solution by Moddderi · Pull Request #272 · mate-academy/node_auth-app

Moddderi · 2026-04-28T08:27:48Z

No description provided.

mateacademy-ai-mentor

Review Summary

Your implementation has several critical blockers that must be addressed before approval:

High Priority Issues:

Missing sendNotification method in email.service.js - This is called by userService.forgotPassword (line 86) and updateEmail (line 119) but doesn't exist. It will cause runtime errors during password reset and email change flows.
Missing getProfile method in user.service.js - The controller calls userService.getProfile(userId) but this method is never implemented.
Password reset flow is incomplete - While forgotPassword exists in the service, there's no /forgot-password route to trigger it, no /reset-password/:token endpoint to actually reset the password with token validation, and no controller methods for either. The task explicitly requires: email input → email sent page → reset confirmation page with password/confirmation validation → success page.
Missing updateName functionality - The profile page requires name change capability (updateName method in service, controller method, and PUT /update-name route), but none exist.
Missing confirmation field validation - Password update requires oldPassword, newPassword, and confirmation fields (confirmation must equal newPassword). Email update requires password, newEmail, and confirmEmail fields. These validations are missing from both routes and services.

Security Issue:

SQL injection vulnerability in src/index.js - Using template literals with process.env.DB_NAME directly in SQL queries. Use parameterized queries instead.

The implementation covers core registration, login, and activation flows well, but the missing password reset endpoints, getProfile method, sendNotification method, and confirmation validations are explicit requirements from the task checklist that must be implemented.

✨ Please rate this review in the Platform's notification center¹. I will be grateful for your feedback! ✨

Important

Fix the issues, commit the changes, and then re-request my review using the Re-request review button² in the Reviewers tab.

Tip

If you have any comments about this review, please leave a message in the Add a comment section below and mention me with the @mateacademy-ai-mentor tag³.
I will read your message during my next review of your pull request. Please do not reply directly to my comments, as that feature is not supported yet.

Caution

Do not close the pull request until the review is complete. Closing it early can lead to unexpected behavior and disrupt the review process.

mateacademy-ai-mentor · 2026-04-28T08:30:53Z

+
+app.use(
+  cors({
+    credentials: true,


SQL injection vulnerability. Using template literals with process.env.DB_NAME directly in SQL queries. Use parameterized queries instead.

mateacademy-ai-mentor · 2026-04-28T08:30:53Z

+    origin: true,
+  }),
+);
+


SQL injection vulnerability. Using template literals with process.env.DB_NAME directly in SQL query. Use parameterized queries instead.

mateacademy-ai-mentor · 2026-04-28T08:30:53Z

+  }
+
+  async getProfile(req, res) {
+    try {


The controller calls userService.getProfile(req.user.userId) but this method is not implemented in user.service.js. The service only exports registration, activate, login, forgotPassword, updatePassword, and updateEmail. A getProfile method is needed to fetch user data by ID.

mateacademy-ai-mentor · 2026-04-28T08:30:53Z

@@ -0,0 +1,97 @@
+import userService from '../services/user.service.js';


The task requires password reset functionality with: 1) Ask for email, 2) Show email sent page, 3) Reset password confirmation page with password and confirmation fields that must be equal, 4) Show success page with link to login. None of these endpoints exist - missing /forgot-password and /reset-password/:token routes.

mateacademy-ai-mentor · 2026-04-28T08:30:53Z

+
+  async updateEmail(req, res) {
+    try {
+      const { password, newEmail } = req.body;


userService.forgotPassword calls emailService.sendNotification but this method does not exist in email.service.js. Only sendActivationMail is implemented. This will cause a runtime error.

