``` REFACTORING AUDIT — Provided Code Language: Python 3.12 Files analyzed: 1 (4 functions, 24 lines) ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ PRIORITY 1 — HIGH IMPACT / LOW EFFORT ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ ┌─────────────────────────────────────────────────────┐ │ FINDING #1 │ │ Type: Duplication │ │ Location: get_user() L8–12 / get_customer() L14–18 │ │ Effort: 1 | Impact: 4 | Ratio: 4.0 │ │ │ │ Fix: │ │ Extract a shared private helper: │ │ │ │ def _fetch_entity(endpoint: str) -> dict | None: │ │ response = requests.get(API_URL + endpoint) │ │ if response.status_code == 200: │ │ return response.json() │ │ return None │ │ │ │ Retain both public functions as thin wrappers │ │ to preserve legacy API consumer signatures: │ │ │ │ def get_user(user_id): │ │ return _fetch_entity(f"/users/{user_id}") │ │ │ │ def get_customer(customer_id): │ │ return _fetch_entity(f"/users/{customer_id}")│ │ │ │ NOTE: Both functions currently resolve to the │ │ same endpoint (/users/{id}). This is either │ │ intentional aliasing or a latent bug. │ │ [UNCONF] — confirm with runtime routing config │ │ before merging endpoint paths. │ │ │ │ Expected outcome: Bug fixes and future behavior │ │ changes apply in one place. Eliminates silent │ │ divergence risk across a 4-dev team. │ └─────────────────────────────────────────────────────┘ ┌─────────────────────────────────────────────────────┐ │ FINDING #2 │ │ Type: Duplication │ │ Location: process_order() L20–24 / │ │ calculate_invoice() L26–30 │ │ Effort: 1 | Impact: 4 | Ratio: 4.0 │ │ │ │ Fix: │ │ Extract shared computation core: │ │ │ │ def _compute_total(amount: float) -> float: │ │ tax = amount * TAX_RATE │ │ return amount + tax + PROCESSING_FEE │ │ │ │ Retain public wrappers: │ │ │ │ def process_order(order): │ │ return _compute_total(order["amount"]) │ │ │ │ def calculate_invoice(invoice): │ │ return _compute_total(invoice["amount"]) │ │ │ │ This directly depends on Finding #3 (constants). │ │ Implement #3 first, then extract this helper. │ │ │ │ Expected outcome: Tax rate or fee changes update │ │ in one location. Current dual-site maintenance is │ │ a confirmed divergence risk — values are identical │ │ now but nothing enforces that they stay so. │ └─────────────────────────────────────────────────────┘ ┌─────────────────────────────────────────────────────┐ │ FINDING #3 │ │ Type: Magic Numbers / Hardcoded Values │ │ Location: process_order() L21–22, │ │ calculate_invoice() L27–28 │ │ Effort: 1 | Impact: 3 | Ratio: 3.0 │ │ │ │ Fix: │ │ Promote literals to named module-level constants: │ │ │ │ TAX_RATE: float = 0.15 │ │ PROCESSING_FEE: float = 12.99 │ │ │ │ Place immediately after API_URL declaration │ │ (L5) to consolidate all configuration in one │ │ visible block at the top of the module. │ │ │ │ Expected outcome: Business rule changes (e.g. tax │ │ jurisdiction updates) require a single edit, not │ │ a codebase search. Eliminates silent inconsistency │ │ risk when values drift between call sites. │ └─────────────────────────────────────────────────────┘ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ PRIORITY 2 — MEDIUM IMPACT / MEDIUM EFFORT ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ ┌─────────────────────────────────────────────────────┐ │ FINDING #4 │ │ Type: Dead Code — Unused Import │ │ Location: L2 (import os) │ │ Effort: 1 | Impact: 1 | Ratio: 1.0 │ │ │ │ Fix: │ │ Remove `import os` from L2. │ │ [UNCONF] — verify no conditional os usage exists │ │ in code not provided (e.g. env var reads). If │ │ API_URL will later be sourced from │ │ os.environ.get(), retain and document intent. │ │ │ │ Expected outcome: Removes noise from import block, │ │ prevents false assumptions by team members that │ │ os is actively used elsewhere in this module. │ └─────────────────────────────────────────────────────┘ ┌─────────────────────────────────────────────────────┐ │ FINDING #5 │ │ Type: Hardcoded Config / Environment Coupling │ │ Location: L5 (API_URL = "https://api.example.com") │ │ Effort: 2 | Impact: 3 | Ratio: 1.5 │ │ │ │ Fix: │ │ Source from environment with a safe fallback: │ │ │ │ API_URL: str = os.environ.get( │ │ "API_URL", "https://api.example.com" │ │ ) │ │ │ │ This would also resolve Finding #4 (os becomes │ │ actively used). Coordinate these two changes │ │ together. │ │ │ │ Expected outcome: Enables environment-specific │ │ deployments (staging, prod) without code changes. │ │ Reduces risk of hardcoded prod URLs shipping in │ │ test builds. │ └─────────────────────────────────────────────────────┘ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ PRIORITY 3 — LOW PRIORITY / DEFERRED ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ ┌─────────────────────────────────────────────────────┐ │ FINDING #6 │ │ Type: Missing Type Annotations [GAP] │ │ Location: All four public functions │ │ Effort: 1 | Impact: 2 | Ratio: 2.0 │ │ │ │ Fix: │ │ Add signatures for Python 3.12 compatibility: │ │ │ │ def get_user(user_id: int) -> dict | None │ │ def get_customer(customer_id: int) -> dict | None│ │ def process_order(order: dict) -> float │ │ def calculate_invoice(invoice: dict) -> float │ │ │ │ [GAP] — No type stubs or mypy config provided. │ │ Annotation value depends on whether static │ │ analysis is part of this team's CI pipeline. │ │ Defer if not currently enforced. │ │ │ │ Expected outcome: Enables static analysis catches │ │ on callers. Especially relevant for the dict │ │ inputs — callers passing missing "amount" key │ │ will raise KeyError at runtime with no prior │ │ warning under the current untyped signatures. │ └─────────────────────────────────────────────────────┘ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ CROSS-CUTTING FLAG ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ ⚠ get_user() and get_customer() resolve to an identical endpoint: /users/{id}. This is either intentional aliasing (two caller domains, one resource) or a copy-paste defect. This audit cannot determine which. [UNCONF] — requires product/API owner confirmation before any consolidation. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ SUMMARY ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Total findings: 6 [UNCONF] flags: 2 (F1, F4/F5) [GAP] flags: 1 (F6) Priority 1 findings: 3 (ratio ≥ 2.0) Estimated refactoring time: 2–3 hours (solo), <1 hour (pair on F1–F3) Recommended first action: Extract TAX_RATE and PROCESSING_FEE as named constants (F3, Effort 1), then use them to implement _compute_total() (F2) — this removes the highest-risk silent divergence point in under 15 minutes and unblocks F2 with no signature changes required. ```