Repository: kalviumcommunity/S84_Harshit_Sharma_CodeSnippet_Context
Pull request #13: Adds comment schema and user API routes
Author: login: Sharmaharshitnone
Labels: name: Review effort 2/5
Created: 2025-05-14T14:52:59Z | Merged: 2025-05-15T06:55:51Z

### **User description**
Introduces a schema for comments within snippets, enabling discussion.
Adds new API routes for user management, supporting comment attribution.


___

### **PR Type**
enhancement


___

### **Description**
- Introduced a new `User` schema and model for user management.

- Added API routes for user CRUD operations.

- Embedded a `Comment` schema within the `Snippet` model for snippet discussions.

- Registered user routes in the main server application.


___



### **Changes walkthrough** 📝
<table><thead><tr><th></th><th align="left">Relevant files</th></tr></thead><tbody><tr><td><strong>Enhancement</strong></td><td><table>
<tr>
  <td>
    <details>
      <summary><strong>Snippet.js</strong><dd><code>Add embedded CommentSchema to Snippet model</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </dd></summary>
<hr>

Backend/models/Snippet.js

<li>Added an embedded <code>CommentSchema</code> for snippet comments.<br> <li> Comment schema includes text, user reference, and timestamps.


</details>


  </td>
  <td><a href="https://github.com/kalviumcommunity/S84_Harshit_Sharma_CodeSnippet_Context/pull/13/files#diff-760b935eae444d1c9804b98beea9415cc2c7632fd5b2145e0f6ea5b9a25f8a13">+21/-4</a>&nbsp; &nbsp; </td>

</tr>

<tr>
  <td>
    <details>
      <summary><strong>user.js</strong><dd><code>Introduce User model and schema</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </dd></summary>
<hr>

Backend/models/user.js

<li>Created a new <code>UserSchema</code> with username, email, bio, and createdAt <br>fields.<br> <li> Added validation for username and email.<br> <li> Exported the <code>User</code> model.


</details>


  </td>
  <td><a href="https://github.com/kalviumcommunity/S84_Harshit_Sharma_CodeSnippet_Context/pull/13/files#diff-829d7cb3d3afee7546a0c912870916f9ec379477ae781d4c590ddeae44b62c8a">+27/-0</a>&nbsp; &nbsp; </td>

</tr>

<tr>
  <td>
    <details>
      <summary><strong>users.js</strong><dd><code>Add user API routes for CRUD operations</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </dd></summary>
<hr>

Backend/routes/users.js

<li>Added API route to get all users.<br> <li> Added API route to get a single user by ID.<br> <li> Added API route to create a new user.<br> <li> Implemented error handling for user operations.


</details>


  </td>
  <td><a href="https://github.com/kalviumcommunity/S84_Harshit_Sharma_CodeSnippet_Context/pull/13/files#diff-7e2b88367071f100891a2f34396da32fb7479902fb52946902404e52b8f20522">+38/-0</a>&nbsp; &nbsp; </td>

</tr>

<tr>
  <td>
    <details>
      <summary><strong>server.js</strong><dd><code>Register user routes in main server file</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </dd></summary>
<hr>

Backend/server.js

<li>Imported and registered user routes at <code>/api/users</code>.<br> <li> Ensured user API is accessible alongside snippet routes.


</details>


  </td>
  <td><a href="https://github.com/kalviumcommunity/S84_Harshit_Sharma_CodeSnippet_Context/pull/13/files#diff-6ccbaf6041c44c73c4e29f8c1ea8cf0e4059302f9d086525e63773bf00115f4a">+2/-0</a>&nbsp; &nbsp; &nbsp; </td>

</tr>
</table></td></tr></tr></tbody></table>

___

> <details> <summary>  Need help?</summary><li>Type <code>/help how to ...</code> in the comments thread for any questions about Qodo Merge usage.</li><li>Check out the <a href="https://qodo-merge-docs.qodo.ai/usage-guide/">documentation</a> for more information.</li></details>