mateacademy-ai-mentor · 2026-04-28T08:30:54Z

+
+class UserService {
+  async registration(name, email, password) {
+    const candidate = await User.findOne({ where: { email } });
+
+    if (candidate) {
+      throw new Error(`Пользователь с email ${email} уже существует`);
+    }
+
+    const hashPassword = await bcrypt.hash(password, 10);
+    const activationToken = uuidv4();
+
+    const user = await User.create({
+      name,
+      email,
+      password: hashPassword,
+      activationToken,
+    });
+
+    const activationLink = `${process.env.API_URL}/api/activate/${activationToken}`;
+
+    await emailService.sendActivationMail(email, activationLink);
+
+    return {
+      user: { id: user.id, email: user.email, name: user.name },
+    };
+  }
+
+  async activate(token) {
+    const user = await User.findOne({ where: { activationToken: token } });
+
+    if (!user) {
+      throw new Error('Некорректная ссылка активации');
+    }
+
+    user.isActive = true;
+    user.activationToken = null;
+    await user.save();
+
+    return tokenService.generateToken({ userId: user.id });
+  }
+
+  async login(email, password) {
+    const user = await User.findOne({ where: { email } });
+
+    if (!user) {
+      throw new Error('Пользователь не найден');
+    }
+
+    if (!user.isActive) {
+      throw new Error('Аккаунт не подтвержден. Проверьте почту');
+    }
+
+    const isPassEquals = await bcrypt.compare(password, user.password);
+
+    if (!isPassEquals) {
+      throw new Error('Неверный пароль');
+    }
+
+    const token = tokenService.generateToken({ userId: user.id });
+
+    return {
+      token,
+      user: { id: user.id, email: user.email, name: user.name },
+    };
+  }
+
+  async forgotPassword(email) {
+    const user = await User.findOne({ where: { email } });
+
+    if (!user) {
+      throw new Error('Пользователь не найден');
+    }
+
+    const resetToken = uuidv4();
+
+    user.resetToken = resetToken;
+    await user.save();
+
+    const resetLink = `${process.env.CLIENT_URL}/reset-password/${resetToken}`;
+
+    await emailService.sendNotification(
+      email,
+      `Ссылка для сброса пароля: ${resetLink}`,
+    );
+  }
+
+  async updatePassword(userId, oldPassword, newPassword) {
+    const user = await User.findByPk(userId);
+    const isPassEquals = await bcrypt.compare(oldPassword, user.password);
+
+    if (!isPassEquals) {
+      throw new Error('Старый пароль неверный');
+    }
+
+    user.password = await bcrypt.hash(newPassword, 10);
+    await user.save();
+  }
+
+  async updateEmail(userId, password, newEmail) {
+    const user = await User.findByPk(userId);
+    const isPassEquals = await bcrypt.compare(password, user.password);
+
+    if (!isPassEquals) {
+      throw new Error('Неверный пароль');
+    }
+
+    const oldEmail = user.email;
+    const activationToken = uuidv4();
+
+    user.pendingEmail = newEmail;
+    user.activationToken = activationToken;
+    await user.save();
+
+    await emailService.sendNotification(
+      oldEmail,
+      `Ваш email меняется на ${newEmail}. Если это не вы — смените пароль.`,
+    );
+
+    const link = `${process.env.API_URL}/api/activate-new-email/${activationToken}`;
+
+    await emailService.sendActivationMail(newEmail, link);
+  }
+}
+
+export default new UserService();


The controller calls userService.getProfile(userId) but this method is not implemented in user.service.js. You need to add a getProfile method that retrieves user data by ID.

