SonarCloud Issue Triage Report¶

Date: 2026-03-13 Project: devgem_forma-3d-connect Branch analyzed: main Total issues: 244 code smells + 15.7% code duplication (10,743 lines / 202 blocks / 105 files) Previous report: 2026-03-12 — 769 issues + 19.5% duplication

Summary¶

All 244 issues are CODE_SMELL (no bugs or vulnerabilities remaining).

Recommended Action Plan¶

Phase 1: Quick Auto-fixes (22 issues)¶

S7781 — Prefer String#replaceAll() over String#replace() (9 issues) → FIX¶

Fix: Replace .replace(/pattern/g, ...) with .replaceAll(pattern, ...).

S7741 — Compare with undefined directly instead of typeof (2 issues) → FIX¶

Fix: Change typeof x !== 'undefined' to x !== undefined.

S7755 — Use .at() instead of [length - index] (2 issues) → FIX¶

Fix: Replace arr[arr.length - 1] with arr.at(-1).

S6606 — Use ??= instead of assignment expression (2 issues) → FIX¶

Fix: Replace x = x ?? value or if (x == null) x = value with x ??= value.

S3863 — Merge duplicate imports (2 issues) → FIX¶

Fix: Merge duplicate @forma3d/service-common import statements into one.

S7778 — Consolidate multiple Array#push() calls (1 issue) → FIX¶

Fix: Combine consecutive .push() calls into a single .push(a, b, c).

S7744 — Remove unnecessary fallback object in spread (1 issue) → FIX¶

Fix: Remove the empty object fallback (e.g., { ...(obj || {}) } → { ...obj }).

S7735 — Flip negated condition (1 issue) → FIX¶

Fix: Flip !condition ? a : b to condition ? b : a.

S7780 — Use String.raw for escaped backslashes (1 issue) → FIX¶

Fix: Use String.raw\...`` for regex patterns with backslash escapes.

S7787 — Empty export specifiers (1 issue) → SUPPRESS¶

Verdict: This export {}; was intentionally placed to keep the barrel file after moving decorators to @forma3d/service-common. Suppress in sonar properties.

Phase 2: Moderate Auto-fixes (70 issues)¶

S6759 — React props should be read-only (49 issues) → FIX¶

All 49 in apps/web/src/. Component props interfaces/types need to be wrapped with Readonly<Props> or use readonly modifiers.

Fix pattern: Change function Component(props: Props) or interface Props { ... } to use Readonly<Props>.

S4624 — Nested template literals (10 issues) → FIX¶

Fix: Extract inner template literal to a variable before the outer template.

S6819 — Use <section> tag instead of ARIA role="region" (6 issues) → FIX¶

Fix: Replace <div role="region" aria-label="..."> with <section aria-label="...">.

S4323 — Type aliases should be used (2 issues) → FIX¶

Fix: Extract inline union types to named type aliases.

S6571 — Redundant unknown in union type (2 issues) → FIX¶

Fix: unknown absorbs all other types in a union — simplify to just unknown or remove it.

S6754 — useState should be destructured symmetrically (1 issue) → FIX¶

Fix: Ensure useState is destructured as [value, setValue] with matching naming.

Phase 3: Manual Refactoring (71 issues)¶

S3358 — Nested ternary operations (45 issues) → MIXED¶

Most appear in React JSX where ternaries are a common rendering pattern. Some in backend services are genuinely hard to read.

Recommendation: - Backend (5 issues): Refactor to if/else or lookup maps — these are readable improvements. - Frontend JSX (40 issues): Many are idiomatic JSX patterns (conditional rendering). Consider suppressing S3358 for apps/web/src/** in sonar properties if the team accepts this pattern, or refactor the most deeply nested ones (3+ levels) into helper functions.

S6853 — Form labels must be associated with a control (19 issues) → FIX¶

All in apps/web/src/. These are accessibility violations where <label> elements lack htmlFor or don't wrap the associated <input>.

Fix: Add htmlFor="inputId" to <label> and matching id="inputId" to the input, or wrap the input inside the label element.

S4325 — Unnecessary type assertions (7 issues) → CAREFUL REVIEW¶

⚠️ Caution: Previous attempts to remove type assertions in sendcloud.service.ts and users.service.ts caused TypeScript compilation errors. Each must be individually verified — only remove if the compiler agrees the type is already correct.