Diff:
diff --git a/Backend/models/Snippet.js b/Backend/models/Snippet.js
index 1200257..5e4a076 100644
--- a/Backend/models/Snippet.js
+++ b/Backend/models/Snippet.js
@@ -1,4 +1,3 @@
-
 const mongoose = require("mongoose");
 
 const SnippetSchema = new mongoose.Schema({
@@ -11,15 +10,15 @@ const SnippetSchema = new mongoose.Schema({
   description: {
     type: String,
     required: false,
-    maxlength: [500, "Description cannot be more than 500 characters"], 
+    maxlength: [500, "Description cannot be more than 500 characters"],
   },
   code: {
     type: String,
-    required: [true, "Please add the code snippet"], 
+    required: [true, "Please add the code snippet"],
   },
   language: {
     type: String,
-    required: [true, "Please specify the language"], 
+    required: [true, "Please specify the language"],
     trim: true,
     lowercase: true,
   },
@@ -59,4 +58,32 @@ const SnippetSchema = new mongoose.Schema({
   },
 });
 
+// Comment Schema (embedded in Snippet)
+const CommentSchema = new mongoose.Schema({
+  text: {
+    type: String,
+    required: [true, "Comment text is required"],
+  },
+  user: {
+    type: mongoose.Schema.Types.ObjectId,
+    ref: "User",
+    required: true,
+  },
+  createdAt: {
+    type: Date,
+    default: Date.now,
+  },
+  updatedAt: Date,
+});
+
+// Add comments to SnippetSchema
+SnippetSchema.add({
+  comments: [CommentSchema]
+});
+
+// Add comments to SnippetSchema
+SnippetSchema.add({
+  comments: [CommentSchema]
+});
+
 module.exports = mongoose.model("Snippet", SnippetSchema);
diff --git a/Backend/models/user.js b/Backend/models/user.js
new file mode 100644
index 0000000..f388986
--- /dev/null
+++ b/Backend/models/user.js
@@ -0,0 +1,27 @@
+const mongoose = require("mongoose");
+
+const UserSchema = new mongoose.Schema({
+  username: {
+    type: String,
+    required: [true, "Username is required"],
+    unique: true,
+    trim: true,
+    maxlength: [50, "Username cannot be more than 50 characters"],
+  },
+  email: {
+    type: String,
+    required: [true, "Email is required"],
+    unique: true,
+    match: [
+      /^\w+([\.-]?\w+)*@\w+([\.-]?\w+)*(\.\w{2,3})+$/,
+      "Please add a valid email",
+    ],
+  },
+  bio: String,
+  createdAt: {
+    type: Date,
+    default: Date.now,
+  },
+});
+
+module.exports = mongoose.model("User", UserSchema);
diff --git a/Backend/routes/users.js b/Backend/routes/users.js
new file mode 100644
index 0000000..19ff81c
--- /dev/null
+++ b/Backend/routes/users.js
@@ -0,0 +1,38 @@
+const express = require("express");
+const router = express.Router();
+const User = require("../models/user.js");
+
+// Get all users
+router.get("/", async (req, res) => {
+  try {
+    const users = await User.find();
+    res.json({ success: true, count: users.length, data: users });
+  } catch (err) {
+    res.status(500).json({ success: false, error: err.message });
+  }
+});
+
+// Get single user
+router.get("/:id", async (req, res) => {
+  try {
+    const user = await User.findById(req.params.id);
+    if (!user) {
+      return res.status(404).json({ success: false, error: "User not found" });
+    }
+    res.json({ success: true, data: user });
+  } catch (err) {
+    res.status(500).json({ success: false, error: err.message });
+  }
+});
+
+// Create user
+router.post("/", async (req, res) => {
+  try {
+    const user = await User.create(req.body);
+    res.status(201).json({ success: true, data: user });
+  } catch (err) {
+    res.status(400).json({ success: false, error: err.message });
+  }
+});
+
+module.exports = router;
diff --git a/Backend/server.js b/Backend/server.js
index 96787c5..5827d83 100644
--- a/Backend/server.js
+++ b/Backend/server.js
@@ -3,6 +3,7 @@ require("dotenv").config();
 const app = express();
 const connectDB = require("./db/db");
 const snippetRoutes = require("./routes/snippets.js");
+const userRoutes = require("./routes/users.js");
 connectDB();
 app.use(express.json());
 
