Managing Cart Line Items

Welcome back! 👋 Now that your cart can gain items via “add to cart,” the next step is letting clients manage those items: change quantities and remove a line entirely. In this lesson, you’ll implement the two core mutations that every cart needs: PATCH to update a line item’s quantity, and DELETE to remove a line item. Along the way, you’ll see how the repository provides precise “row-level” operations, how the service layer enforces business rules (cart state, product availability, inventory), and how the route maps those outcomes into consistent HTTP responses without hardcoded status codes. Previously, adding items created rows in cart_items, and cart reads automatically computed totals from those rows. Managing items builds directly on that: when quantities change or rows are deleted, the cart totals naturally change on the next GET /api/carts/:id .

The Cart Item Operations We’re Adding

A cart line item is uniquely identified by: cart_id (the cart that owns it) id (the item row’s ID) That means every “manage” operation needs to be scoped by both values. Scoping by both is not just correctness—it’s security and integrity: you never want to update or delete an item from the wrong cart. In this lesson, you’ll cover three repository capabilities that make safe mutations possible: getCartItemByCartAndId(cartId, itemId) \to read a specific item (or null) updateCartItemQuantity(cartId, itemId, quantity) \to update quantity with UPDATE ... RETURNING (or null) deleteCartItem(cartId, itemId) \to delete with DELETE ... RETURNING (returns boolean) Then you’ll wire those into service rules and expose them through: app/routes/api.carts.$id.items.$itemId.ts

Repository: Reading a Specific Cart Item Before Mutating

The service layer often needs to detect “missing item” before it tries to update or delete. That’s why the repository provides a targeted lookup. This code lives in src/lib/repositories/cartsRepo.ts and returns either the cart item or null. TypeScript// src/lib/repositories/cartsRepo.ts export async function getCartItemByCartAndId( cartId: string, itemId: string, ): Promise<CartItem | null> { const rows = await query<CartItemRow>( "SELECT * FROM cart_items WHERE cart_id = $1 AND id = $2", [cartId, itemId], ); return rows[0] ? mapCartItemRow(rows[0]) : null; } The key detail is the WHERE cart_id = $1 AND id = $2 scope. This guarantees you only ever retrieve an item that belongs to the specified cart, which prevents cross-cart access bugs. Returning null is intentional: the repository is “SQL-in / data-out.” It doesn’t decide HTTP behavior; it gives the service enough information to turn missing rows into a 404. mapCartItemRow keeps the returned shape consistent with the rest of the domain layer, so services and routes don’t work with raw DB rows. This function is especially valuable because it lets the service check business rules (like product availability) using the item’s product_id before applying updates.

Join the 1M+ learners on CodeSignal

Be a part of our community of 1M+ users who develop and demonstrate their skills on CodeSignal

Service: Updating an Item with Business Rules

The service method updateItemService(cartId, itemId, input) enforces the rules that make the update meaningful and safe:

Cart must exist and be open (404 / 409)
Cart item must exist for that cart (404)
Product still exists and is purchasable (missing/archived → 409)
Inventory must be sufficient (409)

This code lives in src/lib/services/cartsService.ts.

TypeScript

// src/lib/services/cartsService.ts
export async function updateItemService(
  cartId: string,
  itemId: string,
  input: UpdateCartItemInput,
): Promise<ServiceResult<CartItem>> {
  try {
    const cart = await getCartById(cartId);
    const cartResult = ensureCartOpen(cart);
    if (!cartResult.ok) return cartResult;

    const existing = await getCartItemByCartAndId(cartId, itemId);
    if (!existing)
      return fail({
        code: "NOT_FOUND",
        message: "Cart item not found",
        httpStatus: 404,
      });

    const product = await getProductById(existing.product_id);
    if (!product || product.status === "archived")
      return fail({
        code: "CONFLICT",
        message: "Product not available",
        httpStatus: 409,
      });

    if (input.quantity > product.inventory_count) {
      return fail({
        code: "CONFLICT",
        message: "Insufficient inventory",
        httpStatus: 409,
      });
    }

    const updated = await updateCartItemQuantity(
      cartId,
      itemId,
      input.quantity,
    );
    if (!updated)
      return fail({
        code: "NOT_FOUND",
        message: "Cart item not found",
        httpStatus: 404,
      });

    return ok(updated);
  } catch (e: unknown) {
    return handleException(e);
  }
}

