Open
Conversation
…batches for clubs
…batches for clubs
|
@codewkaushik404 is attempting to deploy a commit to the openlake's projects Team on Vercel. A member of the Team first needs to authorize it. |
Contributor
WalkthroughThe pull request transitions from local Passport authentication to JWT-based authentication, removes legacy passport-local dependencies, rewrites the user schema with automatic timestamps and conditional password validation, introduces certificate batch creation functionality with validation, and updates all route imports to use named exports for authentication middleware. Changes
Sequence DiagramssequenceDiagram
participant Client
participant AuthRoute as Auth Route
participant AuthValidate as Auth Validator
participant User as User Model
participant Bcrypt
participant JWT as JWT Sign
participant Cookie as Cookie
Client->>AuthRoute: POST /login {username, password}
AuthRoute->>AuthValidate: Validate input
AuthValidate-->>AuthRoute: ✓ Valid
AuthRoute->>User: Find user by username
User-->>AuthRoute: User found
AuthRoute->>Bcrypt: Compare password hash
Bcrypt-->>AuthRoute: ✓ Match
AuthRoute->>JWT: Sign token {user_id, role}
JWT-->>AuthRoute: Signed JWT (1hr expiry)
AuthRoute->>Cookie: Set httpOnly cookie
AuthRoute-->>Client: {success: true, token}
sequenceDiagram
participant Client
participant CertRoute as Certificate Route
participant JWTAuth as JWT Middleware
participant CreateBatch as createBatch Controller
participant BatchValidate as Batch Validator
participant User as User Model
participant OrgUnit as Org Unit Model
participant Approver as Approver Lookup
participant CertBatch as Certificate Batch Model
Client->>CertRoute: POST /api/certificate-batches {Authorization header}
CertRoute->>JWTAuth: Validate Bearer token
JWTAuth-->>CertRoute: ✓ Decoded user
CreateBatch->>User: Verify user exists & is CLUB_COORDINATOR
User-->>CreateBatch: ✓ User + position
CreateBatch->>BatchValidate: Validate batch payload
BatchValidate-->>CreateBatch: ✓ Valid data
CreateBatch->>OrgUnit: Verify target unit is Club
OrgUnit-->>CreateBatch: ✓ Club + Council
CreateBatch->>Approver: Resolve approvers from Council
Approver-->>CreateBatch: General Secretary & President
CreateBatch->>User: Verify all batch users exist
User-->>CreateBatch: ✓ User IDs valid
CreateBatch->>CertBatch: Create CertificateBatch record
CertBatch-->>CreateBatch: ✓ Batch created
CreateBatch-->>Client: {success: true, batch details}
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 11
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (4)
backend/config/db.js (1)
7-13:⚠️ Potential issue | 🟠 MajorFail fast when
MONGODB_URIis missing or connect fails.Right now the server can keep running without a DB connection, which will surface as confusing runtime errors later. Guard the env var and rethrow to halt startup on failure.
🔧 Proposed fix
const connectDB = async () => { try { const ConnectDB = process.env.MONGODB_URI; + if (!ConnectDB) { + throw new Error("MONGODB_URI is not set"); + } //Removing the options as they are no longer needed from mongoose6+ await mongoose.connect(ConnectDB); console.log("MongoDB Connected"); } catch (error) { console.error("MongoDB Connection Error:", error); + throw error; } };backend/routes/profile.js (3)
9-31:⚠️ Potential issue | 🟠 MajorEnforce ownership/role checks for
ID_No-based updates.
ID_Nocomes from the request body, so any authenticated user could update someone else’s photo unless you verify ownership or privileged roles. This is a horizontal privilege escalation risk.
Consider usingreq.useras the source of truth (or allow overrides only for explicit roles).🔒 Suggested guard (adjust role/field names to your auth model)
- const { ID_No } = req.body; + const { ID_No } = req.body; if (!ID_No) { return res.status(400).json({ error: "ID_No is required" }); } + if (req.user?.user_id !== ID_No) { + return res.status(403).json({ error: "Forbidden" }); + }
106-111:⚠️ Potential issue | 🟠 MajorRemove debug logs that include user data.
userIdandupdatedDetailscan contain PII (email, phone, DOB, etc.). Logging these in production is a compliance/privacy risk.🧹 Suggested removal
- console.log("Received userId:", userId); - console.log("Received updatedDetails:", updatedDetails);
219-220:⚠️ Potential issue | 🟡 MinorRemove manual
updated_atassignment; it's redundant with Mongoose timestamps.The schema uses
{ timestamps: true }, which automatically manages theupdatedAtfield (camelCase). Manually settingupdated_at(snake_case) is ignored under strict mode (the default) and doesn't serve any purpose.🧽 Suggested cleanup
- // Update the updated_at timestamp - user.updated_at = new Date();
🤖 Fix all issues with AI agents
In `@backend/controllers/certificateController.js`:
- Around line 14-16: There's a typo in the error JSON returned when a user isn't
found: the key is "messge" instead of "message"; update the response in the
controller (the block that checks `if (!user) { return
res.status(404).json({...}) }`) to use `message: "Invalid data (User not
found)"` so the client receives the correct key (look for the `user` variable
and the `res.status(404).json` call in certificateController.js).
- Around line 18-22: Update the role guard to require an explicit
CLUB_COORDINATOR role instead of allowing missing roles: replace the current
conditional that only checks user.role !== "CLUB_COORDINATOR" with a strict
check that returns 403 when user.role is falsy or not exactly "CLUB_COORDINATOR"
(i.e., if (!user.role || user.role !== "CLUB_COORDINATOR") return
res.status(403).json(...)); locate and change the check around the user.role
validation in certificateController.js where the current guard is implemented.
- Around line 39-116: The code dereferences and logs lookup results before null
checks (e.g., positionHolder, position, gensecObj, presidentHolder,
presidentObj), which can throw if a record is missing; move all console.log
calls until after the corresponding existence checks and add explicit guards for
presidentHolder and presidentObj (returning the proper error responses like the
existing patterns) after PositionHolder.findOne, Position.findById, User.findOne
(gensecObj), Position.findOne (presidentPosition), PositionHolder.findOne
(presidentHolder) and User.findById (presidentId) to ensure no property is
accessed on null/undefined.
