// CONTROLLER LAYER - Apex Controller
public with sharing class {{projectPrefix}}_ProductController {
    @AuraEnabled(cacheable=true)
    public static List<Product2> getProductsForStore(String storeId) {
        // Immediately delegates to service layer
        return {{projectPrefix}}_ProductService.getProductsForStore(storeId);
    }
}

// SERVICE LAYER - Business Logic
public with sharing class {{projectPrefix}}_ProductService {
    public static List<Product2> getProductsForStore(String storeId) {
        // Complex logic, integrations
        Set<Id> validProductIds = {{projectPrefix}}_ProductSelector.getActiveProductsForStore(storeId);
        List<Product2> products = {{projectPrefix}}_ProductSelector.getProductsByIds(validProductIds);

        // Apply business rules
        {{projectPrefix}}_ProductDomain.applyDiscounts(products);
        {{projectPrefix}}_ProductDomain.validateInventory(products);

        return products;
    }
}

// SELECTOR LAYER - Data Access Only
public with sharing class {{projectPrefix}}_ProductSelector {
    public static Set<Id> getActiveProductsForStore(String storeId) {
        return new Map<Id, Product2>([
            SELECT Id FROM Product2
            WHERE IsActive = true
            AND StoreId__c = :storeId
        ]).keySet();
    }
}

// DOMAIN LAYER - Business Rules
public with sharing class {{projectPrefix}}_ProductDomain {
    public static void applyDiscounts(List<Product2> products) {
        // Apply buyer-group-specific discounts
        for (Product2 prod : products) {
            // Discount logic
        }
    }
}

// Correct naming
public class {{projectPrefix}}_OrderService {
    private static final Integer MAX_ORDER_ITEMS = 500;
    private static final String ERROR_MSG_INVALID_ORDER = 'Order is invalid';

    public static Boolean isOrderValid(Order order) { ... }
    private Boolean hasDiscountApplied = false;
}

// Incorrect naming
public class OrderService { ... } // Missing {{projectPrefix}}_ prefix
public class getOrderInfo() { ... } // Should be camelCase for methods
private String maxItems; // Should be MAX_ITEMS for constant

# Apex coverage
sf apex run test --class-names {{projectPrefix}}_OrderServiceTest --code-coverage

# Jest coverage
npm test -- --coverage --collectCoverageFrom='force-app/**/component.js'

// BAD: Multiple separate queries
for (Account acc : accounts) {
    List<Contact> contacts = [SELECT Id FROM Contact WHERE AccountId = :acc.Id];
    List<Opportunity> opps = [SELECT Id FROM Opportunity WHERE AccountId = :acc.Id];
}

// GOOD: Single bulkified query
Map<Id, List<Contact>> contactsByAccountId = new Map<Id, List<Contact>>();
for (Contact con : [SELECT AccountId FROM Contact WHERE AccountId IN :accountIds]) {
    if (!contactsByAccountId.containsKey(con.AccountId)) {
        contactsByAccountId.put(con.AccountId, new List<Contact>());
    }
    contactsByAccountId.get(con.AccountId).add(con);
}

test('has proper ARIA labels for accessibility', async () => {
  element.product = { Name: 'Test Product', Id: '001xx000003DHY' };
  await element.updateComplete;

  const button = element.shadowRoot.querySelector('[data-test-id="add-to-cart"]');
  expect(button.getAttribute('aria-label')).toBe('Add Test Product to cart');
});

test('is fully keyboard navigable', async () => {
  // Tab through all interactive elements
  const button = element.shadowRoot.querySelector('button');
  button.focus();
  expect(document.activeElement).toBe(element.shadowRoot.host);

  // Fire keyboard events
  const event = new KeyboardEvent('keydown', { key: 'Enter' });
  button.dispatchEvent(event);
  // Verify action occurred
});

// CORRECT: Using Named Credential
HttpRequest req = new HttpRequest();
req.setEndpoint('callout:{{projectPrefix}}_Middleware_Prod/orders');
req.setMethod('POST');
Http http = new Http();
HttpResponse res = http.send(req);

// INCORRECT: Hardcoded endpoint
req.setEndpoint('https://api.internal.com/orders?key=abc123');

<?xml version="1.0" encoding="UTF-8"?>
<ruleset name="{{projectPrefix}} Apex Rules"
  xmlns="http://pmd.sf.net/ruleset/2.0.0"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://pmd.sf.net/ruleset/2.0.0
    http://pmd.sf.net/ruleset_2_0_0.xsd">

  <description>PMD Rules for {{clientName}} B2B Commerce</description>

  <!-- Code style -->
  <rule ref="category/apex/style.xml/FieldNamingConventions">
    <properties>
      <property name="prefix" value="m_"/>
      <property name="exclusions" value="serialVersionUID"/>
    </properties>
  </rule>

