Code Quality Metrics Standards

• Cyclomatic complexity
• Cognitive complexity
• Lines-of-code thresholds
• Coupling and cohesion
• Concrete refactoring suggestions and drop-in code snippets

jeremy@MACSTUDIO Express-login-demo % claude
* Welcome to Claude Code!
/help for help, /status for your current setup
cwd: /Users/jeremy/Repos/Claude Code Course/Express-login-demo
> Try "fix typecheck errors"
? for shortcuts

https://github.com/JeremyMorgan/Claude-Code-Reviewing-Prompts

• Analyze code complexity across the codebase
• Identify high-complexity functions and methods
• Calculate or evaluate:
  1. Cyclomatic complexity
  2. Cognitive complexity
  3. Lines-of-code (LOC) metrics
  4. Coupling metrics
  5. Cohesion analysis
• Produce a structured findings report including an importance scale (1–10) and remediation with precise code-level fixes where possible

• Cyclomatic complexity is deterministic (counts decision points).
• Cognitive complexity models human understanding and is more subjective.
• LOC thresholds are human-oriented aids to improve maintainability.
• Coupling and cohesion are architectural metrics that guide refactors and design choices.

​

Executive summary

​

1. Cyclomatic complexity

• Finding #1: Login route handler
  • Location: routes/auth.js:17-96
  • Cyclomatic complexity: 12 (threshold > 10 flagged)
  • Importance: 8/10
  • Why: multiple decision points (validation, user lookup, password verification, error handling switch), with nested if/else branches

• Extract validation, user lookup, password verification, token generation, and error mapping into separate functions.
• Replace complex switch-based error handling with a small reusable error-mapper function (see remediation snippets below).

​

2. Cognitive complexity

• Finding #2: Login handler — high cognitive complexity
  • Location: routes/auth.js:17-96
  • Cognitive complexity: ~15
  • Importance: 7/10
  • Contributing factors:
    • Nested conditionals (validation → user check → password check)
    • Database queries interleaved with business logic (mixed abstractions)
    • Inline switch with multiple DB-specific error cases
    • Single function performing validation, auth logic, token generation, and error formatting

• Move database operations into a repository/service layer.
• Move validation to a dedicated validator function or middleware.
• Keep the route handler as a thin coordinator that calls small helpers and returns early on failures.

// routes/auth.js (refactored helpers)

const { validationResult } = require('express-validator');
const jwt = require('jsonwebtoken');
const bcrypt = require('bcrypt');

// Validate request body; throw on validation failure
const validateLoginRequest = (req) => {
  const errors = validationResult(req);
  if (!errors.isEmpty()) {
    const error = new Error('Validation failed');
    error.type = 'ValidationError';
    error.details = errors.array();
    throw error;
  }
  return req.body;
};

// Generate JWT token for a user
const generateAuthToken = (user) => {
  return jwt.sign(
    { userId: user.id, email: user.email },
    process.env.JWT_SECRET,
    { expiresIn: process.env.JWT_EXPIRES_IN || '24h' }
  );
};

​

3. Lines-of-code metrics

• Functions over 50 LOC: 1 (auth/login handler ~80 LOC)
• Files over 300 LOC: 0
• Classes over 500 LOC: 0

• Break the large login function into smaller functions with clear responsibilities (validation, user repository lookup, password verification, token creation, error mapping). This improves testability and readability.

​

4. Coupling metrics

• Efferent dependencies for auth module:
  • express, bcrypt, jsonwebtoken, express-validator, ../config/database
• Afferent coupling:
  • config/database.js is used by 1 module (routes/auth.js) — low afferent coupling
• Instability index:
  • Auth module shows moderate instability because it depends on several external libraries (typical for an auth module)

• Keep dependency usage explicit and consider dependency injection for easier testing (pass a database client or userRepository into service constructors).

​

5. Cohesion analysis

• config/database.js is cohesive: it focuses on database connection management.
• routes/auth.js currently violates single responsibility: it performs validation, business logic, DB access, token creation, and error formatting in a single function.
• Recommendation: increase cohesion by grouping related functions and moving unrelated concerns to separate modules (authService, userRepository, errorMapper).

​

Specific findings and remediation (prioritized)

1. Reduce cyclomatic complexity in the login handler by extracting validation, repository, password check, token creation, and error mapping into separate functions.
2. Split the login handler into multiple single-responsibility functions so each is < 50 LOC and has a low cyclomatic complexity.

// utils/errorMapper.js

function mapDatabaseError(err) {
  // Map known DB error codes to application-level error identifiers
  if (!err || !err.code) return { status: 500, body: { message: 'Internal server error' } };

  switch (err.code) {
    case 'ECONNREFUSED':
      return { status: 503, body: { message: 'Database unavailable' } };
    case '28P01': // invalid_password (Postgres)
      return { status: 500, body: { message: 'Database authentication error' } };
    case '3D000': // invalid_catalog_name (Postgres)
      return { status: 500, body: { message: 'Database not found' } };
    default:
      return { status: 500, body: { message: 'Database error' } };
  }
}

module.exports = { mapDatabaseError };

// routes/auth.js (simplified pattern)
const { mapDatabaseError } = require('../utils/errorMapper');

app.post('/login', async (req, res) => {
  try {
    const { email, password } = validateLoginRequest(req);
    const user = await userRepository.findByEmail(email); // move DB call into repo
    if (!user) return res.status(401).json({ message: 'Invalid credentials' });

    const isPasswordValid = await bcrypt.compare(password, user.passwordHash);
    if (!isPasswordValid) return res.status(401).json({ message: 'Invalid credentials' });

    const token = generateAuthToken(user);
    return res.json({ token });
  } catch (err) {
    if (err.type === 'ValidationError') {
      return res.status(400).json({ errors: err.details });
    }
    if (err.code) {
      const mapped = mapDatabaseError(err);
      return res.status(mapped.status).json(mapped.body);
    }
    // fallback
    return res.status(500).json({ message: 'Internal server error' });
  }
});

• If a reported finding cannot be fully verified due to missing files or lines, add a note “Unable to verify” and list which file(s) and line ranges are required to confirm it (e.g., repositories/userRepository.js or the exact routes/auth.js content).

​

Implementation plan (phased)

• Extract validation logic into helper functions or express-validator middleware.
• Extract token generation function into a small utility.
• Add an errorMapper utility for predictable DB-to-HTTP mapping.

• Create services/authService.js with methods: loginUser, verifyPassword, createToken.
• Create repositories/userRepository.js to encapsulate DB queries.
• Update routes to be thin coordinators that call services.

• Add unit tests for authService and userRepository (use DI/mocks for DB).
• Add a static analyzer check for cyclomatic/cognitive complexity as part of CI (optional).
• Monitor function/file sizes and complexity regressions in CI.

​

Metrics summary

1. Reduce cyclomatic complexity of login handler to <= 10.
2. Break the ~80-line login function into smaller, testable functions.
3. Extract DB error handling to an errorMapper to simplify error logic.

• Good separation between server/bootstrap code and configuration (e.g., server.js, config/database.js).
• Reasonable dependency choices for authentication (bcrypt, jsonwebtoken).
• Small, focused modules across the codebase make incremental improvements low-risk.

• express-validator — https://express-validator.github.io/docs/
• bcrypt (npm) — https://www.npmjs.com/package/bcrypt
• jsonwebtoken (npm) — https://www.npmjs.com/package/jsonwebtoken
• Static analysis & complexity tools:
  • ESLint — https://eslint.org/
  • Plato (JavaScript complexity) — https://github.com/es-analysis/plato
  • SonarQube — https://www.sonarqube.org/