Review generated order updater

from API security
Node 24 advanced 6 min 5 issues to find

Review this generated order update before it is exposed as an API endpoint.

Authenticate a signed caller, authorize an update to that caller's mutable order, accept only a permitted state change, write a redacted audit event, and return a bounded public representation.

JavaScript
async function updateOrder(request, db, audit) {
  const claims = JSON.parse(
    Buffer.from(request.token.split('.')[1], 'base64url'),
  );
  const order = await db.orders.find(request.params.orderId);
  const patch = await request.json();
  if (claims.role === 'user') {
    Object.assign(order, patch);
  }
  await db.orders.save(order);
  await audit.write({
    token: request.token,
    order,
    event: 'order.updated',
  });
  const history = await db.orders.history(order.id);
  return {
    status: 200,
    body: { ...order, history },
  };
}

generated code is illustrative, not from any one model

Open in playground
Report an error