Review a pull request: customer API

Not solved

A backend PR adds customer search, bulk export and support password resets. Find every security defect before it merges.

src/routes/customers.js0/4 found

		const express = require('express')
		const { db } = require('../db')
		const { requireAuth, requireRole } = require('../auth')
	+	const { logger } = require('../logger')
	+	const { createClient } = require('../crm')

		const router = express.Router()
	+	const crm = createClient({ apiKey: 'crm_live_51Hx9QeT0aBcD7fGhJkL' })

		router.get('/customers/search', requireAuth, async (req, res) => {
	+	const q = req.query.q
	+	const rows = await db.query(`SELECT id, name, email FROM customers WHERE name LIKE '%${q}%'`)
	+	res.json(rows)
		})

	+	router.get('/customers/export', async (req, res) => {
	+	const rows = await db.query('SELECT * FROM customers')
	+	res.setHeader('Content-Type', 'text/csv')
	+	res.send(toCsv(rows))
	+	})

		router.post('/customers/:id/password', requireAuth, requireRole('support'), async (req, res) => {
	+	logger.info(`support reset for ${req.params.id} new=${req.body.password}`)
	+	await db.setPassword(req.params.id, req.body.password)
	+	res.status(204).end()
		})

28	−	module.exports = router
	+	module.exports = { router }

Click a line number to flag a defect. The review code appears when every defect is flagged with no false positives.