- Around line 121-126: The check after calling zodObjectId.safeParse in the
users.map Promise (used to build userChecks) is incorrect because safeParse
always returns an object; change the conditional to check validation.success
(e.g., if (!validation.success)) and return the invalid response when success is
false; update any later uses that rely on validation.data to use validation.data
only when validation.success is true (inside the branch where the ID is valid).
In `@backend/middlewares/isAuthenticated.js`:
- Around line 13-28: In jwtIsAuthenticated, ensure process.env.JWT_SECRET_TOKEN
is present and return res.status(500).json({ message: "Server misconfiguration:
JWT secret missing" }) if not; when calling jwt.verify(token,
process.env.JWT_SECRET_TOKEN) pass an explicit algorithms allow-list (e.g.
algorithms: ['HS256']) to prevent algorithm downgrade attacks, assign the
verified payload to req.user as before, and keep the existing catch to return
401 for invalid/expired tokens.
In `@backend/models/certificateSchema.js`:
- Around line 62-66: The certificateId field is marked unique which causes
duplicate-key errors for multiple non-approved docs; remove the unique: true
from the certificateId field in the certificateSchema and instead add a partial
unique index on certificateId that only applies when status === "Approved"
(ensure the index also requires certificateId exists). Locate the schema
definition (certificateId in certificateSchema / CertificateSchema) and replace
the field-level unique constraint with a schema-level index using
partialFilterExpression for status:"Approved" (and certificateId existence) so
only approved documents enforce uniqueness.
- Around line 6-9: The ref name for the unit_id schema field is misspelled as
"Oraganizational_Unit"; update the unit_id field's ref to the correctly
registered model name "Organizational_Unit" so mongoose.populate() resolves
properly (locate the unit_id definition in the certificate schema and replace
the ref string).
In `@backend/routes/auth.js`:
- Around line 45-51: Replace incorrect res.json(401).json(...) calls with
res.status(401).json(...) in the auth route handler(s) where authentication
fails (the checks using bcrypt.compare and the earlier invalid-credentials
check), and make the same change for the other occurrence around the second
failure block (the one referenced at lines 89-92); update the two places that
call res.json(401).json to use res.status(401).json to set the HTTP status
correctly and avoid double-sending headers.
In `@backend/routes/feedbackRoutes.js`:
- Around line 189-212: The route currently trusts req.body.resolved_by which
allows spoofing; instead ignore the body field and derive the resolver from the
authenticated user (req.user). In the feedback resolution handler (where
feedbackId, actions_taken, resolved_by are read and Feedback.findById is
called), remove usage of req.body.resolved_by and set feedback.resolved_by =
req.user.id or req.user.email (whichever is the canonical identifier in your
auth model) after verifying req.user exists; keep validation for actions_taken
and the rest of the update logic, and ensure the API does not accept or persist
a client-supplied resolved_by.
In `@backend/routes/profile.js`:
- Around line 80-90: The code in the router.delete("/photo-delete",
isAuthenticated, async (req, res) => { ... }) handler calls user.findOne(...)
but `user` is undefined; update the handler to use the correct User model
reference (e.g., `User.findOne(...)`) and ensure the model is imported/required
at the top (or rename the local variable to avoid shadowing, e.g., `const
foundUser = await User.findOne({ user_id: ID_No })`), then update subsequent
references to use that variable (`foundUser`) instead of the undefined `user`.
In `@backend/utils/batchValidate.js`:
- Around line 3-10: The zodObjectId regex is too permissive (allows non-hex
chars); update the zodObjectId used by validateBatchSchema to enforce hex-only
ObjectIds by replacing the pattern with a hex-only regex (e.g.,
/^[0-9a-fA-F]{24}$/) so zodObjectId = zod.string().regex(...); ensure the same
updated zodObjectId is used in validateBatchSchema for unit_id and users array
elements.
🧹 Nitpick comments (1)
backend/package.json (1)
33-58: Verified: bcrypt, cookie-parser, and zod versions are secure and current.All three packages check out—bcrypt 6.0.0 has no known advisories (prior CVEs fixed in 5.0.0+), cookie-parser 1.4.7 has no direct vulnerabilities, and zod 4.3.6 is the current latest stable release.
However, I notice express-rate-limiter@1.3.1 is also in the dependencies. This package is effectively unmaintained (~10 years old) and, while no CVEs are recorded, poses a supply chain risk. If it's unused, remove it; if actively used, consider migrating to express-rate-limit (the maintained alternative, already in your dependencies at 7.5.1) which has recent security hardening.
Comment on lines
+14
to
+16
| if (!user) { | ||
| return res.status(404).json({ messge: "Invalid data (User not found)" }); | ||
| } |
Contributor
There was a problem hiding this comment.
Typo in error response key.
messge should be message.
💡 Suggested fix
- return res.status(404).json({ messge: "Invalid data (User not found)" });
+ return res.status(404).json({ message: "Invalid data (User not found)" });📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| if (!user) { | |
| return res.status(404).json({ messge: "Invalid data (User not found)" }); | |
| } | |
| if (!user) { | |
| return res.status(404).json({ message: "Invalid data (User not found)" }); | |
| } |
🤖 Prompt for AI Agents
In `@backend/controllers/certificateController.js` around lines 14 - 16, There's a
typo in the error JSON returned when a user isn't found: the key is "messge"
instead of "message"; update the response in the controller (the block that
checks `if (!user) { return res.status(404).json({...}) }`) to use `message:
"Invalid data (User not found)"` so the client receives the correct key (look
for the `user` variable and the `res.status(404).json` call in
certificateController.js).
Comment on lines
+18
to
+22
| if (user.role && user.role !== "CLUB_COORDINATOR") { | ||
| return res | ||
| .status(403) | ||
| .json({ message: "Not authorized to perform the task" }); | ||
| } |
Contributor
There was a problem hiding this comment.