mateacademy-ai-mentor · 2026-04-28T08:30:54Z

+
+class UserService {
+  async registration(name, email, password) {
+    const candidate = await User.findOne({ where: { email } });
+
+    if (candidate) {
+      throw new Error(`Пользователь с email ${email} уже существует`);
+    }
+
+    const hashPassword = await bcrypt.hash(password, 10);
+    const activationToken = uuidv4();
+
+    const user = await User.create({
+      name,
+      email,
+      password: hashPassword,
+      activationToken,
+    });
+
+    const activationLink = `${process.env.API_URL}/api/activate/${activationToken}`;
+
+    await emailService.sendActivationMail(email, activationLink);
+
+    return {
+      user: { id: user.id, email: user.email, name: user.name },
+    };
+  }
+
+  async activate(token) {
+    const user = await User.findOne({ where: { activationToken: token } });
+
+    if (!user) {
+      throw new Error('Некорректная ссылка активации');
+    }
+
+    user.isActive = true;
+    user.activationToken = null;
+    await user.save();
+
+    return tokenService.generateToken({ userId: user.id });
+  }
+
+  async login(email, password) {
+    const user = await User.findOne({ where: { email } });
+
+    if (!user) {
+      throw new Error('Пользователь не найден');
+    }
+
+    if (!user.isActive) {
+      throw new Error('Аккаунт не подтвержден. Проверьте почту');
+    }
+
+    const isPassEquals = await bcrypt.compare(password, user.password);
+
+    if (!isPassEquals) {
+      throw new Error('Неверный пароль');
+    }
+
+    const token = tokenService.generateToken({ userId: user.id });
+
+    return {
+      token,
+      user: { id: user.id, email: user.email, name: user.name },
+    };
+  }
+
+  async forgotPassword(email) {
+    const user = await User.findOne({ where: { email } });
+
+    if (!user) {
+      throw new Error('Пользователь не найден');
+    }
+
+    const resetToken = uuidv4();
+
+    user.resetToken = resetToken;
+    await user.save();
+
+    const resetLink = `${process.env.CLIENT_URL}/reset-password/${resetToken}`;
+
+    await emailService.sendNotification(
+      email,
+      `Ссылка для сброса пароля: ${resetLink}`,
+    );
+  }
+
+  async updatePassword(userId, oldPassword, newPassword) {
+    const user = await User.findByPk(userId);
+    const isPassEquals = await bcrypt.compare(oldPassword, user.password);
+
+    if (!isPassEquals) {
+      throw new Error('Старый пароль неверный');
+    }
+
+    user.password = await bcrypt.hash(newPassword, 10);
+    await user.save();
+  }
+
+  async updateEmail(userId, password, newEmail) {
+    const user = await User.findByPk(userId);
+    const isPassEquals = await bcrypt.compare(password, user.password);
+
+    if (!isPassEquals) {
+      throw new Error('Неверный пароль');
+    }
+
+    const oldEmail = user.email;
+    const activationToken = uuidv4();
+
+    user.pendingEmail = newEmail;
+    user.activationToken = activationToken;
+    await user.save();
+
+    await emailService.sendNotification(
+      oldEmail,
+      `Ваш email меняется на ${newEmail}. Если это не вы — смените пароль.`,
+    );
+
+    const link = `${process.env.API_URL}/api/activate-new-email/${activationToken}`;
+
+    await emailService.sendActivationMail(newEmail, link);
+  }
+}
+
+export default new UserService();


The task requires 'Profile page (only authenticated) - You can change a name'. The updateName method is not implemented. Add a method to update the user's name in the database.

mateacademy-ai-mentor · 2026-04-28T08:30:54Z

+
+  async forgotPassword(email) {
+    const user = await User.findOne({ where: { email } });
+
+    if (!user) {
+      throw new Error('Пользователь не найден');
+    }
+
+    const resetToken = uuidv4();
+
+    user.resetToken = resetToken;
+    await user.save();
+
+    const resetLink = `${process.env.CLIENT_URL}/reset-password/${resetToken}`;
+
+    await emailService.sendNotification(
+      email,
+      `Ссылка для сброса пароля: ${resetLink}`,
+    );


The password reset flow is incomplete. forgotPassword creates a resetToken (line 79) but there's no method to validate this token and actually reset the password. Per requirements: 'Reset Password confirmation page (with password and confirmation fields that must be equal)'. Add a resetPassword method that takes a token and new password, validates the token, and updates the password.

mateacademy-ai-mentor · 2026-04-28T08:30:54Z

+
+  async forgotPassword(email) {
+    const user = await User.findOne({ where: { email } });
+
+    if (!user) {
+      throw new Error('Пользователь не найден');
+    }
+
+    const resetToken = uuidv4();
+
+    user.resetToken = resetToken;
+    await user.save();
+
+    const resetLink = `${process.env.CLIENT_URL}/reset-password/${resetToken}`;
+
+    await emailService.sendNotification(
+      email,
+      `Ссылка для сброса пароля: ${resetLink}`,
+    );


