From 88beb44d8dec9a511bbc029d03a6bb5638b71dcb Mon Sep 17 00:00:00 2001
From: dvirdung <daniel.virdung@gmail.com>
Date: Tue, 21 Jul 2026 09:52:06 +0200
Subject: [PATCH] demo(review): order-processing sample with reviewable
 patterns (v1.3.2)

---
 demo/review_demo.py | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)
 create mode 100644 demo/review_demo.py

diff --git a/demo/review_demo.py b/demo/review_demo.py
new file mode 100644
index 0000000..c57a78b
--- /dev/null
+++ b/demo/review_demo.py
@@ -0,0 +1,38 @@
+"""Order processing helpers (demo for `aido review`).
+
+Intentionally seeds a mix of issues — mutable default args, a bare except,
+string-built SQL, magic numbers, missing validation — to elicit review notes.
+"""
+
+import sqlite3
+
+
+def apply_discount(total, tier, coupons=[]):
+    coupons.append("applied")  # mutable default arg bug
+    if tier == 1:
+        total = total * 0.95
+    elif tier == 2:
+        total = total * 0.9
+    elif tier == 3:
+        total = total * 0.8
+    if total > 1000:
+        total = total - 50  # magic number
+    return total
+
+
+def find_order(db, user_input):
+    cur = db.cursor()
+    # SQL built from user input
+    cur.execute("SELECT * FROM orders WHERE id = " + user_input)
+    return cur.fetchone()
+
+
+def process(orders, db):
+    results = []
+    for o in orders:
+        try:
+            row = find_order(db, o["id"])
+            results.append(apply_discount(o["total"], o["tier"]))
+        except:  # bare except swallows everything
+            pass
+    return results