Require explicit CLUB_COORDINATOR role.
The current guard allows users with a missing role to proceed. Enforce a strict role check to avoid accidental privilege bypass.
💡 Suggested fix
- if (user.role && user.role !== "CLUB_COORDINATOR") {
+ if (user.role !== "CLUB_COORDINATOR") {
return res
.status(403)
.json({ message: "Not authorized to perform the task" });
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| if (user.role && user.role !== "CLUB_COORDINATOR") { | |
| return res | |
| .status(403) | |
| .json({ message: "Not authorized to perform the task" }); | |
| } | |
| if (user.role !== "CLUB_COORDINATOR") { | |
| return res | |
| .status(403) | |
| .json({ message: "Not authorized to perform the task" }); | |
| } |
🤖 Prompt for AI Agents
In `@backend/controllers/certificateController.js` around lines 18 - 22, Update
the role guard to require an explicit CLUB_COORDINATOR role instead of allowing
missing roles: replace the current conditional that only checks user.role !==
"CLUB_COORDINATOR" with a strict check that returns 403 when user.role is falsy
or not exactly "CLUB_COORDINATOR" (i.e., if (!user.role || user.role !==
"CLUB_COORDINATOR") return res.status(403).json(...)); locate and change the
check around the user.role validation in certificateController.js where the
current guard is implemented.
Comment on lines
+39
to
+116
| console.log(id); | ||
| // Get coordinator's position and unit | ||
| const positionHolder = await PositionHolder.findOne({ user_id: id }); | ||
| console.log(positionHolder._id); | ||
| if (!positionHolder) { | ||
| return res | ||
| .status(403) | ||
| .json({ message: "You are not part of any position in a unit" }); | ||
| } | ||
|
|
||
| const position = await Position.findById(positionHolder.position_id); | ||
| console.log(position._id); | ||
| if (!position) { | ||
| return res.status(403).json({ message: "Your position is invalid" }); | ||
| } | ||
|
|
||
| const userUnitId = position.unit_id.toString(); | ||
| if (userUnitId !== unit_id) { | ||
| return res | ||
| .status(403) | ||
| .json({ | ||
| message: | ||
| "You are not authorized to initiate batches outside of your club", | ||
| }); | ||
| } | ||
|
|
||
| //const clubId = unit_id; | ||
| // Ensure unit_id is a Club | ||
| const unitObj = await OrganizationalUnit.findById(unit_id); | ||
| if (!unitObj || unitObj.type !== "Club") { | ||
| return res | ||
| .status(403) | ||
| .json({ message: "Invalid Data: unit is not a Club" }); | ||
| } | ||
| console.log(unitObj._id); | ||
|
|
||
| // Get council (parent unit) and ensure it's a Council | ||
| if (!unitObj.parent_unit_id) { | ||
| return res | ||
| .status(403) | ||
| .json({ message: "Invalid Data: club does not belong to a council" }); | ||
| } | ||
| console.log(unitObj.parent_unit_id); | ||
|
|
||
| const councilObj = await OrganizationalUnit.findById(unitObj.parent_unit_id); | ||
| if (!councilObj || councilObj.type !== "Council") { | ||
| return res.status(403).json({ message: "Invalid Data: council not found" }); | ||
| } | ||
|
|
||
| //const councilId = councilObj._id.toString(); | ||
| const presidentOrgUnitId = councilObj.parent_unit_id; | ||
| const category = councilObj.category.toUpperCase(); | ||
|
|
||
| // Resolve General Secretary and President for the council (server-side, tamper-proof) | ||
| const gensecObj = await User.findOne({ role: `GENSEC_${category}` }); | ||
| console.log(gensecObj._id); | ||
|
|
||
| const presidentPosition = await Position.findOne({ | ||
| unit_id: presidentOrgUnitId, | ||
| title: /president/i, | ||
| }); | ||
| if (!presidentPosition) { | ||
| return res | ||
| .status(500) | ||
| .json({ message: "President position not found for council" }); | ||
| } | ||
| console.log(presidentPosition._id); | ||
|
|
||
| const presidentHolder = await PositionHolder.findOne({ | ||
| position_id: presidentPosition._id, | ||
| }); | ||
| const presidentId = presidentHolder.user_id.toString(); | ||
| console.log(presidentId); | ||
| const presidentObj = await User.findById(presidentId); | ||
|
|
||
| console.log(presidentObj._id); | ||
| if (!gensecObj || !presidentObj) { | ||
| return res.status(500).json({ message: "Approvers not found" }); |
Contributor
There was a problem hiding this comment.
Guard nulls before dereferencing lookup results.
Several lookups are logged/dereferenced before null checks (positionHolder, position, gensecObj, presidentHolder/Obj). A missing record will throw and bypass the intended error response. Move logs after checks and add a guard for presidentHolder.