  <!-- Design -->
  <rule ref="category/apex/design.xml/ExcessiveParameterList">
    <properties>
      <property name="threshold" value="4"/>
    </properties>
  </rule>

  <rule ref="category/apex/design.xml/ExcessiveClassLength">
    <properties>
      <property name="threshold" value="1000"/>
    </properties>
  </rule>

  <!-- Performance -->
  <rule ref="category/apex/performance.xml/OperationWithLimitsInLoop">
    <priority>1</priority>
  </rule>

  <rule ref="category/apex/performance.xml/AvoidSoqlInLoops">
    <priority>1</priority>
  </rule>

  <!-- Best Practices -->
  <rule ref="category/apex/bestpractices.xml/AvoidGlobalModifier">
    <priority>3</priority>
  </rule>

  <rule ref="category/apex/bestpractices.xml/ApexAssertionsShouldIncludeMessage">
    <priority>3</priority>
  </rule>

</ruleset>

sf scanner run --engine pmdapex --target force-app/ --format json > pmd-report.json

{
  "extends": ["eslint:recommended", "plugin:@lwc/recommended"],
  "parserOptions": {
    "ecmaVersion": 2020
  },
  "env": {
    "browser": true,
    "es2020": true,
    "jest": true
  },
  "rules": {
    "no-var": "error",
    "prefer-const": "error",
    "no-console": "warn",
    "no-unused-vars": ["error", { "argsIgnorePattern": "^_" }],
    "@lwc/lwc/no-invalid-dom-query-selector": "error",
    "@lwc/lwc/valid-api": "error",
    "@lwc/lwc/no-document-query": "error",
    "no-restricted-globals": ["error", "window"],
    "@lwc/lwc/no-dupe-class-fields": "error"
  }
}

npm run lint
npm run lint -- --fix  # Auto-fix issues

{
  "singleQuote": true,
  "trailingComma": "es5",
  "tabWidth": 2,
  "semi": true,
  "printWidth": 100,
  "arrowParens": "always",
  "overrides": [
    {
      "files": "*.apex",
      "options": {
        "parser": "apex",
        "tabWidth": 4
      }
    }
  ]
}

npm run format
npm run format:check

{
  "rules": [
    {
      "engine": "pmdapex",
      "enabled": true,
      "categories": ["Performance", "Security", "Design"]
    },
    {
      "engine": "retire",
      "enabled": true
    }
  ],
  "target": ["force-app/"]
}

sf scanner run --config .sfdx-scanner-config.json --format json

## Summary

[Brief description of what this PR accomplishes - 1-2 sentences]

## Workstream

- Epic/Feature: [e.g., "B2B Cart Management"]
- Story: [e.g., "As a buyer, I want to modify cart quantities"]
- Task: [e.g., "Implement cart update endpoint"]

## Gap Analysis Items

[List any outstanding tasks or considerations]

- [ ] Integration testing pending
- [ ] Performance benchmarking required
- [ ] Third-party API validation needed

## Type of Change

- [ ] Bug fix (non-breaking change)
- [ ] New feature (non-breaking change)
- [ ] Breaking change (fix or feature that would cause existing functionality to change)
- [ ] Documentation update
- [ ] Performance improvement
- [ ] Refactoring (no functional change)
- [ ] Security fix

## Testing

**Manual Testing Steps:**

1. Navigate to product listing page
2. Select a product and add to cart
3. Update quantity in cart
4. Verify total price recalculates correctly
5. Proceed to checkout and complete order

**Test Coverage:**

- Jest Coverage: 85% (statements, branches, lines)
- Apex Coverage: 92% (includes error paths)
- Manual QA: [Pass/Fail]

## Screenshots

[For UI changes, include before/after screenshots]

## Checklist

### Code Quality

- [ ] Code follows project style guide
- [ ] No hardcoded credentials or sensitive data
- [ ] Comments explain complex logic
- [ ] Variable/method names are clear and descriptive
- [ ] No console.log or debug statements left

### Testing

- [ ] Unit tests written and passing
- [ ] Integration tests passing
- [ ] All test scenarios documented
- [ ] Negative test cases included
- [ ] Code coverage >80% (LWC) / >85% (Apex)

### Security & Performance

- [ ] CRUD/FLS checks included in queries
- [ ] No SOQL in loops
- [ ] Bulkified for 200+ records
- [ ] No hardcoded endpoints (using Named Credentials)
- [ ] Accessibility checks (WCAG 2.1 AA)

### Documentation

- [ ] JSDoc/Apex comments on public methods
- [ ] README updated if new setup steps required
- [ ] Edge cases documented
- [ ] Related issues/tickets linked

### Review Requirements

- [ ] 2+ code reviewers assigned
- [ ] No merge conflicts
- [ ] Builds passing in CI/CD
- [ ] Performance benchmarks met (if applicable)