// src/lib/services/cartsService.ts
export async function updateItemService(
  cartId: string,
  itemId: string,
  input: UpdateCartItemInput,
): Promise<ServiceResult<CartItem>> {
  try {
    const cart = await getCartById(cartId);
    const cartResult = ensureCartOpen(cart);
    if (!cartResult.ok) return cartResult;

    const existing = await getCartItemByCartAndId(cartId, itemId);
    if (!existing)
      return fail({
        code: "NOT_FOUND",
        message: "Cart item not found",
        httpStatus: 404,
      });

    const product = await getProductById(existing.product_id);
    if (!product || product.status === "archived")
      return fail({
        code: "CONFLICT",
        message: "Product not available",
        httpStatus: 409,
      });

    if (input.quantity > product.inventory_count) {
      return fail({
        code: "CONFLICT",
        message: "Insufficient inventory",
        httpStatus: 409,
      });
    }

    const updated = await updateCartItemQuantity(
      cartId,
      itemId,
      input.quantity,
    );
    if (!updated)
      return fail({
        code: "NOT_FOUND",
        message: "Cart item not found",
        httpStatus: 404,
      });

    return ok(updated);
  } catch (e: unknown) {
    return handleException(e);
  }
}

The call to ensureCartOpen is the gatekeeper for cart lifecycle. A checked-out or abandoned cart is a real cart, but it’s not valid to mutate—so the service returns 409 CONFLICT.
getCartItemByCartAndId(cartId, itemId) ensures the item exists and belongs to the cart. If it’s missing, we return 404, which is the clean “you can’t update what doesn’t exist” outcome.
The product check uses existing.product_id. This is important: the update request doesn’t include a product id, so the service must look up the product through the cart item row.
Missing product or archived product both return 409 here via "Product not available". The cart item exists, but the product is no longer purchasable, so the update would violate business rules.
Inventory enforcement prevents setting a quantity higher than product.inventory_count. That protects checkout logic later and prevents “cart promises more stock than exists.”
The service calls updateCartItemQuantity(...) and still handles the null case. This double-check might seem redundant, but it’s defensive: between the earlier SELECT and the UPDATE, another operation could have deleted the row. The service still responds consistently with 404.

This service method is a good example of why business rules belong above the repository: the repository can update rows, but only the service understands whether an update is allowed.

Service: Deleting an Item Safely

Deleting also needs lifecycle enforcement and “missing item” checks. The service returns { deleted: true } on success, which makes the API response predictable.

This code lives in src/lib/services/cartsService.ts.

TypeScript

// src/lib/services/cartsService.ts
export async function deleteItemService(
  cartId: string,
  itemId: string,
): Promise<ServiceResult<{ deleted: true }>> {
  try {
    const cart = await getCartById(cartId);
    const cartResult = ensureCartOpen(cart);
    if (!cartResult.ok) return cartResult;

    const existing = await getCartItemByCartAndId(cartId, itemId);
    if (!existing)
      return fail({
        code: "NOT_FOUND",
        message: "Cart item not found",
        httpStatus: 404,
      });

    const deleted = await deleteCartItem(cartId, itemId);
    if (!deleted)
      return fail({
        code: "NOT_FOUND",
        message: "Cart item not found",
        httpStatus: 404,
      });

    return ok({ deleted: true });
  } catch (e: unknown) {
    return handleException(e);
  }
}