💡 Suggested fix
- console.log(id);
- const positionHolder = await PositionHolder.findOne({ user_id: id });
- console.log(positionHolder._id);
- if (!positionHolder) {
+ const positionHolder = await PositionHolder.findOne({ user_id: id });
+ if (!positionHolder) {
return res
.status(403)
.json({ message: "You are not part of any position in a unit" });
}
+ console.log(positionHolder._id);
- const position = await Position.findById(positionHolder.position_id);
- console.log(position._id);
- if (!position) {
+ const position = await Position.findById(positionHolder.position_id);
+ if (!position) {
return res.status(403).json({ message: "Your position is invalid" });
}
+ console.log(position._id);
- const gensecObj = await User.findOne({ role: `GENSEC_${category}` });
- console.log(gensecObj._id);
+ const gensecObj = await User.findOne({ role: `GENSEC_${category}` });
+ if (!gensecObj) {
+ return res.status(500).json({ message: "Approvers not found" });
+ }
+ console.log(gensecObj._id);
const presidentPosition = await Position.findOne({
unit_id: presidentOrgUnitId,
title: /president/i,
});
if (!presidentPosition) {
return res
.status(500)
.json({ message: "President position not found for council" });
}
console.log(presidentPosition._id);
const presidentHolder = await PositionHolder.findOne({
position_id: presidentPosition._id,
});
+ if (!presidentHolder) {
+ return res
+ .status(500)
+ .json({ message: "President position holder not found" });
+ }
const presidentId = presidentHolder.user_id.toString();
console.log(presidentId);
const presidentObj = await User.findById(presidentId);
- console.log(presidentObj._id);
- if (!gensecObj || !presidentObj) {
+ if (!presidentObj) {
return res.status(500).json({ message: "Approvers not found" });
}
+ console.log(presidentObj._id);📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| console.log(id); | |
| // Get coordinator's position and unit | |
| const positionHolder = await PositionHolder.findOne({ user_id: id }); | |
| console.log(positionHolder._id); | |
| if (!positionHolder) { | |
| return res | |
| .status(403) | |
| .json({ message: "You are not part of any position in a unit" }); | |
| } | |
| const position = await Position.findById(positionHolder.position_id); | |
| console.log(position._id); | |
| if (!position) { | |
| return res.status(403).json({ message: "Your position is invalid" }); | |
| } | |
| const userUnitId = position.unit_id.toString(); | |
| if (userUnitId !== unit_id) { | |
| return res | |
| .status(403) | |
| .json({ | |
| message: | |
| "You are not authorized to initiate batches outside of your club", | |
| }); | |
| } | |
| //const clubId = unit_id; | |
| // Ensure unit_id is a Club | |
| const unitObj = await OrganizationalUnit.findById(unit_id); | |
| if (!unitObj || unitObj.type !== "Club") { | |
| return res | |
| .status(403) | |
| .json({ message: "Invalid Data: unit is not a Club" }); | |
| } | |
| console.log(unitObj._id); | |
| // Get council (parent unit) and ensure it's a Council | |
| if (!unitObj.parent_unit_id) { | |
| return res | |
| .status(403) | |
| .json({ message: "Invalid Data: club does not belong to a council" }); | |
| } | |
| console.log(unitObj.parent_unit_id); | |
| const councilObj = await OrganizationalUnit.findById(unitObj.parent_unit_id); | |
| if (!councilObj || councilObj.type !== "Council") { | |
| return res.status(403).json({ message: "Invalid Data: council not found" }); | |
| } | |
| //const councilId = councilObj._id.toString(); | |
| const presidentOrgUnitId = councilObj.parent_unit_id; | |
| const category = councilObj.category.toUpperCase(); | |
| // Resolve General Secretary and President for the council (server-side, tamper-proof) | |
| const gensecObj = await User.findOne({ role: `GENSEC_${category}` }); | |
| console.log(gensecObj._id); | |
| const presidentPosition = await Position.findOne({ | |
| unit_id: presidentOrgUnitId, | |
| title: /president/i, | |
| }); | |
| if (!presidentPosition) { | |
| return res | |
| .status(500) | |
| .json({ message: "President position not found for council" }); | |
| } | |
| console.log(presidentPosition._id); | |
| const presidentHolder = await PositionHolder.findOne({ | |
| position_id: presidentPosition._id, | |
| }); | |
| const presidentId = presidentHolder.user_id.toString(); | |
| console.log(presidentId); | |
| const presidentObj = await User.findById(presidentId); | |
| console.log(presidentObj._id); | |
| if (!gensecObj || !presidentObj) { | |
| return res.status(500).json({ message: "Approvers not found" }); | |
| // Get coordinator's position and unit | |
| const positionHolder = await PositionHolder.findOne({ user_id: id }); | |
| if (!positionHolder) { | |
| return res | |
| .status(403) | |
| .json({ message: "You are not part of any position in a unit" }); | |
| } | |
| console.log(positionHolder._id); | |
| const position = await Position.findById(positionHolder.position_id); | |
| if (!position) { | |
| return res.status(403).json({ message: "Your position is invalid" }); | |
| } | |
| console.log(position._id); | |
| const userUnitId = position.unit_id.toString(); | |
| if (userUnitId !== unit_id) { | |
| return res | |
| .status(403) | |
| .json({ | |
| message: | |
| "You are not authorized to initiate batches outside of your club", | |
| }); | |
| } | |
| //const clubId = unit_id; | |
| // Ensure unit_id is a Club | |
| const unitObj = await OrganizationalUnit.findById(unit_id); | |
| if (!unitObj || unitObj.type !== "Club") { | |
| return res | |
| .status(403) | |
| .json({ message: "Invalid Data: unit is not a Club" }); | |
| } | |
| console.log(unitObj._id); | |
| // Get council (parent unit) and ensure it's a Council | |
| if (!unitObj.parent_unit_id) { | |
| return res | |
| .status(403) | |
| .json({ message: "Invalid Data: club does not belong to a council" }); | |
| } | |
| console.log(unitObj.parent_unit_id); | |
| const councilObj = await OrganizationalUnit.findById(unitObj.parent_unit_id); | |
| if (!councilObj || councilObj.type !== "Council") { | |
| return res.status(403).json({ message: "Invalid Data: council not found" }); | |
| } | |
| //const councilId = councilObj._id.toString(); | |
| const presidentOrgUnitId = councilObj.parent_unit_id; | |
| const category = councilObj.category.toUpperCase(); | |
| // Resolve General Secretary and President for the council (server-side, tamper-proof) | |
| const gensecObj = await User.findOne({ role: `GENSEC_${category}` }); | |
| if (!gensecObj) { | |
| return res.status(500).json({ message: "Approvers not found" }); | |
| } | |
| console.log(gensecObj._id); | |
| const presidentPosition = await Position.findOne({ | |
| unit_id: presidentOrgUnitId, | |
| title: /president/i, | |
| }); | |
| if (!presidentPosition) { | |
| return res | |
| .status(500) | |
| .json({ message: "President position not found for council" }); | |
| } | |
| console.log(presidentPosition._id); | |
| const presidentHolder = await PositionHolder.findOne({ | |
| position_id: presidentPosition._id, | |
| }); | |
| if (!presidentHolder) { | |
| return res | |
| .status(500) | |
| .json({ message: "President position holder not found" }); | |
| } | |
| const presidentId = presidentHolder.user_id.toString(); | |
| console.log(presidentId); | |
| const presidentObj = await User.findById(presidentId); | |
| if (!presidentObj) { | |
| return res.status(500).json({ message: "Approvers not found" }); | |
| } | |
| console.log(presidentObj._id); |
🤖 Prompt for AI Agents
In `@backend/controllers/certificateController.js` around lines 39 - 116, The code
dereferences and logs lookup results before null checks (e.g., positionHolder,
position, gensecObj, presidentHolder, presidentObj), which can throw if a record
is missing; move all console.log calls until after the corresponding existence
checks and add explicit guards for presidentHolder and presidentObj (returning
the proper error responses like the existing patterns) after
PositionHolder.findOne, Position.findById, User.findOne (gensecObj),
Position.findOne (presidentPosition), PositionHolder.findOne (presidentHolder)
and User.findById (presidentId) to ensure no property is accessed on
null/undefined.