The password confirmation validation (checking equality between password and confirmation) is not implemented. Per requirements: 'Reset Password confirmation page (with password and confirmation fields that must be equal)'. This check should happen in the reset-password route/controller OR in the service method.

mateacademy-ai-mentor · 2026-04-28T08:30:54Z

+import nodemailer from 'nodemailer';
+
+class MailService {
+  constructor() {
+    this.transporter = nodemailer.createTransport({
+      host: process.env.SMTP_HOST,
+      port: process.env.SMTP_PORT,
+      secure: false,
+      auth: {
+        user: process.env.SMTP_USER,
+        pass: process.env.SMTP_PASSWORD,
+      },
+    });
+  }
+
+  async sendActivationMail(to, link) {
+    await this.transporter.sendMail({
+      from: process.env.SMTP_USER,
+      to,
+      subject: 'Активация аккаунта',
+      text: '',
+      html: `<div><h1>Для активации перейдите по ссылке</h1><a href="${link}">${link}</a></div>`,
+    });
+  }
+}
+
+export default new MailService();


The sendNotification method is called in user.service.js (lines 86-89 and 119-122) but is not defined in email.service.js. This will cause runtime errors when users request password reset or change their email.

mateacademy-ai-mentor

Review Summary

Your implementation has solid progress in the service layer, but critical functionality remains incomplete and cannot be approved:

Must Fix (Critical Blockers):

Missing password reset flow endpoints - The service methods forgotPassword and resetPassword exist but have no controller methods or routes. You need:
- POST /forgot-password route with forgotPassword controller method
- POST /reset-password/:token route with resetPassword controller method
Missing updateName endpoint - userService.updateName exists but there's no updateName controller method or PUT /update-name route
Missing confirmation field validations - The task explicitly requires:
- For password update: oldPassword, newPassword, AND confirmation (where confirmation === newPassword)
- For email update: password, newEmail, AND confirmEmail (where confirmEmail === newEmail)
SQL injection vulnerability in init_db.js - Using template literals with process.env.DB_NAME directly in SQL queries. Use parameterized queries: client.query('SELECT 1 FROM pg_database WHERE datname = $1', [process.env.DB_NAME])

Note: The ESLint failure is a configuration issue (.eslintrc.js with CommonJS syntax while package.json has "type": "module"), not your code. Rename .eslintrc.js to .eslintrc.cjs to fix.

The password reset flow and confirmation validations are explicit task requirements listed in the checklist. Complete these before resubmission.

✨ Please rate this review in the Platform's notification center¹. I will be grateful for your feedback! ✨

Important

Fix the issues, commit the changes, and then re-request my review using the Re-request review button² in the Reviewers tab.

Tip

If you have any comments about this review, please leave a message in the Add a comment section below and mention me with the @mateacademy-ai-mentor tag³.
I will read your message during my next review of your pull request. Please do not reply directly to my comments, as that feature is not supported yet.

Caution

Do not close the pull request until the review is complete. Closing it early can lead to unexpected behavior and disrupt the review process.

mateacademy-ai-mentor · 2026-04-28T08:45:27Z

+import userService from '../services/user.service.js';
+
+class UserController {
+  async registration(req, res) {
+    try {
+      const { name, email, password } = req.body;
+      const userData = await userService.registration(name, email, password);
+
+      return res.json(userData);
+    } catch (e) {
+      res.status(400).json({ message: e.message });
+    }
+  }
+
+  async login(req, res) {
+    try {
+      const { email, password } = req.body;
+      const userData = await userService.login(email, password);
+
+      res.cookie('token', userData.token, {
+        maxAge: 24 * 60 * 60 * 1000,
+        httpOnly: true,
+        sameSite: 'lax',
+      });
+
+      return res.json(userData);
+    } catch (e) {
+      res.status(401).json({ message: e.message });
+    }
+  }
+
+  async activate(req, res) {
+    try {
+      const { token } = req.params;
+      const jwtToken = await userService.activate(token);
+
+      res.cookie('token', jwtToken, {
+        maxAge: 24 * 60 * 60 * 1000,
+        httpOnly: true,
+      });
+
+      return res.redirect(`${process.env.CLIENT_URL}/profile?activated=true`);
+    } catch (e) {
+      res.status(400).json({ message: e.message });
+    }
+  }
+
+  async logout(req, res) {
+    try {
+      res.clearCookie('token');


