch(() => {
+        // Error is already in Redux state; modal stays open for user to retry
+      });

This is a common RTK gotcha — dispatch(thunk()) fulfills with either a fulfilled or rejected action object, so .then() always runs. .unwrap() converts rejected actions into thrown errors.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@client/src/components/ui/Admin/Dashboard/Modals/StockCreateModal.jsx` around
lines 51 - 54, The current dispatch(createStock(stockData)).then(...) always
runs even on thunk rejection; change to await
dispatch(createStock(stockData)).unwrap() (or
dispatch(createStock(stockData)).unwrap().then(...).catch(...)) so rejected
createStock re-throws and you only call dispatch(listInventory({})) and
handleModalClose() on success; wrap in try/catch (or add .catch) to handle
errors and avoid closing the modal or refreshing inventory when createStock
fails, referencing the createStock thunk, dispatch call, listInventory dispatch,
and handleModalClose.

client/src/redux/asyncThunks/pizzaThunks.js (2)

36-45: ⚠️ Potential issue | 🟡 Minor

NPE risk if both adminUserInfo and userInfo are null/undefined.

Line 43: adminUserInfo ? adminUserInfo.token : userInfo.token — if a user is somehow logged out (both state slices cleared) and this thunk fires, userInfo.token throws a TypeError. Compare with updatePizzaById (line 109) and deletePizzaById (line 147) which only reference adminUserInfo.token without any fallback — same NPE risk if the admin session is cleared.

A defensive pattern:

const token = adminUserInfo?.token || userInfo?.token;
if (!token) {
  return rejectWithValue({ code: 'AUTH_ERROR', message: 'Not authenticated' });
}

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@client/src/redux/asyncThunks/pizzaThunks.js` around lines 36 - 45, The thunk
builds Authorization header using adminUserInfo ? adminUserInfo.token :
userInfo.token which can throw when both adminUserInfo and userInfo are null;
update the token acquisition to use optional chaining (e.g. adminUserInfo?.token
|| userInfo?.token) and if token is falsy call rejectWithValue({ code:
'AUTH_ERROR', message: 'Not authenticated' }) before creating the config object,
and apply the same defensive pattern to the other thunks referenced
(updatePizzaById and deletePizzaById) that currently access adminUserInfo.token
directly so they also early-reject when no token is present.

---

47-61: ⚠️ Potential issue | 🟠 Major

Fix field name inconsistency: updatePizzaById must send bases (plural), not base (singular).

The backend schema, controller, and validators all expect bases (plural). Line 99 destructures base (singular) and line 118 sends base, causing the update request to silently fail—req.body.bases will be undefined, and the controller will preserve the old value instead of updating it.

Change line 99 from base to bases in the destructuring, and line 118 will then correctly send the plural field name matching the createPizza behavior and backend expectations.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@client/src/redux/asyncThunks/pizzaThunks.js` around lines 47 - 61, In
updatePizzaById, fix the inconsistent field name by changing the destructured
variable from base to bases (so use "bases" where you extract values from
pizzaData) and ensure the payload sent in the axios request uses bases (plural)
instead of base; update the destructuring and the object you pass in the
axios.post/put call (referencing updatePizzaById and the payload object) so the
request matches createPizza and the backend schema expecting req.body.bases.

client/src/redux/asyncThunks/userThunks.js (2)

142-175: ⚠️ Potential issue | 🟠 Major

Remove misleading multipart/form-data header—only JSON fields are sent.

Line 152 declares 'Content-Type': 'multipart/form-data', but the server's updateUserProfile handler (server/controllers/userControllers.js, lines 287–321) accepts only text fields (name, email, phoneNumber, address, password) from req.body—no file uploads or multipart parsing. Axios serializes the plain JavaScript object as JSON regardless of the header, so the request works in practice, but the incorrect header is misleading and violates HTTP semantics. Change to 'application/json' to match the actual request format and server expectations.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@client/src/redux/asyncThunks/userThunks.js` around lines 142 - 175, The
request header in the updateUserProfile async thunk incorrectly sets
'Content-Type' to 'multipart/form-data' even though the payload is a plain JSON
object; update the headers in the config object inside updateUserProfile (the
createAsyncThunk for 'user/userUpdateProfile') to use 'application/json' (or
remove the explicit Content-Type so axios sets it) so the header matches the
actual JSON payload and server expectations.