Comment on lines
+121
to
+126
| const userChecks = await Promise.all( | ||
| users.map(async (uid) => { | ||
| const validation = zodObjectId.safeParse(uid); | ||
| if (!validation) { | ||
| return { uid, ok: false, reason: "Invalid ID" }; | ||
| } |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
find . -type f -name "certificateController.js" | head -5Repository: OpenLake/Student_Database_COSA
Length of output: 307
🌐 Web query:
Zod safeParse return value structure success
💡 Result:
z.safeParse(value) returns a discriminated union keyed by success:
- Success case:
{ success: true; data: T } - Failure case:
{ success: false; error: ZodError }
So you typically do:
const result = schema.safeParse(input);
if (result.success) {
result.data; // typed as T
} else {
result.error; // ZodError
}Sources: Zod docs / method signatures show this exact return shape and that it’s a discriminated union. [1] [2]
Fix zodObjectId.safeParse result check.
safeParse returns { success: boolean, data?: T, error?: ZodError }; if (!validation) never triggers because safeParse always returns an object (truthy), so invalid IDs slip through and can cause cast errors. Check !validation.success instead.
💡 Suggested fix
const validation = zodObjectId.safeParse(uid);
- if (!validation) {
+ if (!validation.success) {
return { uid, ok: false, reason: "Invalid ID" };
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| const userChecks = await Promise.all( | |
| users.map(async (uid) => { | |
| const validation = zodObjectId.safeParse(uid); | |
| if (!validation) { | |
| return { uid, ok: false, reason: "Invalid ID" }; | |
| } | |
| const userChecks = await Promise.all( | |
| users.map(async (uid) => { | |
| const validation = zodObjectId.safeParse(uid); | |
| if (!validation.success) { | |
| return { uid, ok: false, reason: "Invalid ID" }; | |
| } |
🤖 Prompt for AI Agents
In `@backend/controllers/certificateController.js` around lines 121 - 126, The
check after calling zodObjectId.safeParse in the users.map Promise (used to
build userChecks) is incorrect because safeParse always returns an object;
change the conditional to check validation.success (e.g., if
(!validation.success)) and return the invalid response when success is false;
update any later uses that rely on validation.data to use validation.data only
when validation.success is true (inside the branch where the ID is valid).
Comment on lines
+13
to
+28
| function jwtIsAuthenticated(req, res, next) { | ||
| let token; | ||
| const headerData = req.headers.authorization; | ||
| if (!headerData || !headerData.startsWith("Bearer ")) { | ||
| return res.status(401).json({ message: "User not authenticated " }); | ||
| } | ||
|
|
||
| token = headerData.split(" ")[1]; | ||
| try { | ||
| const userData = jwt.verify(token, process.env.JWT_SECRET_TOKEN); | ||
| req.user = userData; | ||
| //console.log(userData); | ||
| next(); | ||
| } catch (err) { | ||
| res.status(401).json({ message: "Invalid or expired token sent" }); | ||
| } |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat package.json | grep -A 5 -B 5 jsonwebtokenRepository: OpenLake/Student_Database_COSA
Length of output: 118
🌐 Web query:
jsonwebtoken npm library algorithms option security best practices
💡 Result:
jsonwebtoken (npm i jsonwebtoken) — algorithms option security best practices
- Pin/upgrade to v9+ and keep it updated. Versions
<= 8.5.1had a verification-bypass issue whenverify()was called without analgorithmsallow-list and with a falsy key, causing a dangerous default tonone(fixed in9.0.0). [1][2] - Always pass an explicit
algorithmsallow-list tojwt.verify()(don’t rely on defaults). Example: allow only what you actually issue. [3] - Never allow
nonein production. In v9, accepting unsigned tokens requires explicitly allowingnoneviaoptions.algorithms—don’t do this unless you have a very specific, safe use case. [4] - Don’t mix symmetric and asymmetric algorithms (e.g., don’t accept both
HS256andRS256for the same verifier). This helps avoid “algorithm confusion/downgrade” classes of mistakes. [5] - Prefer asymmetric signing (e.g.,
RS256/ES256) for most real systems, especially when multiple services verify tokens or key rotation matters. Auth0 (and many deployments) recommendRS256overHS256because verifiers only need a public key, and rotation is easier. [6] - Validate claims, not just the signature: set
issuerandaudience(and use expiration). This reduces token replay/misuse across services. [5] - Use
verify(), notdecode(), for untrusted tokens.decode()does not validate signatures/claims; treat decoded payload as untrusted input unless verified. [7]
Minimal safe verification pattern
import jwt from "jsonwebtoken";
const payload = jwt.verify(token, publicKeyPem, {
algorithms: ["RS256"], // strict allow-list
issuer: "https://issuer.example",
audience: "my-api",
// optionally: maxAge: "15m"
});Sources: GitHub Security Advisory + NVD for CVE-2022-23540 [1][2]; jsonwebtoken npm docs on algorithms option/defaults [3]; v8→v9 migration note on explicitly allowing none [4]; express-jwt guidance on required algorithms and not mixing HS/RS + issuer/audience [5]; Auth0 guidance recommending RS256 [6]; Auth0 JWT validation note to use verify() (not decode()) and disallow none [7].