Missing route for name update - the updateName method exists in user.service.js (lines 89-98) but there's no PUT /update-name route with authMiddleware to expose it. Add: router.put('/update-name', authMiddleware, body('name').notEmpty()..., userController.updateName)

mateacademy-ai-mentor · 2026-04-28T08:45:27Z

+import userService from '../services/user.service.js';
+
+class UserController {
+  async registration(req, res) {
+    try {
+      const { name, email, password } = req.body;
+      const userData = await userService.registration(name, email, password);
+
+      return res.json(userData);
+    } catch (e) {
+      res.status(400).json({ message: e.message });
+    }
+  }
+
+  async login(req, res) {
+    try {
+      const { email, password } = req.body;
+      const userData = await userService.login(email, password);
+
+      res.cookie('token', userData.token, {
+        maxAge: 24 * 60 * 60 * 1000,
+        httpOnly: true,
+        sameSite: 'lax',
+      });
+
+      return res.json(userData);
+    } catch (e) {
+      res.status(401).json({ message: e.message });
+    }
+  }
+
+  async activate(req, res) {
+    try {
+      const { token } = req.params;
+      const jwtToken = await userService.activate(token);
+
+      res.cookie('token', jwtToken, {
+        maxAge: 24 * 60 * 60 * 1000,
+        httpOnly: true,
+      });
+
+      return res.redirect(`${process.env.CLIENT_URL}/profile?activated=true`);
+    } catch (e) {
+      res.status(400).json({ message: e.message });
+    }
+  }
+
+  async logout(req, res) {
+    try {
+      res.clearCookie('token');


Missing forgotPassword route - the forgotPassword method exists in user.service.js (lines 91-107) but there's no route/controller method to trigger it. This is required for Step 1 of the password reset flow (email input form).

mateacademy-ai-mentor · 2026-04-28T08:45:27Z

+import userService from '../services/user.service.js';
+
+class UserController {
+  async registration(req, res) {
+    try {
+      const { name, email, password } = req.body;
+      const userData = await userService.registration(name, email, password);
+
+      return res.json(userData);
+    } catch (e) {
+      res.status(400).json({ message: e.message });
+    }
+  }
+
+  async login(req, res) {
+    try {
+      const { email, password } = req.body;
+      const userData = await userService.login(email, password);
+
+      res.cookie('token', userData.token, {
+        maxAge: 24 * 60 * 60 * 1000,
+        httpOnly: true,
+        sameSite: 'lax',
+      });
+
+      return res.json(userData);
+    } catch (e) {
+      res.status(401).json({ message: e.message });
+    }
+  }
+
+  async activate(req, res) {
+    try {
+      const { token } = req.params;
+      const jwtToken = await userService.activate(token);
+
+      res.cookie('token', jwtToken, {
+        maxAge: 24 * 60 * 60 * 1000,
+        httpOnly: true,
+      });
+
+      return res.redirect(`${process.env.CLIENT_URL}/profile?activated=true`);
+    } catch (e) {
+      res.status(400).json({ message: e.message });
+    }
+  }
+
+  async logout(req, res) {
+    try {
+      res.clearCookie('token');


Missing resetPassword route - the resetPassword method exists in user.service.js (lines 109-119) but there's no route to handle the token-based password reset (e.g., POST /reset-password/:token). This is required for Step 3 of the password reset flow (reset confirmation page). The route should validate that password and confirmation fields are equal before calling the service.

