Code Review Comments Jenna Chan

[jenchan88]

• Using f-strings in SQL queries can lead to SQL injection vulnerabilities. Use parameterized queries to prevent SQL injection.
• The code does not handle cases where the track ID does not exist well, and it just returns an empty list. Maybe consider returning a structured response or raise an HTTP exception with an appropriate status code and message.
• The add_song_to_playlist and remove_song_from_playlist endpoints return a simple "OK" string. Consider returning a more structured JSON response.
• If all search parameters are empty, the code will return all tracks, which might be inefficient for large databases. Add a check to ensure that at least one search parameter is provided.
• For large datasets, the current implementation could return too many results. Add pagination support to limit the number of results returned and allow users to fetch results in chunks.
• Raise an appropriate exception if the song does not exist in the playlist
• Return an appropriate response if no recommendations are found.
• The code does not handle database exceptions. Maybe consider adding exception handling for database operations.
• Use EXISTS clause or check if any rows are returned directly, rather than counting all rows
• The endpoints assume that the user_id passed is valid and does not check if the requesting user has permission to access that user's history. Maybe implement user authentication and authorization checks to ensure users can only access their own history.
• The search results are not ordered. Consider adding parameters to allow users to sort results by different criteria (e.g., track name, artist, popularity).
• The search parameters are not validated. Add validation for search parameters to ensure they meet expected criteria (e.g., string length, special characters)