@@ -13,6 +14,7 @@ app.get("/", (req, res) => {
 });
 
 app.use("/api/snippets", snippetRoutes);
+app.use("/api/users", userRoutes);
 
 app.listen(port, () => {
   console.log(`Server is running at port: ${port}`);


Reviews:
user: login: qodo-free-for-open-source-projects[bot]
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-14T14:54:58Z
user: login: qodo-code-review[bot]
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-14T14:54:58Z
user: login: qodo-code-review[bot]
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-14T14:55:59Z
user: login: qodo-free-for-open-source-projects[bot]
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-14T14:55:59Z

Review comments:
diff_hunk: @@ -59,4 +58,22 @@ const SnippetSchema = new mongoose.Schema({
   },
 });
 
+// Comment Schema (embedded in Snippet)
+const CommentSchema = new mongoose.Schema({
+  text: {
+    type: String,
+    required: [true, "Comment text is required"],
+  },
+  user: {
+    type: mongoose.Schema.Types.ObjectId,
+    ref: "User",
+    required: true,
+  },
+  createdAt: {
+    type: Date,
+    default: Date.now,
+  },
+  updatedAt: Date,
+});
path: Backend/models/Snippet.js
user: login: qodo-free-for-open-source-projects[bot]
body: **Suggestion:** Missing schema integration
```suggestion
// Comment Schema (embedded in Snippet)
const CommentSchema = new mongoose.Schema({
  text: {
    type: String,
    required: [true, "Comment text is required"],
  },
  user: {
    type: mongoose.Schema.Types.ObjectId,
    ref: "User",
    required: true,
  },
  createdAt: {
    type: Date,
    default: Date.now,
  },
  updatedAt: Date,
});

// Add comments to SnippetSchema
SnippetSchema.add({
  comments: [CommentSchema]
});
```

<!-- manually_applied -->
created_at: 2025-05-14T14:54:58Z
author_association: CONTRIBUTOR
diff_hunk: @@ -59,4 +58,22 @@ const SnippetSchema = new mongoose.Schema({
   },
 });
 
+// Comment Schema (embedded in Snippet)
+const CommentSchema = new mongoose.Schema({
+  text: {
+    type: String,
+    required: [true, "Comment text is required"],
+  },
+  user: {
+    type: mongoose.Schema.Types.ObjectId,
+    ref: "User",
+    required: true,
+  },
+  createdAt: {
+    type: Date,
+    default: Date.now,
+  },
+  updatedAt: Date,
+});
path: Backend/models/Snippet.js
user: login: qodo-code-review[bot]
body: **Suggestion:** Missing schema integration
```suggestion
// Comment Schema (embedded in Snippet)
const CommentSchema = new mongoose.Schema({
  text: {
    type: String,
    required: [true, "Comment text is required"],
  },
  user: {
    type: mongoose.Schema.Types.ObjectId,
    ref: "User",
    required: true,
  },
  createdAt: {
    type: Date,
    default: Date.now,
  },
  updatedAt: Date,
});

// Add comments to SnippetSchema
SnippetSchema.add({
  comments: [CommentSchema]
});
```

<!-- manually_applied -->
created_at: 2025-05-14T14:54:58Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,38 @@
+const express = require("express");
+const router = express.Router();
+const User = require("../models/user.js");
+
+// Get all users
+router.get("/", async (req, res) => {
+  try {
+    const users = await User.find();
+    res.json({ success: true, count: users.length, data: users });
+  } catch (err) {
+    res.status(500).json({ success: false, error: err.message });
+  }
+});
+
+// Get single user
+router.get("/:id", async (req, res) => {
+  try {
+    const user = await User.findById(req.params.id);
+    if (!user) {
+      return res.status(404).json({ success: false, error: "User not found" });
+    }
+    res.json({ success: true, data: user });
+  } catch (err) {
+    res.status(500).json({ success: false, error: err.message });
+  }
+});
+
+// Create user
+router.post("/", async (req, res) => {
+  try {
+    const user = await User.create(req.body);
+    res.status(201).json({ success: true, data: user });
+  } catch (err) {
+    res.status(400).json({ success: false, error: err.message });
+  }
+});
path: Backend/routes/users.js
user: login: qodo-code-review[bot]
body: **Suggestion:** Input validation needed
```suggestion
// Create user
router.post("/", async (req, res) => {
  try {
    const { username, email, bio } = req.body;
    const user = await User.create({ username, email, bio });
    res.status(201).json({ success: true, data: user });
  } catch (err) {
    res.status(400).json({ success: false, error: err.message });
  }
});
```