---

65-91: ⚠️ Potential issue | 🟠 Major

VerifyEmailScreen.jsx sends incomplete request to verifyEmail thunk—missing required email parameter.

Line 28 dispatches verifyEmail({ verificationCode: token }) without the email field. The thunk expects both parameters (line 67), and the server enforces email as required via verifyUserValidation (server/validators/userValidators.js:51–56). This request will fail server-side validation with "Email is required."

The correct pattern is shown in VerficationModal.jsx (line 38), which dispatches verifyEmail({ email, verificationCode }). Update VerifyEmailScreen to retrieve email from userInfo via getState() (as the thunk already does) or pass it explicitly.

Additionally, there's a state key mismatch: the reducer updates state.userVerifyEmailSuccess and state.userVerifyEmailError (userSlice.js:180–186), but VerifyEmailScreen destructures userVerifySuccess and userVerifyError (line 23), causing success/error states to remain undefined in the UI.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@client/src/redux/asyncThunks/userThunks.js` around lines 65 - 91,
VerifyEmailScreen.jsx is dispatching verifyEmail with only { verificationCode:
token } causing the server "Email is required" error and also destructures wrong
state keys; update VerifyEmailScreen.jsx to supply the email (either pass email
from the component by reading it from the Redux userInfo state or ensure the
thunk uses getState to fill email) when calling the verifyEmail thunk, and fix
the state destructuring to match the reducer’s keys (use userVerifyEmailSuccess
and userVerifyEmailError instead of userVerifySuccess/userVerifyError) so
success/error UI reacts correctly.

client/src/components/ui/Admin/Dashboard/Table.jsx (3)

56-59: ⚠️ Potential issue | 🟡 Minor

Remove console.log debug statement before merging.

Line 58 has a leftover debug log: console.log('Id', row._id, 'Value', e.target.value). This will pollute the browser console in production. Clean it up or replace with a proper logging utility if needed for diagnostics.

🧹 Proposed fix

                        onChange={(e) => {
                          handleChange(row._id, e.target.value);
-                          console.log('Id', row._id, 'Value', e.target.value);
                        }}

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@client/src/components/ui/Admin/Dashboard/Table.jsx` around lines 56 - 59,
Remove the leftover console.log in the onChange handler inside Table.jsx: within
the onChange that calls handleChange(row._id, e.target.value), delete the
console.log('Id', row._id, 'Value', e.target.value) (or replace it with a proper
logging utility call such as logger.debug if you need diagnostics) so the
browser console is not polluted in production; ensure only handleChange(row._id,
e.target.value) remains in that handler.

---

53-85: ⚠️ Potential issue | 🟡 Minor

defaultValue on <select> conflicts with selected on <option> — React anti-pattern.

Lines 55 uses defaultValue={row[column]} on the <select>, while lines 63, 69, 75, and 81 also set selected={...} on individual <option> elements. React explicitly warns against this combination — defaultValue (or value) on <select> is the idiomatic approach, and selected on <option> is the legacy HTML way. Using both is redundant and may produce console warnings.

Remove the selected attributes from all <option> elements:

♻️ Proposed fix

                        <option
                          value={ORDER_STATUS.RECEIVED}
-                          selected={row[column] === ORDER_STATUS.RECEIVED}
                        >
                          {ORDER_STATUS.RECEIVED}
                        </option>
                        <option
                          value={ORDER_STATUS.IN_KITCHEN}
-                          selected={row[column] === ORDER_STATUS.IN_KITCHEN}
                        >
                          {ORDER_STATUS.IN_KITCHEN}
                        </option>
                        <option
                          value={ORDER_STATUS.OUT_FOR_DELIVERY}
-                          selected={row[column] === ORDER_STATUS.OUT_FOR_DELIVERY}
                        >
                          {ORDER_STATUS.OUT_FOR_DELIVERY}
                        </option>
                        <option
                          value={ORDER_STATUS.DELIVERED}
-                          selected={row[column] === ORDER_STATUS.DELIVERED}
                        >
                          {ORDER_STATUS.DELIVERED}
                        </option>