🏁 Script executed:
find . -name "package.json" -type f | head -20Repository: OpenLake/Student_Database_COSA
Length of output: 120
🏁 Script executed:
rg "jwt\." --type js -A 2 -B 2 | head -100Repository: OpenLake/Student_Database_COSA
Length of output: 1563
🏁 Script executed:
rg "JWT_SECRET_TOKEN" --type js -A 3 -B 3Repository: OpenLake/Student_Database_COSA
Length of output: 2072
🏁 Script executed:
cat backend/package.json | jq '.dependencies.jsonwebtoken, .devDependencies.jsonwebtoken'Repository: OpenLake/Student_Database_COSA
Length of output: 87
🏁 Script executed:
cat -n backend/middlewares/isAuthenticated.jsRepository: OpenLake/Student_Database_COSA
Length of output: 2711
🏁 Script executed:
cat -n backend/routes/auth.js | grep -A 10 -B 5 "jwt.sign\|jwt.verify"Repository: OpenLake/Student_Database_COSA
Length of output: 2473
Explicitly restrict JWT algorithms and validate secret configuration.
jwt.verify() in jsonwebtoken v9+ requires passing an explicit algorithms allow-list; the current code relies on defaults, which bypasses algorithm-restriction security. Additionally, missing JWT_SECRET_TOKEN should return 500 (server misconfiguration) rather than 401 (auth failure).
Proposed fix
function jwtIsAuthenticated(req, res, next) {
let token;
const headerData = req.headers.authorization;
if (!headerData || !headerData.startsWith("Bearer ")) {
return res.status(401).json({ message: "User not authenticated " });
}
token = headerData.split(" ")[1];
try {
- const userData = jwt.verify(token, process.env.JWT_SECRET_TOKEN);
+ const secret = process.env.JWT_SECRET_TOKEN;
+ if (!secret) {
+ return res.status(500).json({ message: "JWT secret not configured" });
+ }
+ const userData = jwt.verify(token, secret, {
+ algorithms: ["HS256"],
+ });
req.user = userData;
//console.log(userData);
next();
} catch (err) {
res.status(401).json({ message: "Invalid or expired token sent" });
}
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| function jwtIsAuthenticated(req, res, next) { | |
| let token; | |
| const headerData = req.headers.authorization; | |
| if (!headerData || !headerData.startsWith("Bearer ")) { | |
| return res.status(401).json({ message: "User not authenticated " }); | |
| } | |
| token = headerData.split(" ")[1]; | |
| try { | |
| const userData = jwt.verify(token, process.env.JWT_SECRET_TOKEN); | |
| req.user = userData; | |
| //console.log(userData); | |
| next(); | |
| } catch (err) { | |
| res.status(401).json({ message: "Invalid or expired token sent" }); | |
| } | |
| function jwtIsAuthenticated(req, res, next) { | |
| let token; | |
| const headerData = req.headers.authorization; | |
| if (!headerData || !headerData.startsWith("Bearer ")) { | |
| return res.status(401).json({ message: "User not authenticated " }); | |
| } | |
| token = headerData.split(" ")[1]; | |
| try { | |
| const secret = process.env.JWT_SECRET_TOKEN; | |
| if (!secret) { | |
| return res.status(500).json({ message: "JWT secret not configured" }); | |
| } | |
| const userData = jwt.verify(token, secret, { | |
| algorithms: ["HS256"], | |
| }); | |
| req.user = userData; | |
| //console.log(userData); | |
| next(); | |
| } catch (err) { | |
| res.status(401).json({ message: "Invalid or expired token sent" }); | |
| } | |
| } |
🤖 Prompt for AI Agents
In `@backend/middlewares/isAuthenticated.js` around lines 13 - 28, In
jwtIsAuthenticated, ensure process.env.JWT_SECRET_TOKEN is present and return
res.status(500).json({ message: "Server misconfiguration: JWT secret missing" })
if not; when calling jwt.verify(token, process.env.JWT_SECRET_TOKEN) pass an
explicit algorithms allow-list (e.g. algorithms: ['HS256']) to prevent algorithm
downgrade attacks, assign the verified payload to req.user as before, and keep
the existing catch to return 401 for invalid/expired tokens.
Comment on lines
+62
to
+66
| certificateId: { | ||
| type: String, | ||
| unique: true, | ||
| required: function () { | ||
| return this.status === "Approved"; |
Contributor
There was a problem hiding this comment.
certificateId unique constraint will reject multiple non-approved docs.
With unique: true, multiple pending records without certificateId can trigger duplicate-key errors. Use a partial unique index instead and remove unique: true from the field.
🧩 Proposed fix
certificateId: {
type: String,
- unique: true,
required: function () {
return this.status === "Approved";
},
},+certificateSchema.index(
+ { certificateId: 1 },
+ { unique: true, partialFilterExpression: { certificateId: { $exists: true } } },
+);MongoDB unique index behavior with missing field values (null/absent)
🤖 Prompt for AI Agents
In `@backend/models/certificateSchema.js` around lines 62 - 66, The certificateId
field is marked unique which causes duplicate-key errors for multiple
non-approved docs; remove the unique: true from the certificateId field in the
certificateSchema and instead add a partial unique index on certificateId that
only applies when status === "Approved" (ensure the index also requires
certificateId exists). Locate the schema definition (certificateId in
certificateSchema / CertificateSchema) and replace the field-level unique
constraint with a schema-level index using partialFilterExpression for
status:"Approved" (and certificateId existence) so only approved documents
enforce uniqueness.
Comment on lines
+45
to
+51
| return res.json(401).json({ message: "Invalid user credentials" }); | ||
| } | ||
|
|
||
| const isValid = await bcrypt.compare(password, user.password); | ||
| if (!isValid) { | ||
| return res.json(401).json({ message: "Invalid user credentials" }); | ||
| } |
Contributor
There was a problem hiding this comment.
