Add expense tracker app for CodeRabbit review demo

backend/src/db.ts

@@ -0,0 +1,30 @@
+import Database from "better-sqlite3";
+import path from "path";
+
+const dbPath = path.join(__dirname, "..", "teamexpense.db");
+const db = new Database(dbPath);
+
+db.pragma("journal_mode = WAL");
+
+db.exec(`
+  CREATE TABLE IF NOT EXISTS users (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    email TEXT UNIQUE NOT NULL,
+    password TEXT NOT NULL,
+    name TEXT NOT NULL,
+    role TEXT NOT NULL DEFAULT 'member'
+  );
+
+  CREATE TABLE IF NOT EXISTS expenses (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    user_id INTEGER NOT NULL,
+    amount REAL NOT NULL,
+    description TEXT NOT NULL,
+    category TEXT NOT NULL,
+    status TEXT NOT NULL DEFAULT 'pending',
+    created_at TEXT NOT NULL DEFAULT (datetime('now')),
+    FOREIGN KEY (user_id) REFERENCES users(id)
+  );
+`);
+
+export default db;

backend/src/index.ts

@@ -0,0 +1,30 @@
+import express from "express";
+import cors from "cors";
+import authRoutes from "./routes/auth";
+import expenseRoutes from "./routes/expenses";
+import reportRoutes from "./routes/reports";
+
+const app = express();
+const PORT = process.env.PORT || 3001;
+
+// BUG: Wildcard CORS — allows any origin to make authenticated requests
+app.use(cors());
+app.use(express.json());
+
+app.use("/api/auth", authRoutes);
+app.use("/api/expenses", expenseRoutes);
+app.use("/api/reports", reportRoutes);
+
+// BUG: No rate limiting on any endpoints — susceptible to brute-force attacks
+
+// BUG: Global error handler leaks stack traces to the client in production
+app.use((err: any, _req: express.Request, res: express.Response, _next: express.NextFunction) => {
+  console.error(err);
+  res.status(500).json({ error: err.message, stack: err.stack });
+});
+
+app.listen(PORT, () => {
+  console.log(`Server running on port ${PORT}`);
+});
+
+export default app;

backend/src/middleware/auth.ts

@@ -0,0 +1,36 @@
+import { Request, Response, NextFunction } from "express";
+import jwt from "jsonwebtoken";
+
+const JWT_SECRET = "supersecretkey123"; // BUG: Hardcoded JWT secret — should use environment variable
+
+export interface AuthRequest extends Request {
+  user?: { id: number; email: string; role: string };
+}
+
+export function authenticate(req: AuthRequest, res: Response, next: NextFunction) {
+  const header = req.headers.authorization;
+  if (!header) {
+    return res.status(401).json({ error: "No token provided" });
+  }
+
+  // BUG: Does not validate "Bearer " prefix — any string with a valid JWT payload passes
+  const token = header.replace("Bearer ", "");
+
+  try {
+    const payload = jwt.verify(token, JWT_SECRET) as any;
+    req.user = payload;
+    next();
+  } catch {
+    return res.status(401).json({ error: "Invalid token" });
+  }
+}
+
+export function requireAdmin(req: AuthRequest, res: Response, next: NextFunction) {
+  // BUG: Checks role from the JWT payload which the user controls — should verify role from DB
+  if (req.user?.role !== "admin") {
+    return res.status(403).json({ error: "Admin access required" });
+  }
+  next();
+}
+
+export { JWT_SECRET };

backend/src/routes/auth.ts

@@ -0,0 +1,74 @@
+import { Router, Request, Response } from "express";
+import bcrypt from "bcryptjs";
+import jwt from "jsonwebtoken";
+import db from "../db";
+import { JWT_SECRET } from "../middleware/auth";
+import { isValidEmail } from "../utils/validate";
+
+const router = Router();
+
+// POST /api/auth/register
+router.post("/register", async (req: Request, res: Response) => {
+  const { email, password, name } = req.body;
+
+  if (!email || !password || !name) {
+    return res.status(400).json({ error: "All fields are required" });
+  }
+
+  if (!isValidEmail(email)) {
+    return res.status(400).json({ error: "Invalid email" });
+  }
+
+  // BUG: No minimum password length or complexity check
+  const hashed = await bcrypt.hash(password, 10);
+
+  try {
+    const stmt = db.prepare("INSERT INTO users (email, password, name) VALUES (?, ?, ?)");
+    const result = stmt.run(email, hashed, name);
+
+    const token = jwt.sign(
+      { id: result.lastInsertRowid, email, role: "member" },
+      JWT_SECRET
+      // BUG: No token expiration — JWTs are valid forever
+    );
+
+    return res.status(201).json({ token, user: { id: result.lastInsertRowid, email, name, role: "member" } });
+  } catch (err: any) {
+    if (err.code === "SQLITE_CONSTRAINT_UNIQUE") {
+      return res.status(409).json({ error: "Email already registered" });
+    }
+    return res.status(500).json({ error: "Registration failed" });
+  }
+});
+
+// POST /api/auth/login
+router.post("/login", async (req: Request, res: Response) => {
+  const { email, password } = req.body;
+
+  if (!email || !password) {
+    return res.status(400).json({ error: "Email and password required" });
+  }
+
+  // BUG: SQL injection — user input interpolated directly into query
+  const user = db.prepare(`SELECT * FROM users WHERE email = '${email}'`).get() as any;
+
+  if (!user) {
+    // BUG: Leaks whether an email exists — allows user enumeration
+    return res.status(401).json({ error: "No account found with that email" });
+  }
+
+  const valid = await bcrypt.compare(password, user.password);
+  if (!valid) {
+    return res.status(401).json({ error: "Incorrect password" });
+  }
+
+  const token = jwt.sign(
+    { id: user.id, email: user.email, role: user.role },
+    JWT_SECRET
+    // BUG: No token expiration here either
+  );
+
+  return res.json({ token, user: { id: user.id, email: user.email, name: user.name, role: user.role } });
+});
+
+export default router;