MaIN.NET (Modular Artificial Intelligence Network)

Security at TechVibe Solutions is managed through a badge access system and 24/7 monitoring:

Badge Access Levels

• Standard Access: All employees can access reception and floors 1-4 during business hours.
• Restricted Access:
  • Floor 5: Executive team and facilities staff only.
  • Server Room (Room 303): CTO and IT team only.
  • Security Lab (Room 301): Security team only.
  • After-hours: Restricted to Executive team and security personnel.

Visitor Management

• Process: Visitors must check in at the Floor 1 reception, receive a visitor badge, and must be escorted.
• Restrictions: Visitors are limited to floors 1-2 unless specific authorization is granted.
• Expiration: Visitor badges expire after 8 hours.

Parking

• Employee Parking: Spaces 1-115 (first-come, first-served).
• Executive Parking: Reserved spaces 501-505.
• Visitor Parking: Spaces 116-120.
• EV Charging: 8 charging stations available.

You can orchestrate the MaIN.NET stack using Docker Compose. The stack typically includes a MongoDB database, a Blazor frontend, and a Demo application.

Note: The backend service is currently commented out in the provided configuration but is designed to depend on mongodb and expose port 5000.

services:
  mongodb:
    image: mongo:latest
    container_name: mongodb
    restart: always
    ports:
      - "27017:27017"
    volumes:
      - mongo-data:/data/db

  blazor:
    image: inza124/main-blazor:latest
    container_name: blazor
    restart: always
    ports:
      - "5001:8080"
    environment:
      ASPNETCORE_ENVIRONMENT: Docker
      API_URL: http://host.docker.internal:5000
      DEMO_API_URL: http://demo:8080

  demo:
    image: inza124/main-demo
    container_name: demo
    restart: always
    ports:
      - "5002:8080"
    depends_on:
      - blazor
    environment:
      LocalHost: http://host.docker.internal

volumes:
  mongo-data:

The following C# code snippet demonstrates several anti-patterns that should be avoided in production environments:

1. SQL Injection: Concatenating variables directly into a SQL string ("... WHERE id = " + id) instead of using parameterized queries.
2. Hardcoded Credentials: Including sensitive connection strings and passwords directly in the source code.
3. Resource Leaks: Failing to use using blocks or explicit .Dispose() calls for SqlConnection and SqlCommand, which can lead to connection pool exhaustion.
4. Unsafe Type Conversion: Calling .ToString() directly on the result of ExecuteScalar() without checking for null, which will cause a NullReferenceException if no record is found.
5. Synchronous I/O: Performing blocking database operations (.Open(), .ExecuteScalar()) on the calling thread instead of using asynchronous methods (.OpenAsync(), .ExecuteScalarAsync()).

public string GetUser(int id) {
    var conn = new SqlConnection("Server=prod;Password=admin123");
    conn.Open();
    var cmd = new SqlCommand("SELECT * FROM users WHERE id = " + id, conn);
    return cmd.ExecuteScalar().ToString();
}

When using the code-review skill, provide a code snippet to be analyzed. The system will evaluate the code against specific criteria and return a structured response.

Analysis Criteria

The review covers:

• Bugs and logical errors: Functional correctness.
• Security vulnerabilities: Detection of injection attacks, unvalidated input, and hardcoded secrets.
• Performance: Identification of unnecessary allocations, missing async/await patterns, and N+1 query problems.
• Readability: Evaluation of naming conventions, code complexity, and the use of magic numbers.
• Error Handling: Identification of missing edge case management and error handling.

Response Format

The output is strictly structured into three sections:

1. Issues: A numbered list of critical problems that require immediate fixes.
2. Suggestions: A numbered list of non-critical improvements or best practices.
3. Verdict: A single-sentence summary of the code quality.

## Review Guidelines

For every code snippet analyze:
- Bugs and logical errors
- Security vulnerabilities (injection, unvalidated input, hardcoded secrets)
- Performance (unnecessary allocations, missing async/await, N+1 queries)
- Readability (naming, complexity, magic numbers)
- Missing error handling and edge cases

Response format:

**Issues** — critical problems that must be fixed (numbered list)
**Suggestions** — improvements worth considering (numbered list)
**Verdict** — one sentence summary

When implementing asynchronous data access methods (e.g., fetching a user by ID), follow these best practices to ensure security, performance, and reliability:

1. Use Asynchronous Patterns: Use async and await throughout the call stack to avoid blocking threads.
2. Prevent SQL Injection: Always use parameterized queries (e.g., passing an anonymous object new { id }) instead of string interpolation.
3. Manage Lifecycles with await using: Use await using for database connections to ensure proper asynchronous disposal of resources.
4. Handle Nullability: Use nullable return types (e.g., Task<User?>) to explicitly communicate to the caller that a record might not exist.
5. Support Cancellation: Accept and pass a CancellationToken to the underlying database driver to allow callers to abort long-running operations.

public async Task<User?> GetUserAsync(int id, CancellationToken ct = default)
{
    await using var conn = new SqlConnection(_connectionString);
    return await conn.QueryFirstOrDefaultAsync<User>(
        "SELECT * FROM users WHERE id = @id",
        new { id },
        cancellationToken: ct);
}