---

## Related Issues

Closes #[issue number]
Related to #[issue number]

## Additional Context

[Add any other context about the PR here]

**CRITICAL: Security Issue**
This query doesn't check CRUD permissions before accessing Account data.

Suggested fix:
\`\`\`apex
if (!Account.sObjectType.getDescribe().isAccessible()) {
throw new SecurityException('No access to Account');
}
\`\`\`

**MAJOR: Performance Issue**
This SOQL query inside a loop will cause governor limit errors with 200+ records.

Suggested fix:

- Move query outside loop
- Use bulk API instead
- See sfb2b-test skill for bulk testing examples

**MINOR: Code Style**
Method name should follow camelCase convention: `getProductInfo` instead of `getproductinfo`

Reference: {{projectPrefix}}_ naming conventions in sfb2b-review skill

**SUGGESTION: Maintainability**
Consider extracting this calculation into a domain class for reusability.

This is optional but would improve code reusability across the system.

## Summary

This PR implements the cart quantity update feature for the B2B Commerce platform.

## Code Quality Review

- Architecture follows SSD pattern correctly
- Test coverage: 87% (exceeds 85% requirement)
- MAJOR: See performance concern below

## Issues Found

### 1. **CRITICAL: Security - CRUD Check Missing**

Lines 42-45 in `{{projectPrefix}}_CartService.cls`

The `updateCartItem` method queries CartItem without checking CRUD permissions.

**Fix Required:**
\`\`\`apex
public static void updateCartItem(Id cartItemId, Decimal newQuantity) {
if (!CartItem.sObjectType.getDescribe().isAccessible()) {
throw new SecurityException('Insufficient privileges');
}
// ... rest of method
}
\`\`\`

### 2. **MAJOR: Performance - SOQL in Loop**

Lines 58-62 in `{{projectPrefix}}_CartDomain.cls`

This loop will trigger SOQL in loop error:
\`\`\`apex
for (CartItem item : cartItems) {
Product2 prod = [SELECT UnitPrice FROM Product2 WHERE Id = :item.Product2Id]; // Query in loop
}
\`\`\`

**Fix Required:**
\`\`\`apex
Set<Id> productIds = new Map<Id, CartItem>(cartItems).keySet();
Map<Id, Product2> products = new Map<Id, Product2>([
SELECT Id, UnitPrice FROM Product2 WHERE Id IN :productIds
]);
for (CartItem item : cartItems) {
Product2 prod = products.get(item.Product2Id);
}
\`\`\`

### 3. **MINOR: Naming Convention**

Variable `qty` should be `quantity` for clarity.

## Approvals Needed

- [ ] 2+ reviewers
- [ ] Security team (for CRUD implementation)
- [ ] Performance review (verify bulkification)

## Ready to Merge?

**NO** - Critical security issue must be resolved first.

---

Approve after addressing CRITICAL and MAJOR items.

// BAD: {{projectPrefix}}_OrderManager does everything
public class {{projectPrefix}}_OrderManager {
    public static void createOrder() { }
    public static void updateInventory() { }
    public static void calculateTax() { }
    public static void submitToERP() { }
    public static void sendNotification() { }
    public static void generateReport() { }
}

// GOOD: Separated concerns
public class {{projectPrefix}}_OrderService { ... }      // Creates/manages orders
public class {{projectPrefix}}_InventoryService { ... }  // Inventory operations
public class {{projectPrefix}}_TaxService { ... }        // Tax calculations
public class {{projectPrefix}}_ERPIntegration { ... }    // ERP submission
public class {{projectPrefix}}_NotificationService { ... } // Notifications

// BAD: Component with business logic
export default class {{projectPrefixLower}}Order extends LightningElement {
  handleAddToCart() {
    // Complex business logic in component
    const subtotal = this.cartItems.reduce((sum, item) => {
      return sum + item.quantity * item.unitPrice;
    }, 0);

    const taxRate = this.getTaxRate(this.billingState);
    const tax = subtotal * taxRate;
    const total = subtotal + tax;
    // ...
  }
}

// GOOD: Call service, let Apex handle logic
import { {{projectPrefix}}_CartController } from '@salesforce/apex/{{projectPrefix}}_CartController';

export default class {{projectPrefixLower}}Order extends LightningElement {
  async handleAddToCart(cartItem) {
    // Delegate to service
    const cartTotal = await {{projectPrefix}}_CartController.addItemToCart(cartItem);
    this.displayTotal(cartTotal);
  }
}

// BAD: Hardcoded IDs and URLs
public class {{projectPrefix}}_ProductService {
    private static final String STORE_ID = '0ZeQ30000000001CAA'; // Hardcoded ID
    private static final String API_ENDPOINT = 'https://api.internal.com/products'; // Hardcoded

    public static void syncProducts() {
        HttpRequest req = new HttpRequest();
        req.setEndpoint(API_ENDPOINT);
    }
}