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@client/src/components/ui/Admin/Dashboard/Table.jsx` around lines 53 - 85, The
select uses defaultValue={row[column]} while each option also sets
selected={...}, which is an anti-pattern; remove all selected={...} attributes
from the option elements and rely on the select's defaultValue (or convert the
select to a controlled component by replacing defaultValue with
value={row[column]} and keeping onChange/handleChange) so ORDER_STATUS options
only use value={ORDER_STATUS.*} and selection is driven by the select element;
update the JSX in the select block that renders options referencing
ORDER_STATUS, row[column], and handleChange accordingly.

---

24-30: ⚠️ Potential issue | 🟠 Major

React key warning: key must be on the outermost element in .map().

The key={column} is placed on <th> (line 26), but <th> is wrapped in a shorthand Fragment <> (line 25), which is the actual outermost element returned from .map(). Shorthand fragments cannot accept props like key. This will produce a React warning about missing keys.

Either use React.Fragment with a key, or simply remove the unnecessary fragment since there's only one child:

🐛 Proposed fix

              {columns.map((column) => (
-                <>
-                  <th key={column}>
-                    {column.replace(/([A-Z])/g, ' $1').trim()}
-                  </th>
-                </>
+                <th key={column}>
+                  {column.replace(/([A-Z])/g, ' $1').trim()}
+                </th>
              ))}

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@client/src/components/ui/Admin/Dashboard/Table.jsx` around lines 24 - 30, The
map callback that renders columns uses a shorthand fragment wrapping a single
<th>, so the key={column} placed on <th> is not on the outermost element and
causes a React key warning; fix by removing the unnecessary fragment around the
<th> so the <th key={column}> is the top-level element returned from columns.map
(or alternatively replace the shorthand fragment with <React.Fragment
key={column}> if a wrapper is required), updating the code around columns.map
and the <th> element accordingly.

server/index.js (2)

88-93: ⚠️ Potential issue | 🟠 Major

Redundant body parsing — express.json() and bodyParser.json() do the same thing.

Since Express 4.16+, express.json() is a re-export of body-parser's JSON middleware. Having both means every request body is parsed twice — unnecessary CPU overhead and a potential source of subtle bugs if options diverge.

Remove one. Since you already use express.json(), drop bodyParser.json() and either convert the URL-encoded call to express.urlencoded() or keep bodyParser for that alone.

Suggested cleanup

 // Parse incoming JSON data
 app.use(express.json());

 // Parse incoming form data
-app.use(bodyParser.urlencoded({ extended: true }));
-app.use(bodyParser.json());
+app.use(express.urlencoded({ extended: true }));

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@server/index.js` around lines 88 - 93, Remove the redundant JSON parsing
middleware: keep app.use(express.json()) and delete the
app.use(bodyParser.json()) call; for URL-encoded parsing either switch
bodyParser.urlencoded to express.urlencoded by replacing bodyParser.urlencoded({
extended: true }) with express.urlencoded({ extended: true }) or keep bodyParser
for only urlencoded usage so the code uses a single JSON parser (express.json)
and a single urlencoded parser (express.urlencoded or bodyParser.urlencoded) to
avoid double-parsing.

---

163-168: ⚠️ Potential issue | 🟡 Minor

console.log is the second argument to app.listen, not the callback.

console.log(...) is evaluated immediately (before the server is actually listening) and its return value (undefined) is passed as the callback. This means the log fires before the port is bound. Use an arrow function wrapper so it executes when the server is ready.

