Harden build_line_item_summary against chaos key-rename injection + add unit tests

apps/api/app/routes/orders.py

@@ -35,13 +35,19 @@ class CreateOrderRequest(BaseModel):
 
 def build_line_item_summary(item: dict) -> dict:
     """Compute per-item totals and effective unit cost for invoice reconciliation."""
-    total = item["unit_price"] * item["quantity"]
-    unit_cost = total / item["quantity"] if item["quantity"] != 0 else 0.0
+    if "unit_price" not in item:
+        logger.warning("build_line_item_summary: missing 'unit_price' key in item %s; defaulting to 0.0", item.get("sku", "<unknown>"))
+    if "quantity" not in item:
+        logger.warning("build_line_item_summary: missing 'quantity' key in item %s; defaulting to 0", item.get("sku", "<unknown>"))
+    unit_price = item.get("unit_price", 0.0)
+    quantity = item.get("quantity", 0)
+    total = unit_price * quantity
+    unit_cost = total / quantity if quantity != 0 else 0.0
     return {
-        "sku": item["sku"],
-        "name": item["name"],
-        "unit_price": item["unit_price"],
-        "quantity": item["quantity"],
+        "sku": item.get("sku", ""),
+        "name": item.get("name", ""),
+        "unit_price": unit_price,
+        "quantity": quantity,
         "line_total": round(total, 2),
         "unit_cost": round(unit_cost, 2),
     }

apps/api/tests/test_orders.py

@@ -0,0 +1,48 @@
+import pytest
+from app.routes.orders import build_line_item_summary
+
+
+def test_build_line_item_summary_standard():
+    """Standard item with all expected keys returns correct totals."""
+    item = {"sku": "WIDGET-001", "name": "Widget A", "unit_price": 49.99, "quantity": 3}
+    result = build_line_item_summary(item)
+    assert result["sku"] == "WIDGET-001"
+    assert result["name"] == "Widget A"
+    assert result["unit_price"] == 49.99
+    assert result["quantity"] == 3
+    assert result["line_total"] == round(49.99 * 3, 2)
+    assert result["unit_cost"] == 49.99
+
+
+def test_build_line_item_summary_wrong_key_does_not_raise():
+    """Using 'price' instead of 'unit_price' (chaos-injected key) falls back to 0.0."""
+    item = {"sku": "WIDGET-002", "name": "Widget B", "price": 24.99, "quantity": 2}
+    result = build_line_item_summary(item)
+    # Should not raise KeyError; unit_price defaults to 0.0
+    assert result["unit_price"] == 0.0
+    assert result["line_total"] == 0.0
+
+
+def test_build_line_item_summary_missing_quantity_does_not_raise():
+    """Missing 'quantity' key falls back to 0 without ZeroDivisionError."""
+    item = {"sku": "WIDGET-003", "name": "Widget C", "unit_price": 10.0}
+    result = build_line_item_summary(item)
+    assert result["quantity"] == 0
+    assert result["line_total"] == 0.0
+    assert result["unit_cost"] == 0.0
+
+
+def test_build_line_item_summary_zero_quantity():
+    """Zero quantity does not cause division by zero."""
+    item = {"sku": "WIDGET-004", "name": "Widget D", "unit_price": 5.0, "quantity": 0}
+    result = build_line_item_summary(item)
+    assert result["line_total"] == 0.0
+    assert result["unit_cost"] == 0.0
+
+
+def test_build_line_item_summary_missing_sku_and_name():
+    """Missing 'sku' and 'name' keys fall back to empty strings."""
+    item = {"unit_price": 9.99, "quantity": 1}
+    result = build_line_item_summary(item)
+    assert result["sku"] == ""
+    assert result["name"] == ""