<!-- manually_applied -->
created_at: 2025-05-14T14:55:59Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,38 @@
+const express = require("express");
+const router = express.Router();
+const User = require("../models/user.js");
+
+// Get all users
+router.get("/", async (req, res) => {
+  try {
+    const users = await User.find();
+    res.json({ success: true, count: users.length, data: users });
+  } catch (err) {
+    res.status(500).json({ success: false, error: err.message });
+  }
+});
+
+// Get single user
+router.get("/:id", async (req, res) => {
+  try {
+    const user = await User.findById(req.params.id);
+    if (!user) {
+      return res.status(404).json({ success: false, error: "User not found" });
+    }
+    res.json({ success: true, data: user });
+  } catch (err) {
+    res.status(500).json({ success: false, error: err.message });
+  }
+});
+
+// Create user
+router.post("/", async (req, res) => {
+  try {
+    const user = await User.create(req.body);
+    res.status(201).json({ success: true, data: user });
+  } catch (err) {
+    res.status(400).json({ success: false, error: err.message });
+  }
+});
path: Backend/routes/users.js
user: login: qodo-free-for-open-source-projects[bot]
body: **Suggestion:** Input validation needed
```suggestion
// Create user
router.post("/", async (req, res) => {
  try {
    const { username, email, bio } = req.body;
    const user = await User.create({ username, email, bio });
    res.status(201).json({ success: true, data: user });
  } catch (err) {
    res.status(400).json({ success: false, error: err.message });
  }
});
```

<!-- manually_applied -->
created_at: 2025-05-14T14:55:59Z
author_association: CONTRIBUTOR

PR comments:
user: login: qodo-code-review[bot]
created_at: 2025-05-14T14:53:21Z
body: ## PR Reviewer Guide 🔍

#### (Review updated until commit https://github.com/kalviumcommunity/S84_Harshit_Sharma_CodeSnippet_Context/commit/ff05d852787cf4e84db9a195f2044b68145e3f0c)


Here are some key observations to aid the review process:

<table>
<tr><td>⏱️&nbsp;<strong>Estimated effort to review</strong>: 2 🔵🔵⚪⚪⚪</td></tr>
<tr><td>🧪&nbsp;<strong>No relevant tests</strong></td></tr>
<tr><td>🔒&nbsp;<strong>Security concerns</strong><br><br>

<strong>Input validation concerns:</strong><br> The user creation endpoint (POST /api/users) accepts the request body directly without sanitization or validation. This could allow attackers to inject malicious data or bypass the schema validation if they provide unexpected fields. Consider implementing explicit validation of the input fields before passing to User.create().</td></tr>
<tr><td>⚡&nbsp;<strong>Recommended focus areas for review</strong><br><br>

<details><summary><a href='https://github.com/kalviumcommunity/S84_Harshit_Sharma_CodeSnippet_Context/pull/13/files#diff-760b935eae444d1c9804b98beea9415cc2c7632fd5b2145e0f6ea5b9a25f8a13R62-R77'><strong>Incomplete Implementation</strong></a>

The CommentSchema is defined but not actually used in the SnippetSchema. There's no field to store comments in the Snippet model.
</summary>

```javascript
const CommentSchema = new mongoose.Schema({
  text: {
    type: String,
    required: [true, "Comment text is required"],
  },
  user: {
    type: mongoose.Schema.Types.ObjectId,
    ref: "User",
    required: true,
  },
  createdAt: {
    type: Date,
    default: Date.now,
  },
  updatedAt: Date,
});
```