// GOOD: Use Named Credentials and Custom Metadata
public class {{projectPrefix}}_ProductService {
    public static void syncProducts() {
        {{projectPrefix}}_Config__mdt config = {{projectPrefix}}_Config__mdt.getInstance('{{projectPrefix}}_Prod');

        HttpRequest req = new HttpRequest();
        req.setEndpoint('callout:{{projectPrefix}}_Middleware_Prod/products'); // Named Credential

        WebStore store = {{projectPrefix}}_WebStoreSelector.getDefaultStore(); // Query vs hardcode
    }
}

// BAD: Multiple queries in loop
for (Account acc : accounts) {
    List<Contact> contacts = [SELECT Id, Name FROM Contact WHERE AccountId = :acc.Id];
    List<Opportunity> opportunities = [SELECT Id, Amount FROM Opportunity WHERE AccountId = :acc.Id];
    // Process
}

// GOOD: Single bulkified query
Set<Id> accountIds = new Map<Id, Account>(accounts).keySet();

Map<Id, List<Contact>> contactsByAccountId = new Map<Id, List<Contact>>();
for (Contact con : [SELECT AccountId, Name FROM Contact WHERE AccountId IN :accountIds]) {
    if (!contactsByAccountId.containsKey(con.AccountId)) {
        contactsByAccountId.put(con.AccountId, new List<Contact>());
    }
    contactsByAccountId.get(con.AccountId).add(con);
}

// BAD: No null checks
public static Decimal calculateOrderTotal(Order order) {
    Decimal total = order.Amount + order.Tax; // order or Amount could be null
    return total;
}

// GOOD: Defensive null checking
public static Decimal calculateOrderTotal(Order order) {
    if (order == null || order.Amount == null) {
        throw new IllegalArgumentException('Order and Amount required');
    }

    Decimal tax = order.Tax != null ? order.Tax : 0;
    Decimal total = order.Amount + tax;
    return total;
}

// BAD: Synchronous callout during transaction
public static void submitOrder(Id orderId) {
    Order order = [SELECT Id, OrderNumber FROM Order WHERE Id = :orderId];

    Http http = new Http();
    HttpRequest req = new HttpRequest();
    req.setEndpoint('callout:{{projectPrefix}}_Middleware_Prod/orders');
    req.setMethod('POST');

    HttpResponse res = http.send(req); // Blocks entire transaction

    update order;
}

// GOOD: Queue async callout
public static void submitOrder(Id orderId) {
    Order order = [SELECT Id, OrderNumber FROM Order WHERE Id = :orderId];
    order.Status = 'Processing';
    update order;

    // Queue async job to prevent blocking
    System.enqueueJob(new {{projectPrefix}}_OrderSubmissionQueueable(orderId));
}

// In separate queueable class
public class {{projectPrefix}}_OrderSubmissionQueueable implements Queueable, Database.AllowsCallouts {
    private Id orderId;

    public void execute(QueueableContext context) {
        Http http = new Http();
        HttpRequest req = new HttpRequest();
        req.setEndpoint('callout:{{projectPrefix}}_Middleware_Prod/orders');

        HttpResponse res = http.send(req); // Async, non-blocking
    }
}

// BAD: No exception handling
public static List<Order> getOrders() {
    return [SELECT Id, OrderNumber FROM Order LIMIT 1000]; // What if SOQL fails?
}

// GOOD: Graceful error handling
public static List<Order> getOrders() {
    try {
        return [SELECT Id, OrderNumber FROM Order LIMIT 1000];
    } catch (QueryException e) {
        System.debug(LoggingLevel.ERROR, 'Failed to retrieve orders: ' + e.getMessage());
        throw new ApplicationException('Unable to retrieve orders', e);
    }
}

# Run full review suite
npm run lint && npm test -- --coverage && sf scanner run

# Check specific file
npm run lint force-app/main/default/lwc/{{projectPrefixLower}}ProductCard/{{projectPrefixLower}}ProductCard.js

# Run Apex tests with coverage
sf apex run test --class-names {{projectPrefix}}_OrderServiceTest --code-coverage

# Generate PMD report
sf scanner run --engine pmdapex --format json > pmd-report.json

# Check test coverage
npm test -- --coverage --collectCoverageFrom='force-app/main/default/lwc/**/*.js'

### Must Always Include

- [ ] CRUD/FLS checks in queries
- [ ] SOQL bulkification (no loops with queries)
- [ ] Unit test coverage >80-85%
- [ ] JSDoc comments on public methods
- [ ] {{projectPrefix}}_ prefix on all custom classes

### Must Not Include

- [ ] Hardcoded credentials or endpoints
- [ ] console.log statements
- [ ] Synchronous callouts
- [ ] Commented-out code blocks
- [ ] TODO/FIXME without context