Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions app.js
Original file line number Diff line number Diff line change
@@ -1,5 +1,7 @@
const express = require('express');
const tasksRouter = require('./routes/tasks');
const categoriesRouter = require('./routes/categories');
const notesRouter = require('./routes/notes');

const app = express();
const PORT = process.env.PORT || 3000;
Expand All @@ -11,6 +13,8 @@ app.get('/health', (req, res) => {
});

app.use('/tasks', tasksRouter);
app.use('/categories', categoriesRouter);
app.use('/notes', notesRouter);

app.listen(PORT, () => {
console.log(`Server running on port ${PORT}`);
Expand Down
58 changes: 58 additions & 0 deletions routes/categories.js
Original file line number Diff line number Diff line change
@@ -0,0 +1,58 @@
var express = require('express');

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 [MEDIUM] style: Use const or let instead of var

The use of var is discouraged by review-rules.md. Please use const for variables that are not reassigned and let for those that are. This applies to multiple declarations in this file.

Suggestion:

Suggested change
var express = require('express');
const express = require('express');

var router = express.Router();

var categories = [];
var nextId = 1;

// get all categories
router.get('/', function(req, res) {

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 [HIGH] quality: Missing error handling in GET /categories route

The route handler for GET /categories lacks try/catch blocks or proper error middleware integration, violating review-rules.md. Unhandled exceptions could crash the application or expose sensitive information.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 [MEDIUM] architecture: Missing pagination for list endpoint

The GET /categories endpoint does not support pagination with page and limit query parameters, violating review-rules.md. This can lead to performance issues with large datasets and poor user experience.

res.json(categories);
});

// get single category

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 [HIGH] quality: Missing error handling in GET /categories/:id route

The route handler for GET /categories/:id lacks try/catch blocks or proper error middleware integration, violating review-rules.md. Unhandled exceptions could crash the application or expose sensitive information.

router.get('/:id', function(req, res) {

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 [MEDIUM] correctness: Use strict equality === instead of ==

Using == can lead to unexpected type coercion issues. It's best practice to use === for robust comparisons to avoid subtle bugs.

Suggestion:

Suggested change
router.get('/:id', function(req, res) {
var category = categories.find(function(c) { return c.id === req.params.id; });

var category = categories.find(function(c) { return c.id == req.params.id; });
if (!category) {
res.status(404).json({ message: 'not found' });
return;
}
res.json(category);
});

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 [HIGH] security: Missing authentication on POST endpoint

All API endpoints that modify data must require authentication, as per security.md. The POST /categories endpoint currently allows unauthenticated creation of resources, posing a significant security risk.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 [HIGH] quality: Missing error handling in POST /categories route

The route handler for POST /categories lacks try/catch blocks or proper error middleware integration, violating review-rules.md. Unhandled exceptions could crash the application or expose sensitive information.


// create category

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 [HIGH] security: Missing input validation and sanitization for category creation

User input for name, description, and color is used directly without validation or sanitization. This violates review-rules.md and api-patterns.md, creating potential for injection attacks, XSS, or malformed data.

router.post('/', function(req, res) {
var category = {
id: nextId++,
name: req.body.name,
description: req.body.description,
color: req.body.color
};
categories.push(category);
res.json(category);
});

// update category
router.patch('/:id', function(req, res) {
var category = categories.find(function(c) { return c.id == req.params.id; });
if (!category) {

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 [HIGH] security: Missing authentication on PATCH endpoint

All API endpoints that modify data must require authentication, as per security.md. The PATCH /categories/:id endpoint currently allows unauthenticated modification of resources, posing a significant security risk.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 [HIGH] quality: Missing error handling in PATCH /categories/:id route

The route handler for PATCH /categories/:id lacks try/catch blocks or proper error middleware integration, violating review-rules.md. Unhandled exceptions could crash the application or expose sensitive information.

res.status(404).json({ message: 'not found' });
return;
}
if (req.body.name) category.name = req.body.name;

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 [HIGH] security: Missing input validation and sanitization for category update

User input for name, description, and color is used directly without validation or sanitization. This violates review-rules.md and api-patterns.md, creating potential for injection attacks, XSS, or malformed data.

if (req.body.description) category.description = req.body.description;
if (req.body.color) category.color = req.body.color;
res.json(category);
});

// delete category
router.delete('/:id', function(req, res) {
var index = categories.findIndex(function(c) { return c.id == req.params.id; });
if (index === -1) {
res.status(404).json({ message: 'not found' });
return;

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 [HIGH] security: Missing authentication on DELETE endpoint

All API endpoints that modify data must require authentication, as per security.md. The DELETE /categories/:id endpoint currently allows unauthenticated deletion of resources, posing a significant security risk.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 [HIGH] quality: Missing error handling in DELETE /categories/:id route

The route handler for DELETE /categories/:id lacks try/catch blocks or proper error middleware integration, violating review-rules.md. Unhandled exceptions could crash the application or expose sensitive information.

}
categories.splice(index, 1);
res.json({ message: 'deleted' });
});

module.exports = router;
Loading