</details>

<details><summary><a href='https://github.com/kalviumcommunity/S84_Harshit_Sharma_CodeSnippet_Context/pull/13/files#diff-7e2b88367071f100891a2f34396da32fb7479902fb52946902404e52b8f20522R29-R35'><strong>Input Validation</strong></a>

The user creation endpoint accepts any request body without validation before passing it to User.create(), potentially allowing invalid or malicious data.
</summary>

```javascript
router.post("/", async (req, res) => {
  try {
    const user = await User.create(req.body);
    res.status(201).json({ success: true, data: user });
  } catch (err) {
    res.status(400).json({ success: false, error: err.message });
  }
```

</details>

</td></tr>
</table>

author_association: CONTRIBUTOR
user: login: qodo-free-for-open-source-projects[bot]
created_at: 2025-05-14T14:53:41Z
body: ## PR Code Suggestions ✨

<!-- ff05d85 -->

Explore these optional code suggestions:

<table><thead><tr><td><strong>Category</strong></td><td align=left><strong>Suggestion&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </strong></td><td align=center><strong>Impact</strong></td></tr><tbody><tr><td rowspan=1>Possible issue</td>
<td>



<details><summary>✅ 
Missing schema integration
</summary>

___

<details><summary><b>Suggestion Impact:</b></summary>The suggestion was directly implemented in the commit. The exact code from the suggestion was added to integrate the CommentSchema into the SnippetSchema by adding a comments field that stores an array of comments.

code diff:

```diff
+// Add comments to SnippetSchema
+SnippetSchema.add({
+  comments: [CommentSchema]
+});
```

</details>


___


**The <code>CommentSchema</code> is defined but never used in the Snippet model. Add a comments <br>field to the SnippetSchema to store the comments associated with each snippet.**

[Backend/models/Snippet.js [61-77]](https://github.com/kalviumcommunity/S84_Harshit_Sharma_CodeSnippet_Context/pull/13/files#diff-760b935eae444d1c9804b98beea9415cc2c7632fd5b2145e0f6ea5b9a25f8a13R61-R77)

```diff
 // Comment Schema (embedded in Snippet)
 const CommentSchema = new mongoose.Schema({
   text: {
     type: String,
     required: [true, "Comment text is required"],
   },
   user: {
     type: mongoose.Schema.Types.ObjectId,
     ref: "User",
     required: true,
   },
   createdAt: {
     type: Date,
     default: Date.now,
   },
   updatedAt: Date,
 });
 
+// Add comments to SnippetSchema
+SnippetSchema.add({
+  comments: [CommentSchema]
+});
+
```

`[Suggestion processed]`

<details><summary>Suggestion importance[1-10]: 8</summary>

__

Why: The suggestion correctly points out that the `CommentSchema` is defined but not integrated into the `SnippetSchema`, which is necessary for storing comments within snippets. Adding this integration is important for the intended functionality and data consistency.


</details></details></td><td align=center>Medium

</td></tr><tr><td rowspan=1>Security</td>
<td>



<details><summary>Input validation needed</summary>

___


**The user creation endpoint accepts the entire request body without validation, <br>creating a security risk. Implement input validation by explicitly extracting <br>only the required fields.**

[Backend/routes/users.js [28-36]](https://github.com/kalviumcommunity/S84_Harshit_Sharma_CodeSnippet_Context/pull/13/files#diff-7e2b88367071f100891a2f34396da32fb7479902fb52946902404e52b8f20522R28-R36)

```diff
 // Create user
 router.post("/", async (req, res) => {
   try {
-    const user = await User.create(req.body);
+    const { username, email, bio } = req.body;
+    const user = await User.create({ username, email, bio });
     res.status(201).json({ success: true, data: user });
   } catch (err) {
     res.status(400).json({ success: false, error: err.message });
   }
 });
```

- [ ] **Apply / Chat** <!-- /improve --apply_suggestion=1 -->

<details><summary>Suggestion importance[1-10]: 7</summary>

__

Why: The suggestion improves security and data integrity by ensuring only the required fields are accepted when creating a user, reducing the risk of unwanted or malicious data being stored. This is a good practice, though not a critical security fix.