Fix 401 responses: res.json(401) sends a 200 and double-sends.
Use res.status(401).json(...) for proper status and to avoid “headers already sent.”
🔧 Proposed fix
- return res.json(401).json({ message: "Invalid user credentials" });
+ return res.status(401).json({ message: "Invalid user credentials" });
...
- return res.json(401).json({ message: "Invalid user credentials" });
+ return res.status(401).json({ message: "Invalid user credentials" });
...
- return res
- .json(401)
- .json({ message: "Account with username already exists" });
+ return res
+ .status(401)
+ .json({ message: "Account with username already exists" });Also applies to: 89-92
🤖 Prompt for AI Agents
In `@backend/routes/auth.js` around lines 45 - 51, Replace incorrect
res.json(401).json(...) calls with res.status(401).json(...) in the auth route
handler(s) where authentication fails (the checks using bcrypt.compare and the
earlier invalid-credentials check), and make the same change for the other
occurrence around the second failure block (the one referenced at lines 89-92);
update the two places that call res.json(401).json to use res.status(401).json
to set the HTTP status correctly and avoid double-sending headers.
Comment on lines
+189
to
212
| const feedbackId = req.params.id; | ||
| const { actions_taken, resolved_by } = req.body; | ||
| console.log(req.body); | ||
| console.log("User resolving feedback:", resolved_by); | ||
|
|
||
| if (!actions_taken || actions_taken.trim() === "") { | ||
| return res.status(400).json({ error: "Resolution comment is required." }); | ||
| } | ||
|
|
||
| if (feedback.is_resolved) { | ||
| return res.status(400).json({ error: "Feedback is already resolved." }); | ||
| } | ||
| try { | ||
| const feedback = await Feedback.findById(feedbackId); | ||
| if (!feedback) { | ||
| return res.status(404).json({ error: "Feedback not found" }); | ||
| } | ||
|
|
||
| feedback.is_resolved = true; | ||
| feedback.resolved_at = new Date(); | ||
| feedback.actions_taken = actions_taken; | ||
| feedback.resolved_by = resolved_by; | ||
| if (feedback.is_resolved) { | ||
| return res.status(400).json({ error: "Feedback is already resolved." }); | ||
| } | ||
|
|
||
| await feedback.save(); | ||
| feedback.is_resolved = true; | ||
| feedback.resolved_at = new Date(); | ||
| feedback.actions_taken = actions_taken; | ||
| feedback.resolved_by = resolved_by; | ||
|
|
Contributor
There was a problem hiding this comment.
Derive resolved_by from the authenticated user, not the request body.
Clients can spoof resolved_by today. Use req.user and ignore the body field to preserve audit integrity.
🔐 Proposed fix
- const { actions_taken, resolved_by } = req.body;
+ const { actions_taken } = req.body;
+ const resolved_by = req.user?._id;
+ if (!resolved_by) {
+ return res.status(401).json({ error: "Unauthorized" });
+ }
console.log(req.body);
console.log("User resolving feedback:", resolved_by);📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| const feedbackId = req.params.id; | |
| const { actions_taken, resolved_by } = req.body; | |
| console.log(req.body); | |
| console.log("User resolving feedback:", resolved_by); | |
| if (!actions_taken || actions_taken.trim() === "") { | |
| return res.status(400).json({ error: "Resolution comment is required." }); | |
| } | |
| if (feedback.is_resolved) { | |
| return res.status(400).json({ error: "Feedback is already resolved." }); | |
| } | |
| try { | |
| const feedback = await Feedback.findById(feedbackId); | |
| if (!feedback) { | |
| return res.status(404).json({ error: "Feedback not found" }); | |
| } | |
| feedback.is_resolved = true; | |
| feedback.resolved_at = new Date(); | |
| feedback.actions_taken = actions_taken; | |
| feedback.resolved_by = resolved_by; | |
| if (feedback.is_resolved) { | |
| return res.status(400).json({ error: "Feedback is already resolved." }); | |
| } | |
| await feedback.save(); | |
| feedback.is_resolved = true; | |
| feedback.resolved_at = new Date(); | |
| feedback.actions_taken = actions_taken; | |
| feedback.resolved_by = resolved_by; | |
| const feedbackId = req.params.id; | |
| const { actions_taken } = req.body; | |
| const resolved_by = req.user?._id; | |
| if (!resolved_by) { | |
| return res.status(401).json({ error: "Unauthorized" }); | |
| } | |
| console.log(req.body); | |
| console.log("User resolving feedback:", resolved_by); | |
| if (!actions_taken || actions_taken.trim() === "") { | |
| return res.status(400).json({ error: "Resolution comment is required." }); | |
| } | |
| try { | |
| const feedback = await Feedback.findById(feedbackId); | |
| if (!feedback) { | |
| return res.status(404).json({ error: "Feedback not found" }); | |
| } | |
| if (feedback.is_resolved) { | |
| return res.status(400).json({ error: "Feedback is already resolved." }); | |
| } | |
| feedback.is_resolved = true; | |
| feedback.resolved_at = new Date(); | |
| feedback.actions_taken = actions_taken; | |
| feedback.resolved_by = resolved_by; |
🤖 Prompt for AI Agents
In `@backend/routes/feedbackRoutes.js` around lines 189 - 212, The route currently
trusts req.body.resolved_by which allows spoofing; instead ignore the body field
and derive the resolver from the authenticated user (req.user). In the feedback
resolution handler (where feedbackId, actions_taken, resolved_by are read and
Feedback.findById is called), remove usage of req.body.resolved_by and set
feedback.resolved_by = req.user.id or req.user.email (whichever is the canonical
identifier in your auth model) after verifying req.user exists; keep validation
for actions_taken and the rest of the update logic, and ensure the API does not
accept or persist a client-supplied resolved_by.