// src/lib/services/cartsService.ts
export async function deleteItemService(
  cartId: string,
  itemId: string,
): Promise<ServiceResult<{ deleted: true }>> {
  try {
    const cart = await getCartById(cartId);
    const cartResult = ensureCartOpen(cart);
    if (!cartResult.ok) return cartResult;

    const existing = await getCartItemByCartAndId(cartId, itemId);
    if (!existing)
      return fail({
        code: "NOT_FOUND",
        message: "Cart item not found",
        httpStatus: 404,
      });

    const deleted = await deleteCartItem(cartId, itemId);
    if (!deleted)
      return fail({
        code: "NOT_FOUND",
        message: "Cart item not found",
        httpStatus: 404,
      });

    return ok({ deleted: true });
  } catch (e: unknown) {
    return handleException(e);
  }
}

The same cart lifecycle gate (ensureCartOpen) applies here. If the cart is not open, deleting items would break the “checked out cart is immutable” rule, so 409 is returned.
The explicit “does the item exist?” check makes error messages consistent and intentional. It also lets you fail fast before doing a delete operation.
The repository delete returns a boolean, so the service can cleanly map false to 404. This is especially useful for handling concurrency (e.g., two delete requests in a row).
Returning { deleted: true } provides a stable response contract: clients don’t need to interpret an empty response body to know what happened.

Route: PATCH and DELETE /api/carts/:id/items/:itemId

The mutation endpoint for managing line items is:

app/routes/api.carts.$id.items.$itemId.ts

This route validates both IDs, supports PATCH and DELETE, and returns consistent envelopes for every outcome.

Here’s the full route:

// app/routes/api.carts.$id.items.$itemId.ts
import type { ActionFunctionArgs } from "@remix-run/node";
import { success, error, parseJson } from "@/lib/http/response";
import { isUUID } from "@/lib/http/validation";
import {
  updateItemService,
  deleteItemService,
  validateUpdateItem,
} from "@/lib/services/cartsService";

export async function action({ request, params }: ActionFunctionArgs) {
  try {
    const id = params.id ?? "";
    const itemId = params.itemId ?? "";

    if (!isUUID(id) || !isUUID(itemId))
      return error("VALIDATION_ERROR", "Invalid id or itemId", undefined, 400);

    if (request.method === "PATCH") {
      const bodyResult = await parseJson(request);
      if (!bodyResult.ok)
        return error(bodyResult.code, bodyResult.message, undefined, 400);

      const valid = validateUpdateItem(bodyResult.value);
      if (!valid.ok)
        return error("VALIDATION_ERROR", valid.message, undefined, 400);

      const updated = await updateItemService(id, itemId, valid.value);
      if (!updated.ok)
        return error(
          updated.error.code,
          updated.error.message,
          updated.error.details,
          updated.error.httpStatus,
        );

      return success(updated.value);
    }

    if (request.method === "DELETE") {
      const deleted = await deleteItemService(id, itemId);
      if (!deleted.ok)
        return error(
          deleted.error.code,
          deleted.error.message,
          deleted.error.details,
          deleted.error.httpStatus,
        );

      return success(deleted.value);
    }

    return error("VALIDATION_ERROR", "Method not allowed", undefined, 405);
  } catch (e: unknown) {
    return error(
      "INTERNAL_ERROR",
      e instanceof Error ? e.message : "Internal error",
      undefined,
      500,
    );
  }
}

The route validates both params.id and params.itemId with isUUID. If either is invalid, it returns 400 immediately. This prevents ambiguous errors and avoids useless DB queries.
For PATCH, the route does the standard safe-input pipeline:
- parseJson(request) ensures malformed JSON becomes a clean 400.
- validateUpdateItem(...) enforces that only a valid { quantity } shape gets through.
- updateItemService(id, itemId, valid.value) enforces cart, item, product, and inventory rules.
Service failures are mapped using error(code, message, details, httpStatus). The route does not hardcode 500 for expected domain failures; it trusts the service’s httpStatus.
For DELETE, the route calls deleteItemService and forwards structured failures the same way. On success, it returns success({ deleted: true }), matching the service’s stable response contract.
Any other method returns 405 with the same error envelope style, which keeps the API consistent and client-friendly.
The outer try/catch is a final safety net for unexpected exceptions, returning a structured INTERNAL_ERROR instead of leaking unhandled failures.