</details></details></td><td align=center>Medium

</td></tr>
<tr><td align="center" colspan="2">

- [ ] Update <!-- /improve --more_suggestions=true -->

</td><td></td></tr></tbody></table>
author_association: CONTRIBUTOR
user: login: qodo-code-review[bot]
created_at: 2025-05-14T14:53:41Z
body: _Qodo Merge was enabled for this repository. To continue using it, please link your Git account with your Qodo account [here](https://app.qodo.ai/qodo-merge)._

## PR Code Suggestions ✨

<!-- ff05d85 -->

Explore these optional code suggestions:

<table><thead><tr><td><strong>Category</strong></td><td align=left><strong>Suggestion&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </strong></td><td align=center><strong>Impact</strong></td></tr><tbody><tr><td rowspan=1>Possible issue</td>
<td>



<details><summary>✅ 
Missing schema integration
</summary>

___

<details><summary><b>Suggestion Impact:</b></summary>The suggestion was directly implemented in the commit by adding the comments array field to the SnippetSchema using the CommentSchema

code diff:

```diff
+// Add comments to SnippetSchema
+SnippetSchema.add({
+  comments: [CommentSchema]
+});
```

</details>


___


**The CommentSchema is defined but never added to the SnippetSchema. Add a <br>comments field to the SnippetSchema to store the comments as an array of <br>embedded documents.**

[Backend/models/Snippet.js [61-77]](https://github.com/kalviumcommunity/S84_Harshit_Sharma_CodeSnippet_Context/pull/13/files#diff-760b935eae444d1c9804b98beea9415cc2c7632fd5b2145e0f6ea5b9a25f8a13R61-R77)

```diff
 // Comment Schema (embedded in Snippet)
 const CommentSchema = new mongoose.Schema({
   text: {
     type: String,
     required: [true, "Comment text is required"],
   },
   user: {
     type: mongoose.Schema.Types.ObjectId,
     ref: "User",
     required: true,
   },
   createdAt: {
     type: Date,
     default: Date.now,
   },
   updatedAt: Date,
 });
 
+// Add comments to SnippetSchema
+SnippetSchema.add({
+  comments: [CommentSchema]
+});
+
```

`[Suggestion processed]`

<details><summary>Suggestion importance[1-10]: 8</summary>

__

Why: The suggestion correctly identifies that the `CommentSchema` is defined but not integrated into the `SnippetSchema`, which is necessary for storing comments within snippets. Adding the embedded comments array is a significant functional improvement and addresses a core requirement for comment support.


</details></details></td><td align=center>Medium

</td></tr><tr><td rowspan=1>Security</td>
<td>



<details><summary>
Input validation needed
</summary>

___


**The user creation endpoint accepts the entire request body without validation, <br>creating a security risk. Implement input validation by explicitly extracting <br>only the required fields.**

[Backend/routes/users.js [28-36]](https://github.com/kalviumcommunity/S84_Harshit_Sharma_CodeSnippet_Context/pull/13/files#diff-7e2b88367071f100891a2f34396da32fb7479902fb52946902404e52b8f20522R28-R36)

```diff
 // Create user
 router.post("/", async (req, res) => {
   try {
-    const user = await User.create(req.body);
+    const { username, email, bio } = req.body;
+    const user = await User.create({ username, email, bio });
     res.status(201).json({ success: true, data: user });
   } catch (err) {
     res.status(400).json({ success: false, error: err.message });
   }
 });
```

`[Suggestion processed]`

<details><summary>Suggestion importance[1-10]: 7</summary>

__

Why: The suggestion improves security and data integrity by ensuring only the intended fields are used for user creation, reducing the risk of unwanted or malicious data being saved. While important, it is a standard best practice and not a critical bug fix.

</details></details></td><td align=center>Medium

</td></tr>
<tr><td align="center" colspan="2">

- [ ] More <!-- /improve --more_suggestions=true -->

</td><td></td></tr></tbody></table>


author_association: CONTRIBUTOR