A candidate submitted this checkout function. Ask them to explain it.
Answer it out loud before you open anything. The value of the flags below is in comparing them to what you actually said — including whether you asked who uses it before naming what you would build it with.
A take-home submission for the online store includes a processCheckout function that is clean, commented and passes the provided tests. In the follow-up call the candidate cannot say what one of the branches does or why a particular lock is taken. They admit an AI assistant wrote most of it. The interviewer asks how you assess this.
React to this
Say what you would question, what you would keep, and what you would need to know first.
Excerpt from the submission (illustrative):
async function processCheckout(cart, user, paymentMethod) {
// Acquire a distributed lock on the user to prevent concurrent checkouts
const lock = await redlock.acquire([`user:${user.id}`], 5000);
try {
const order = await createOrder(cart, user);
if (order.currency !== paymentMethod.currency) {
order.total = await convertCurrency(order.total, order.currency, paymentMethod.currency);
}
const result = await paymentGateway.charge(order.total, paymentMethod, { retries: 3 });
if (result.status === 'succeeded') {
await markOrderPaid(order.id);
await sendConfirmationEmail(user, order);
} else {
await cancelOrder(order.id);
}
return result;
} finally {
await lock.release();
}
}
Candidate, in the call: "I think the lock is for race conditions. The
currency thing — I'm not sure, it was in the generated version. The
retries are a best practice."What it is really testing
Whether the candidate holds the line that understanding is not delegable — the tool may write code, the engineer owns it — and can say what "owning" means concretely: being able to explain every branch, predict the behaviour on a failure, and change it safely. Also whether they can say how to use the tool well, rather than banning it.