Nitpick

Code Review — auth/middleware.ts

Summary: One blocker, two suggestions. The auth flow has a timing attack vulnerability.

BLOCKER: Line 34: Password comparison uses === (string equality). This is vulnerable to timing attacks — the comparison short-circuits on the first different character, leaking password length information. Use crypto.timingSafeEqual() instead. Reference: Node.js crypto docs, OWASP Authentication Cheatsheet.

SUGGESTION 1: Line 52: JWT secret is loaded from process.env on every request. If the env var is unset, jwt.verify() will throw an unhandled error. Add a startup check that exits if JWT_SECRET is missing.

SUGGESTION 2: Line 71: The error response for invalid tokens returns the raw jwt.verify error message. This leaks implementation details (library version, token structure). Return a generic 'Invalid token' message instead.

CLEAN: Input validation on lines 10-20 is solid. Rate limiting middleware is correctly applied. CORS headers properly configured.

SQL Injection Review

BLOCKER: Line 28: db.query(\SELECT * FROM users WHERE email = '${email}'`)— This is a textbook SQL injection vulnerability. Template literals do NOT parameterize the query. An attacker can input' OR 1=1 --` to dump the entire users table. Reference: OWASP SQL Injection Prevention Cheatsheet.

Fix:

db.query('SELECT * FROM users WHERE email = $1', [email])

Parameterized queries send the value separately from the SQL — the database treats it as data, never as executable SQL.

Line 45: The Prisma findUnique() call on this line is safe — Prisma parameterizes all queries internally.

Line 62: db.raw() call with string concatenation — same vulnerability as line 28. Switch to parameterized form: db.raw('SELECT * FROM orders WHERE status = ?', [status]).

Verdict: 2 of 4 queries are injectable. Fix before merging.