code-review

Code Review Guidelines for Agents

Code Review Verification Workflow

// turbo-all Before submitting any changes, you MUST verify your work against these checklists.

9.1 UI Code Review (loh-game, Rust/Bevy/Egui)

Focus Areas:
  • No .unwrap() or .expect() in UI systems
  • No .clone() in hot paths (frame-by-frame rendering)
  • Use Cow<str> or references for string handling
  • All UI text uses i18n system (t!() macro)
  • No hardcoded emojis in user-facing text
  • Hover/click states implemented
  • Accessibility: proper contrast, readable fonts
Performance:
  • UI systems run in O(1) or O(n) where n is visible items
  • No heap allocations in Update schedule
  • Egui contexts properly guarded with if let Some(ctx)
Test Coverage:
  • Unit Tests: Added/Updated tests for new logic (run cargo test)
  • Integration Tests: Verified critical paths (run cargo test --test integration_name)
  • UI Tests: Manual or Playwright verification for visual changes
  • ALL tests pass before merge

9.2 Backend Code Review (loh-backend, Cloudflare Workers)

Focus Areas:
  • All endpoints have rate limiting
  • Input validation on all user data
  • No raw SQL (use parameterized queries)
  • JWT tokens validated before accessing protected routes
  • Error responses don't leak internal details
  • CORS headers properly configured
Security:
  • No secrets in code (use environment variables)
  • PCI compliance: no card data logging
  • Turnstile/reCAPTCHA on sensitive endpoints
Error Handling:
  • All errors use anyhow::Result with context
  • Graceful degradation (return fallbacks, not 500s)
  • Structured logging with tracing
Rust Testing Guidelines:
  • Struct Initialization: Use constructors (e.g., HandlerContext::new) or helper functions (create_test_player) instead of struct literals in tests to avoid E0063 when fields change.
    • Example: Player requires account_flags; GameState requires bija_auditor, heuristics_engine, etc.
  • Async Tests: Ensure all async function calls in tests are .awaited before .unwrap().
  • Integration Tests:
    • Initialize AnalyticsProcessor in GameState::new (do not pass None).
    • Use HandlerContext::new(state, pool, session_id) for API handlers.
  • SQLx Schema: Ensure test_helpers.rs or migrations include ALL tables (e.g., orders, trades) required by the crate being tested (e.g., loh-market).

9.3 Web Code Review (loh-website, loh-ops-tools, Next.js)

Focus Areas:
  • Follows Awwwards design standards (see knowledge-base/design/design_bible.md)
  • Mobile responsive (tested at 375px)
  • Loading states implemented (skeleton loaders)
  • Error boundaries for component failures
  • No console.log in production
Accessibility:
  • Alt text for images
  • Semantic HTML (<nav>, <main>, <article>)
  • Keyboard navigable (tab order)
  • ARIA labels where needed
TypeScript:
  • No any types without justification
  • Proper null checks (optional chaining ?.)
  • API responses typed with interfaces