Fix

 app.listen(
   PORT,
-  console.log(
-    `Server running in ${process.env.NODE_ENV} mode on port ${PORT}`.yellow.bold
-  )
+  () => {
+    console.log(
+      `Server running in ${process.env.NODE_ENV} mode on port ${PORT}`.yellow.bold
+    );
+  }
 );

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@server/index.js` around lines 163 - 168, The current call to app.listen uses
console.log(...) as the second argument which executes immediately and passes
undefined as the callback; change the second argument to a function so the log
runs once the server is actually listening. Locate the app.listen invocation
(symbols: app.listen, PORT, process.env.NODE_ENV, console.log) and replace the
immediate console.log(...) with an arrow function wrapper that calls console.log
with the same message so the message prints only after the server is bound.

client/src/components/ui/CheckoutSteps/PlaceOrderStep.jsx (1)

34-80: 🛠️ Refactor suggestion | 🟠 Major

cartItems.reduce(...) is computed 5 times identically — extract to a variable.

The same reduction cartItems.reduce((acc, item) => acc + item.price * item.qty, 0) is repeated across the orderSummary array. This hurts readability and does redundant work on every render. Extract it once:

♻️ Suggested refactor

+ const itemsPrice = cartItems
+   ? cartItems.reduce((acc, item) => acc + item.price * item.qty, 0)
+   : 0;
+ const deliveryCharges = itemsPrice > 100 ? 0 : 10;
+ const salesTax = Number((0.15 * itemsPrice).toFixed(2));
+ const totalPrice = Math.round((itemsPrice + deliveryCharges + salesTax) * 100) / 100;
+
  const orderSummary = [
-   {
-     name: 'Items Price',
-     value: cartItems && cartItems.reduce((acc, item) => acc + item.price * item.qty, 0),
-   },
-   // ...repeated reduce calls...
+   { name: 'Items Price', value: itemsPrice },
+   { name: 'Delivery Charges', value: deliveryCharges },
+   { name: 'Sales Tax', value: salesTax },
+   { name: 'Total', value: totalPrice },
  ];

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@client/src/components/ui/CheckoutSteps/PlaceOrderStep.jsx` around lines 34 -
80, The repeated computation of cartItems total inside orderSummary (the
repeated cartItems.reduce((acc, item) => acc + item.price * item.qty, 0) used
for 'Items Price', 'Delivery Charges', 'Sales Tax', and 'Total') should be
extracted to a single variable (e.g., itemsPrice or cartTotal) before the
orderSummary definition; then use that variable in the objects and compute
delivery (0 or 10), salesTax (0.15 * itemsPrice rounded/formatted), and Total
(itemsPrice + delivery + salesTax) from those values instead of re-running the
reduce each time.

server/routes/inventoryRoutes.js (1)

35-47: ⚠️ Potential issue | 🔴 Critical

Route ordering bug: GET /low-stock will never be reached — it's shadowed by GET /:id.

Express evaluates routes in registration order. router.get('/:id', ...) on line 36 matches any path segment, including low-stock. So a GET /low-stock request will be handled by getStockById with req.params.id = 'low-stock', which will likely return a 404 or a cast error — never reaching getLowInventoryItems on line 47.

Move the static paths above the parameterized /:id routes:

🐛 Proposed fix

 // Public Routes

+// Inventory Alert Routes (must be above /:id to avoid shadowing)
+router.post('/check-alerts', protect, admin, checkAndSendAlerts);
+router.get('/low-stock', protect, admin, getLowInventoryItems);
+
 // Private Routes
 router.get('/', protect, getAllStocks);
 router.get('/:id', protect, getStockById);

 // Admin + Private Routes
 router.post('/', protect, admin, createStockValidation, validationHandler, createStock);
 router
   .route('/:id')
   .put(protect, admin, updateStockValidation, validationHandler, updateStockById)
   .delete(protect, admin, deleteStockById);

-// Inventory Alert Routes
-router.post('/check-alerts', protect, admin, checkAndSendAlerts);
-router.get('/low-stock', protect, admin, getLowInventoryItems);

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@server/routes/inventoryRoutes.js` around lines 35 - 47, The route ordering is
wrong: the parameterized route router.get('/:id', protect, getStockById) will
catch requests like '/low-stock' before the static handler getLowInventoryItems;
move the Inventory Alert Routes (router.post('/check-alerts', protect, admin,
checkAndSendAlerts) and router.get('/low-stock', protect, admin,
getLowInventoryItems)) so they are registered before any router.get('/:id', ...)
or router.route('/:id') declarations, keeping router.get('/', protect,
getAllStocks) where it is.

client/src/components/ui/Admin/Dashboard/Lists/OrdersList.jsx (1)

112-112: ⚠️ Potential issue | 🔴 Critical

orderList.length will throw a TypeError when orderList is null or undefined.

