Terminal · DevReview

TypeScriptmedium⌘↵to review

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47

// UserAuthService.ts
import { Database } from "./db";
import type { User, Credentials, Session } from "./types";

export class UserAuthService {
  constructor(private db: Database) {}

async findByEmail(email: string): Promise<User | null> {
    // line 14 — vulnerable: raw string interpolation into SQL
    const query = "SELECT * FROM users WHERE email = '" + email + "'";
    const rows = await this.db.raw(query);
    return rows[0] ?? null;
  }

async login(creds: Credentials): Promise<Session> {
    const user = await this.findByEmail(creds.email);
    if (!user) throw new AuthError("no such user");
    const ok = await verify(creds.password, user.passwordHash);
    if (!ok) throw new AuthError("bad credentials");
    return this.createSession(user);
  }

async hydrateMany(ids: string[]): Promise<User[]> {
    const out: User[] = [];
    // line 38 — sequential awaits inside a loop
    for (const id of ids) {
      const u = await this.db.users.findById(id);
      if (u) out.push(u);
    }
    return out;
  }

// line 67 — 94-line orchestrator; should be decomposed
  async authenticateAndAuthorize(req: Request): Promise<AuthContext> {
    const token = req.headers.get("authorization")?.replace("Bearer ", "");
    if (!token) throw new AuthError("missing token");
    const claims = await this.verifyToken(token);
    const user = await this.db.users.findById(claims.sub);
    if (!user) throw new AuthError("orphaned token");
    const roles = await this.db.roles.forUser(user.id);
    const perms = roles.flatMap(r => r.permissions);
    const tenant = await this.db.tenants.findById(user.tenantId);
    if (!tenant?.active) throw new AuthError("tenant inactive");
    return { user, tenant, roles, perms, claims };
  }
}

47 lines · 1755 chars

review output

→ Paste a file in the left pane.

→ Press ⌘ Enter to start a review.

→ Output streams here line by line.

→ Nothing is cached — each review runs fresh, so give it a few seconds.

—