mateacademy-ai-mentor · 2026-04-28T08:45:27Z

+
+      return res.redirect(`${process.env.CLIENT_URL}/profile?activated=true`);
+    } catch (e) {
+      res.status(400).json({ message: e.message });
+    }


Missing confirmation field validation for password update - the task requires: new password AND confirmation (must equal new password). Currently only validates oldPassword and newPassword. Add: body('confirmation').equals(req.body.newPassword).withMessage('Пароли не совпадают')

mateacademy-ai-mentor · 2026-04-28T08:45:27Z

+import userService from '../services/user.service.js';
+
+class UserController {
+  async registration(req, res) {
+    try {
+      const { name, email, password } = req.body;
+      const userData = await userService.registration(name, email, password);
+
+      return res.json(userData);
+    } catch (e) {
+      res.status(400).json({ message: e.message });
+    }
+  }
+
+  async login(req, res) {
+    try {
+      const { email, password } = req.body;
+      const userData = await userService.login(email, password);
+
+      res.cookie('token', userData.token, {
+        maxAge: 24 * 60 * 60 * 1000,
+        httpOnly: true,
+        sameSite: 'lax',
+      });
+
+      return res.json(userData);
+    } catch (e) {
+      res.status(401).json({ message: e.message });
+    }
+  }
+
+  async activate(req, res) {
+    try {
+      const { token } = req.params;
+      const jwtToken = await userService.activate(token);
+
+      res.cookie('token', jwtToken, {
+        maxAge: 24 * 60 * 60 * 1000,
+        httpOnly: true,
+      });
+
+      return res.redirect(`${process.env.CLIENT_URL}/profile?activated=true`);
+    } catch (e) {
+      res.status(400).json({ message: e.message });
+    }
+  }
+
+  async logout(req, res) {
+    try {
+      res.clearCookie('token');
+
+      return res.json({ message: 'Вышли из системы' });
+    } catch (e) {
+      res.status(500).json({ message: 'Ошибка логаута' });
+    }
+  }
+
+  async getProfile(req, res) {
+    try {
+      const user = await userService.getProfile(req.user.userId);
+
+      return res.json(user);
+    } catch (e) {
+      res.status(500).json({ message: e.message });
+    }
+  }
+
+  async updatePassword(req, res) {
+    try {
+      const { oldPassword, newPassword } = req.body;
+
+      await userService.updatePassword(
+        req.user.userId,
+        oldPassword,
+        newPassword,
+      );
+
+      return res.json({ message: 'Пароль успешно обновлен' });
+    } catch (e) {
+      res.status(400).json({ message: e.message });
+    }
+  }
+
+  async updateEmail(req, res) {
+    try {
+      const { password, newEmail } = req.body;
+
+      await userService.updateEmail(req.user.userId, password, newEmail);
+
+      return res.json({ message: 'Инструкции отправлены на почту' });
+    } catch (e) {
+      res.status(400).json({ message: e.message });
+    }
+  }
+}
+
+export default new UserController();


Missing updateName controller method - userService.updateName exists but there's no corresponding updateName method in the controller. Add: async updateName(req, res) { await userService.updateName(req.user.userId, req.body.name); ... }

mateacademy-ai-mentor · 2026-04-28T08:45:28Z

+
+router.put(
+  '/update-email',
+  authMiddleware,
+  body('newEmail').isEmail().withMessage('Введите корректный новый email'),
+  body('password').notEmpty().withMessage('Для подтверждения нужен пароль'),
+  validationMiddleware,
+  userController.updateEmail,


Missing confirmEmail field validation for email update. The task requires: 'type the password, confirm the new email'. Add body('confirmEmail').isEmail() and validate it equals newEmail.

mateacademy-ai-mentor · 2026-04-28T08:45:28Z

+    .withMessage('Пароль должен содержать заглавную букву'),
+  body('name').notEmpty().withMessage('Имя не может быть пустым'),
+  validationMiddleware,
+  userController.registration,
+);


SQL injection vulnerability - process.env.DB_NAME is directly interpolated into SQL queries. Use parameterized queries: SELECT 1 FROM pg_database WHERE datname = $1 with [process.env.DB_NAME].