Phase 4: Complex Refactoring (72 issues)¶

S3776 — Cognitive Complexity too high (23 issues) → REFACTOR¶

These are the most architecturally significant issues. Each function exceeds the complexity threshold of 15.

Recommendation: Prioritize functions with complexity > 25. Extract helper functions, use early returns, replace nested if/else with guard clauses. settings/index.tsx alone has 3 flagged functions — consider splitting into sub-components.

S6551 — Objects coerced to strings without toString() (47 issues) → MIXED¶

Concentrated in 3 files: - libs/service-common/src/lib/notifications/email.service.ts — 5 issues - apps/order-service/src/simplyprint/simplyprint-api.client.ts — 18 issues - apps/print-service/src/simplyprint/simplyprint-api.client.ts — 21 issues - apps/web/src/components/charts/donut-chart.tsx — 1 issue - apps/web/src/components/logs/log-detail-modal.tsx — 2 issues

Analysis: Most are template literal interpolations like `${context['someKey']}` where the value is typed as unknown or Record<string, unknown> but is actually a string at runtime. These are typically safe but SonarCloud flags them because the static type could be an object.

Recommendation: - For email.service.ts: Add explicit String(value) casts or narrow the type of context values. - For simplyprint-api.client.ts (both services): These are API response interpolations — add String() wrapping or type-narrow the response fields.

S107 — Too many parameters (2 issues) → MIXED¶

Phase 5: Won't Fix / Suppress (10 issues)¶

S7785 — Top-level await preferred (5 issues) → WON'T FIX¶

Reason: NestJS bootstrap uses bootstrap().catch(...) by convention. Top-level await changes module loading semantics and is not recommended for NestJS entry points.

S7726 — Default exports should be named (4 issues) → WON'T FIX¶

Reason: NestJS registerAs() returns a factory function — naming it is unnecessary and adds noise.

S7787 — Empty export specifiers (1 issue) → WON'T FIX¶

Reason: Intentional empty barrel file after moving decorators to @forma3d/service-common. Keeps import paths stable.

Phase 6: Duplication Reduction¶

Overall duplication dropped from 19.5% → 15.7% after the D1–D9 extraction effort (2026-03-12). Remaining duplication: 10,743 lines across 105 files in 202 blocks.

Top Duplication Clusters¶

D1: Retry Queue — order-service ↔ shipping-service (~95%)¶

Recommendation: Extract to libs/service-common/src/lib/retry-queue/. Repository and service are nearly identical. Processor has service-specific job handling but a shared base class could be extracted.

D2: SendCloud — order-service ↔ shipping-service (~90%)¶

Recommendation: Extract shared SendCloud service, webhook handler, and initializer to libs/service-common/src/lib/sendcloud/. The API client is only in shipping-service but shares patterns.

D3: SimplyPrint — order-service ↔ print-service (~88%)¶

Recommendation: Extract shared SimplyPrint DTOs, base API client, and shared service to a libs/simplyprint-common or libs/service-common/src/lib/simplyprint/ module. The API client in print-service is a superset — use it as the shared base.

D4: Cross-Service Infrastructure (~85%)¶

Recommendation: Extract correlation service/middleware, API key guard, and throttler module to libs/service-common. The permissions.ts files are intentionally per-service (different permission sets) — these are expected duplicates.

D5: Print Jobs — order-service ↔ print-service (~83%)¶

Recommendation: The admin controllers and main controllers are near-identical. Extract shared controllers to libs/service-common (similar to the existing D8 pattern for print-job DTOs/events/repository). The services differ more — keep service-specific.

D6: Auth Controllers (~83%)¶

Recommendation: Extract shared auth controller to libs/service-common. Gateway's auth controller is a superset (SSO + standard auth).

D7: Health Controllers (~55%)¶

Recommendation: Extract a shared health controller base class. Each service adds its own health indicators, but the boilerplate is identical.

D8: Notification Event Handlers (~71%)¶

Recommendation: Extract shared event handler patterns. Each service handles different events but the handler structure (logging, error handling, notification dispatch) is identical.

D9: App Modules (~60%)¶

Recommendation: The shared module imports (Database, Auth, Observability, Config, etc.) are already extracted to libs/service-common. The remaining duplication is the import list itself — this is structural and expected for NestJS. Won't fix.

Duplication Priority¶

Progress Since Previous Report¶