Comment on lines
+80
to
+90
| router.delete("/photo-delete", isAuthenticated, async (req, res) => { | ||
| try { | ||
| const { ID_No } = req.query; // Get ID_No from frontend for DELETE | ||
| if (!ID_No) { return res.status(400).json({ error: "ID_No is required" }); } | ||
| if (!ID_No) { | ||
| return res.status(400).json({ error: "ID_No is required" }); | ||
| } | ||
|
|
||
| const user = await user.findOne({ user_id: ID_No }); | ||
| if (!user) { return res.status(404).json({ error: "User not found" }); } | ||
| if (!user) { | ||
| return res.status(404).json({ error: "User not found" }); | ||
| } |
Contributor
There was a problem hiding this comment.
Fix User lookup (Line 87 uses an undefined identifier).
Line 87 uses user.findOne(...), but user isn’t defined. This will throw at runtime.
🐛 Fix the model reference
- const user = await user.findOne({ user_id: ID_No });
+ const user = await User.findOne({ user_id: ID_No });📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| router.delete("/photo-delete", isAuthenticated, async (req, res) => { | |
| try { | |
| const { ID_No } = req.query; // Get ID_No from frontend for DELETE | |
| if (!ID_No) { return res.status(400).json({ error: "ID_No is required" }); } | |
| if (!ID_No) { | |
| return res.status(400).json({ error: "ID_No is required" }); | |
| } | |
| const user = await user.findOne({ user_id: ID_No }); | |
| if (!user) { return res.status(404).json({ error: "User not found" }); } | |
| if (!user) { | |
| return res.status(404).json({ error: "User not found" }); | |
| } | |
| router.delete("/photo-delete", isAuthenticated, async (req, res) => { | |
| try { | |
| const { ID_No } = req.query; // Get ID_No from frontend for DELETE | |
| if (!ID_No) { | |
| return res.status(400).json({ error: "ID_No is required" }); | |
| } | |
| const user = await User.findOne({ user_id: ID_No }); | |
| if (!user) { | |
| return res.status(404).json({ error: "User not found" }); | |
| } |
🧰 Tools
🪛 Biome (2.3.13)
[error] 87-87: This variable is used before its declaration.
The variable is declared here:
(lint/correctness/noInvalidUseBeforeDeclaration)
🤖 Prompt for AI Agents
In `@backend/routes/profile.js` around lines 80 - 90, The code in the
router.delete("/photo-delete", isAuthenticated, async (req, res) => { ... })
handler calls user.findOne(...) but `user` is undefined; update the handler to
use the correct User model reference (e.g., `User.findOne(...)`) and ensure the
model is imported/required at the top (or rename the local variable to avoid
shadowing, e.g., `const foundUser = await User.findOne({ user_id: ID_No })`),
then update subsequent references to use that variable (`foundUser`) instead of
the undefined `user`.
Comment on lines
+3
to
+10
| const zodObjectId = zod.string().regex(/^[0-9a-zA-Z]{24}$/, "Invalid ObjectId"); | ||
|
|
||
| const validateBatchSchema = zod.object({ | ||
| title: zod.string().min(5, "Title is required"), | ||
| unit_id: zodObjectId, | ||
| commonData: zod.record(zod.string(), zod.string()), | ||
| template_id: zod.string(), | ||
| users: zod.array(zodObjectId).min(1, "Atleast 1 user must be associated."), |
Contributor
There was a problem hiding this comment.
ObjectId regex is too permissive.
[0-9a-zA-Z]{24} accepts non-hex characters; Mongo ObjectIds are hex-only.
✅ Proposed fix
-const zodObjectId = zod.string().regex(/^[0-9a-zA-Z]{24}$/, "Invalid ObjectId");
+const zodObjectId = zod
+ .string()
+ .regex(/^[a-f0-9]{24}$/i, "Invalid ObjectId");📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| const zodObjectId = zod.string().regex(/^[0-9a-zA-Z]{24}$/, "Invalid ObjectId"); | |
| const validateBatchSchema = zod.object({ | |
| title: zod.string().min(5, "Title is required"), | |
| unit_id: zodObjectId, | |
| commonData: zod.record(zod.string(), zod.string()), | |
| template_id: zod.string(), | |
| users: zod.array(zodObjectId).min(1, "Atleast 1 user must be associated."), | |
| const zodObjectId = zod | |
| .string() | |
| .regex(/^[a-f0-9]{24}$/i, "Invalid ObjectId"); | |
| const validateBatchSchema = zod.object({ | |
| title: zod.string().min(5, "Title is required"), | |
| unit_id: zodObjectId, | |
| commonData: zod.record(zod.string(), zod.string()), | |
| template_id: zod.string(), | |
| users: zod.array(zodObjectId).min(1, "Atleast 1 user must be associated."), |
🤖 Prompt for AI Agents
In `@backend/utils/batchValidate.js` around lines 3 - 10, The zodObjectId regex is
too permissive (allows non-hex chars); update the zodObjectId used by
validateBatchSchema to enforce hex-only ObjectIds by replacing the pattern with
a hex-only regex (e.g., /^[0-9a-fA-F]{24}$/) so zodObjectId =
zod.string().regex(...); ensure the same updated zodObjectId is used in
validateBatchSchema for unit_id and users array elements.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
name: " Pull Request"
about: Propose and submit changes to the project for review
title: "PR: Implement createBatch endpoint ( /api/certificate-batch/ )"
labels: ""
assignees: harshitap1305, sakshi1755
Related Issue
Changes Introduced
isAuthenticatedmiddleware that verifies JWT from the Authorization header and attaches the verified user toreq.user.createBatchcontroller (implemented from scratch) to create certificate batches for a club with server-side approver resolution.validateBatchSchema,zodObjectId) and return proper 4xx/5xx responses on validation/auth errors.zodObjectId+ DB existence checks) for theusersarray before batch creation.Why This Change?
createBatchflow that:CertificateBatchdocument only when all checks passScreenshots
Testing
npm testin the relevant directory).Documentation Updates
README.mdwith new instructions.Checklist
git checkout -b feature/my-amazing-feature).Deployment Notes
Summary by CodeRabbit
Release Notes
New Features
Bug Fixes
Chores
✏️ Tip: You can customize this high-level summary in your review settings.