If the API call fails (or hasn't completed yet), orderList can be falsy. The loading guard on Line 99 won't protect you if loading finishes but the fetch errored out — you'll land in the else branch with orderList still being null.

🐛 Proposed fix

-           {orderList.length > 0 ? (
+           {orderList && orderList.length > 0 ? (

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@client/src/components/ui/Admin/Dashboard/Lists/OrdersList.jsx` at line 112,
The conditional rendering currently uses orderList.length which throws if
orderList is null/undefined; change the check to guard for non-null array (e.g.,
use Array.isArray(orderList) && orderList.length > 0 or orderList?.length > 0)
in the JSX where orderList is used, and/or ensure the state that holds orderList
is initialized to an empty array so OrdersList rendering (and any map calls)
never run on null; update the condition around the JSX (the ternary that starts
with {orderList.length > 0 ?) to use the safe check and keep the existing
empty/error branch.

client/src/redux/slices/cartSlice.js (1)

166-183: ⚠️ Potential issue | 🟠 Major

Cart quantity can exceed the 10-item cap when adding the same pizza+size.

addToCart.fulfilled (line 176) does existItem.qty += item.qty, but there's no upper-bound check. If a user adds 6 of a pizza, then adds 6 more, qty becomes 12 — exceeding the qty <= 10 validation applied during localStorage hydration (line 71) and updateCartItemQuantity (line 110).

🐛 Proposed fix — clamp the quantity

       if (existItem) {
-        // Update quantity for existing item
-        existItem.qty += item.qty;
+        // Update quantity for existing item, clamped to max 10
+        existItem.qty = Math.min(existItem.qty + item.qty, 10);
       } else {

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@client/src/redux/slices/cartSlice.js` around lines 166 - 183, The
addToCart.fulfilled handler allows existItem.qty to grow unbounded by doing
existItem.qty += item.qty, which can exceed the intended cap of 10; modify the
addToCart.fulfilled branch (the existItem handling inside the reducer) to clamp
the resulting quantity to the maximum allowed (e.g., Math.min(existingQty +
item.qty, 10)) before assigning existItem.qty, then continue to persist
state.cartItems to localStorage as before so hydration and
updateCartItemQuantity invariants are preserved.

client/src/redux/asyncThunks/adminThunks.js (1)

1-3: ⚠️ Potential issue | 🔴 Critical

Critical: Missing import of extractErrorMessage — every error path will throw ReferenceError.

The function is called at lines 25, 49, 79, 103, 127, 151, 180, and 204 throughout this file, but no import exists. Any API failure will crash the thunk before the error can propagate to the UI.

Add the missing import at the top:

 import { createAsyncThunk } from '@reduxjs/toolkit';
 import axios from 'axios';
+import { extractErrorMessage } from '../../utils/errorUtils';

Follow the pattern already established in userThunks.js and orderThunks.js, which import extractErrorMessage from errorUtils. This ensures consistency across your thunk files and guarantees proper error string extraction from API responses.

Minor: Line 131 has a typo — "Admin USer Details By ID" should be "Admin User Details By ID".

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@client/src/redux/asyncThunks/adminThunks.js` around lines 1 - 3, Add the
missing import for extractErrorMessage at the top of adminThunks.js (following
the same import pattern used in userThunks.js and orderThunks.js, e.g. import {
extractErrorMessage } from the module where error utilities live) so all
try/catch blocks can call extractErrorMessage without throwing ReferenceError;
also fix the typo "Admin USer Details By ID" to "Admin User Details By ID" in
the thunk/comment that contains that string.