code-review-skill

### Code Review Summary for PR #124: "Implement User Authentication" (Author: Alex Chen)

**Repository**: `company/web-app` (GitHub)
**Technology Stack**: React 19, TypeScript, TanStack Query v5
**Focus Areas**: Security, Performance, Type Safety

#### Critical Issues (Must Fix)
1. **Security: Missing Input Sanitization**
   - **Location**: `src/auth/services/authService.ts`, Line 42
   - **Issue**: The `login` function directly passes user input to the API without sanitization, risking XSS attacks.
   - **Evidence**: 
     ```typescript
     const response = await fetch('/api/login', {
       method: 'POST',
       body: JSON.stringify({ email: userInput.email, password: userInput.password }),
     });
     ```
   - **Fix**: Use a library like `validator.js` to sanitize inputs:
     ```typescript
     import validator from 'validator';
     const sanitizedEmail = validator.escape(userInput.email);
     ```

2. **Performance: Unnecessary Re-renders**
   - **Location**: `src/auth/components/LoginForm.tsx`, Line 18
   - **Issue**: The `useEffect` hook triggers a re-render on every keystroke in the email field, causing lag.
   - **Evidence**: 
     ```typescript
     useEffect(() => {
       validateEmail(email); // Triggers re-render
     }, [email]);
     ```
   - **Fix**: Debounce the validation:
     ```typescript
     const debouncedValidate = useDebouncedCallback(validateEmail, 300);
     ```

#### Warnings (Should Fix)
1. **Type Safety: Implicit `any` in TanStack Query**
   - **Location**: `src/auth/hooks/useAuth.ts`, Line 22
   - **Issue**: The query key `['user', userId]` lacks type safety. If `userId` changes, the query may not invalidate correctly.
   - **Fix**: Define a type for query keys:
     ```typescript
     type QueryKey = ['user', string];
     const { data } = useQuery<QueryKey>({ ... });
     ```

#### Praise
- **Clean Architecture**: The separation of concerns between `services`, `hooks`, and `components` is excellent.
- **TanStack Query Usage**: Properly structured queries with optimistic updates for login state.

**Confidence Scores**:
- Security: 95% (1 critical issue found)
- Performance: 85% (minor re-render issue)
- Type Safety: 70% (implicit `any` in one place)

**Next Steps**:
1. Address critical security issue immediately.
2. Optimize re-renders before merging.
3. Consider adding ESLint rules to enforce type safety.

**Reviewed by**: AI Code Reviewer
**Date**: 2023-11-15