mateacademy-ai-mentor · 2026-04-28T08:45:28Z

+    next();
+  } catch (e) {
+    return res.status(401).json({ message: 'Пользователь не авторизован' });
+  }
+}


SQL injection vulnerability - Using template literals with process.env.DB_NAME directly in SQL queries. Use parameterized queries instead: client.query('SELECT 1 FROM pg_database WHERE datname = $1', [process.env.DB_NAME])

mateacademy-ai-mentor · 2026-04-28T08:45:28Z

+
+  // --- НОВЫЕ И ИСПРАВЛЕННЫЕ МЕТОДЫ ---
+
+  // 1. Тот самый getProfile, который требовало ревью
+  async getProfile(userId) {
+    const user = await User.findByPk(userId, {
+      attributes: ['id', 'name', 'email', 'isActive'],
+    });
+
+    if (!user) {
+      throw new Error('Пользователь не найден');
+    }
+
+    return user;
+  }
+
+  // 2. Метод смены имени
+  async updateName(userId, name) {
+    const user = await User.findByPk(userId);
+
+    if (!user) {
+      throw new Error('Пользователь не найден');
+    }
+    user.name = name;
+    await user.save();
+
+    return { id: user.id, name: user.name, email: user.email };


Service layer implementation is complete. However, user.service.js still shows placeholder comments like '// --- НОВЫЕ И ИСПРАВЛЕННЫЕ МЕТОДЫ ---' and '// 1. Тот самый getProfile, который требовало ревью'. Consider cleaning up comments for production.

mateacademy-ai-mentor · 2026-04-28T08:45:28Z

+      from: process.env.SMTP_USER,
+      to,
+      subject: 'Активация аккаунта',
+      text: '',
+      html: `<div><h1>Для активации перейдите по ссылке</h1><a href="${link}">${link}</a></div>`,


SQL injection vulnerability: Using template literals with process.env.DB_NAME directly in SQL queries (lines 18, 22). Use parameterized queries instead: client.query('SELECT 1 FROM pg_database WHERE datname = $1', [process.env.DB_NAME]).

mateacademy-ai-mentor

Review Summary

All core functionality is implemented correctly with proper security measures. The ESLint configuration and email change confirmation route are minor adjustments that do not affect functionality.

✨ Please rate this review in the Platform's notification center¹. I will be grateful for your feedback! ✨

Important

Fix the issues, commit the changes, and then re-request my review using the Re-request review button² in the Reviewers tab.

Tip

If you have any comments about this review, please leave a message in the Add a comment section below and mention me with the @mateacademy-ai-mentor tag³.
I will read your message during my next review of your pull request. Please do not reply directly to my comments, as that feature is not supported yet.

Caution

Do not close the pull request until the review is complete. Closing it early can lead to unexpected behavior and disrupt the review process.

vadiimvooo

Well done

solution

fc465ed

mateacademy-ai-mentor suggested changes Apr 28, 2026

View reviewed changes

fixed

fd20ac9

Moddderi requested a review from mateacademy-ai-mentor April 28, 2026 08:41

mateacademy-ai-mentor suggested changes Apr 28, 2026

View reviewed changes

Fixed secondary bugs

4a3a10c

Moddderi requested a review from mateacademy-ai-mentor April 28, 2026 08:56

mateacademy-ai-mentor suggested changes Apr 28, 2026

View reviewed changes

vadiimvooo approved these changes Apr 28, 2026

View reviewed changes

		@@ -0,0 +1,97 @@
		import userService from '../services/user.service.js';

Conversation

Moddderi commented Apr 28, 2026

Uh oh!

mateacademy-ai-mentor left a comment

Choose a reason for hiding this comment

Review Summary

Footnotes

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mateacademy-ai-mentor left a comment

Choose a reason for hiding this comment

Review Summary

Footnotes

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mateacademy-ai-mentor left a comment

Choose a reason for hiding this comment

Review Summary

Footnotes

Uh oh!

vadiimvooo left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants