add task implementation by ANDRIYTS1234 · Pull Request #277 · mate-academy/node_auth-app

ANDRIYTS1234 · 2026-05-04T11:10:53Z

No description provided.

mateacademy-ai-mentor

Review Summary

The implementation has several critical blockers that prevent task completion. Password validation is insufficient - it only checks length > 6, but requirements explicitly state users must be informed of password rules and validation must check them (uppercase, lowercase, numbers, special characters). Auth routes lack non-authenticated user guards - registration, login, forgot-password, and reset-password must be accessible ONLY to non-authenticated users as explicitly required. Error handlers use incorrect status codes - res.send() returns implicit 200 for errors instead of 400/401/403/500. Registration endpoint returns the hashed password in the response, creating a security vulnerability. Logout route is unprotected - it has no authMiddleware despite being an authenticated-only operation. Activation doesn't clear the activationToken after successful use. Email change immediately updates without requiring confirmation from the new email. The changePassword function also doesn't validate the new password against the same rules enforced at registration. Additionally, ESLint configuration is missing TypeScript parser support, preventing code validation. These issues must be addressed before approval.

✨ Please rate this review in the Platform's notification center¹. I will be grateful for your feedback! ✨

Important

Fix the issues, commit the changes, and then re-request my review using the Re-request review button² in the Reviewers tab.

Tip

If you have any comments about this review, please leave a message in the Add a comment section below and mention me with the @mateacademy-ai-mentor tag³.
I will read your message during my next review of your pull request. Please do not reply directly to my comments, as that feature is not supported yet.

Caution

Do not close the pull request until the review is complete. Closing it early can lead to unexpected behavior and disrupt the review process.

mateacademy-ai-mentor · 2026-05-04T11:15:05Z

+    'no-return-await': 'off',
  },
-  plugins: ['jest']
+  plugins: ['jest', '@typescript-eslint']


The registration route doesn't check if user is already authenticated. The task requires this route be accessible ONLY to non-authenticated users.

mateacademy-ai-mentor · 2026-05-04T11:15:05Z

+    '@typescript-eslint/no-unused-vars': ['warn'],
+    'no-shadow': 'off',
+    '@typescript-eslint/no-shadow': ['error'],
+    'no-return-await': 'off',


Error handlers use res.send() with status 200 instead of res.status(). For errors, appropriate status codes like 400 (Bad Request), 401 (Unauthorized), 403 (Forbidden) should be used.

mateacademy-ai-mentor · 2026-05-04T11:15:06Z

+    res.send({ error: (error as Error).message });
+  }
+};


The password validation only checks length > 6. The requirements state: 'Inform users about the rules for a password and check them'. Consider implementing more comprehensive password rules that can be shown to users during registration.

mateacademy-ai-mentor · 2026-05-04T11:15:06Z

+
+    res.send('Акаунт активовано');


The activation endpoint returns plain text 'Акаунт активовано'. The requirements state: 'redirect to Profile after the activation'. Since this is an API endpoint, consider returning a response that indicates successful activation so the frontend can redirect (e.g., status code 200 with a success indicator, or redirect URL).

mateacademy-ai-mentor · 2026-05-04T11:15:06Z

+
+    res.send({ message: 'Успішний вихід' });


The logout endpoint returns a success message but the requirements state: 'Redirect to login after logging out'. Consider returning an appropriate status code so the frontend can redirect to login.

mateacademy-ai-mentor · 2026-05-04T11:15:06Z

+    res.send({ message: "Ім'я змінено" });
+  } catch (error) {
+    res.send({ error: (error as Error).message });
+  }


The activation catch block uses console.log instead of sending an error response to the client, silently failing on errors.

mateacademy-ai-mentor · 2026-05-04T11:15:06Z

+export const updateName = async (req: Request, res: Response) => {
+  try {
+    const email = (req as any).user.email;
+    const { newName } = req.body;


The task requires confirming new email before the change takes effect. Currently, email is changed immediately. Consider implementing a two-step confirmation where the new email must be verified first.

mateacademy-ai-mentor · 2026-05-04T11:15:06Z

+
+    return;


The Token model limits refreshToken to 500 characters. JWT tokens can vary in size depending on the claims and algorithm. Consider using TEXT type or increasing the limit to prevent potential truncation issues.

mateacademy-ai-mentor · 2026-05-04T11:15:06Z

+  @Column({
+    type: DataType.STRING(500),
+    allowNull: false,
+    unique: true,


The authMiddleware doesn't validate the token format before accessing it. If header is 'Bearer' without a token, split()[1] would be undefined. Consider adding validation for the token existence after the split.

mateacademy-ai-mentor · 2026-05-04T11:15:06Z

+
+authRouter.post('/registration', registration);
+authRouter.get('/activation/:activationToken', activation);
+authRouter.post('/login', login);
+authRouter.post('/refresh', refreshing);
+authRouter.post('/logout', logout);
+
+authRouter.post('/forgot-password', forgotPassword);


The authRouter doesn't have middleware to restrict registration, login, forgot-password, and reset-password routes to non-authenticated users only. The task requires these routes be accessible ONLY to non-authenticated users.

mateacademy-ai-mentor · 2026-05-04T11:15:10Z

+authRouter.post('/logout', logout);
+


The password validation only checks length > 6 characters. The task requires informing users about password rules and validating against them. Consider implementing comprehensive password rules (uppercase, lowercase, numbers, special characters) that can be displayed to users during registration.

mateacademy-ai-mentor · 2026-05-04T11:15:10Z

+  const existingUser = await User.findOne({ where: { email: email } });
+
+  if (existingUser) {
+    throw new Error('Користувач з таким емейлом уже зареєстрований');
+  }
+
+  if (password.length < 6) {
+    throw new Error('Довжина паролю має бути більше 6 символів');
+  }


The authRouter lacks middleware to restrict registration, login, forgot-password, and reset-password routes to non-authenticated users only. The requirements explicitly state these routes should be accessible ONLY to non-authenticated users.

mateacademy-ai-mentor · 2026-05-04T11:15:10Z

+
+  return {
+    user,
+    accessToken,
+    refreshToken,


The login function returns the full user object which includes the hashed password. Consider returning only necessary user data (id, name, email) without sensitive fields.

mateacademy-ai-mentor · 2026-05-04T11:15:10Z

+
+  user.isActive = true;


The activate function sets isActive to true but doesn't clear the activationToken. After activation, the token remains in the database which is unnecessary and could be a security concern.

mateacademy-ai-mentor · 2026-05-04T11:15:10Z

+
+  if (password.length < 6) {
+    throw new Error('Довжина паролю має бути більше 6 символів');


The password validation only checks length > 6 characters. The requirements state to 'Inform users about the rules for a password and check them'. Consider implementing comprehensive password rules (uppercase, lowercase, numbers, special characters) that can be displayed to users.

mateacademy-ai-mentor · 2026-05-04T11:15:10Z

+
+export const sendActivationEmail = async (
+  email: string,
+  activationToken: string,
+) => {
+  await transporter.sendMail({
+    from: process.env.SMTP_USER,
+    to: email,
+    subject: 'Активація акаунта',


The authRouter has no middleware to restrict routes to non-authenticated users. According to requirements, registration, login, activation, and password reset must be accessible ONLY to non-authenticated users. Consider adding middleware to check if user is already authenticated on these routes.

mateacademy-ai-mentor · 2026-05-04T11:15:10Z

+  email: string,
+  activationToken: string,
+) => {
+  await transporter.sendMail({


The logout route has no authentication middleware. According to requirements, logout must be accessible only to authenticated users. Consider adding authMiddleware to this route.

mateacademy-ai-mentor · 2026-05-04T11:15:10Z

+  await transporter.sendMail({
+    from: process.env.SMTP_USER,
+    to: email,


The password validation only checks for minimum length (6 characters). The task requires informing users about password rules and validating them. Consider implementing more comprehensive validation (uppercase, lowercase, numbers, special characters) and returning clear error messages about all failed rules.

mateacademy-ai-mentor · 2026-05-04T11:15:10Z

+  secure: false,
+  auth: {
+    user: process.env.SMTP_USER as string,
+    pass: process.env.SMTP_PASSWORD as string,
+  },


The register function doesn't validate email format before saving to the database. Invalid email formats could be stored.

mateacademy-ai-mentor · 2026-05-04T11:15:10Z

+import { authMiddleware } from '../middlewares/authMiddleware';
+
+export const userRouter = Router();
+


The routes are well-structured and the userRouter correctly applies authMiddleware to all protected routes.

mateacademy-ai-mentor · 2026-05-04T11:15:15Z

+
+  const hashedNewPass = await bcrypt.hash(newPassword, 10);
+
+  user.password = hashedNewPass;


The changePassword function doesn't validate the new password against the same rules used during registration. Consider applying consistent password validation to ensure the new password meets requirements (such as minimum length and complexity rules).

mateacademy-ai-mentor · 2026-05-04T11:15:15Z

+
+  const newActivationToken = uuidv4();
+
+  user.email = newEmail;
+  user.activationToken = newActivationToken;
+  user.isActive = false;
+


The email change flow correctly requires password validation, sends activation to the new email, and notifies the old email address. However, the new email is immediately updated without waiting for confirmation. Consider whether the new email should be verified first before finalizing the change.

mateacademy-ai-mentor · 2026-05-04T11:15:15Z

+{
+  "compilerOptions": {
+    "target": "ES2020",
+    "module": "CommonJS",
+    "moduleResolution": "node",
+    "ignoreDeprecations": "6.0",
+    "outDir": "./dist",
+    "rootDir": "./src",
+    "strict": true,
+    "types": ["node"],
+    "experimentalDecorators": true,
+    "emitDecoratorMetadata": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true
+  },
+  "include": ["src/**/*"]


The tsconfig.json is properly configured with necessary options for TypeScript compilation, including decorators support for sequelize-typescript, strict mode, and CommonJS module output.

mateacademy-ai-mentor

Review Summary

Your implementation has 7 critical blockers that must be fixed before approval:

Password validation is incomplete (REQ-4) - Currently only checks length > 6. You must add regex validation requiring uppercase, lowercase, numbers, and special characters. Update both register and changePassword functions.
Registration exposes hashed password - res.send(newUser) returns the entire user object including the password field. Return only safe fields like { id, name, email, isActive } instead.
Missing route guards for non-authenticated users (REQ-2, REQ-6, REQ-10, REQ-15) - Registration, login, forgot-password, reset-password, and activation routes are accessible to all users. Add notAuthMiddleware to these routes in authRouter.ts.
Logout route is unprotected (REQ-13) - Add authMiddleware to the logout route.
ActivationToken not cleared after use - After successful activation, set user.activationToken = null before saving.
Error handlers return HTTP 200 status - Use res.status(400/401/500).send() instead of res.send() for all error responses.
changePassword doesn't validate new password - Apply the same password rules (uppercase, lowercase, numbers, special characters) in userService.ts.

These issues represent security vulnerabilities and broken functionality that violate explicit task requirements. Please address all 7 issues and resubmit.

✨ Please rate this review in the Platform's notification center¹. I will be grateful for your feedback! ✨

Important

Fix the issues, commit the changes, and then re-request my review using the Re-request review button² in the Reviewers tab.

Tip

If you have any comments about this review, please leave a message in the Add a comment section below and mention me with the @mateacademy-ai-mentor tag³.
I will read your message during my next review of your pull request. Please do not reply directly to my comments, as that feature is not supported yet.

Caution

Do not close the pull request until the review is complete. Closing it early can lead to unexpected behavior and disrupt the review process.

mateacademy-ai-mentor · 2026-05-04T11:27:15Z

  rules: {
-    'no-proto': 0
+    'no-proto': 0,
+    'no-console': 0,


Security issue: res.send(newUser) returns the entire user object including the hashed password field. This exposes sensitive data to the client. Return only safe fields like { message: '...', user: { id, name, email } } or { message: '...' }.

mateacademy-ai-mentor · 2026-05-04T11:27:16Z

+    'no-proto': 0,
+    'no-console': 0,
+    'indent': 'off',
+    '@typescript-eslint/no-shadow': ['error'],


Error handler uses res.send() which returns HTTP 200 status. Should use res.status(400/401/500).send() for error responses to comply with REST conventions.

mateacademy-ai-mentor · 2026-05-04T11:27:16Z

+    '@typescript-eslint/no-unused-vars': ['warn'],
+    'no-shadow': 'off',
+    '@typescript-eslint/no-shadow': ['error'],
+    'no-return-await': 'off',


Password validation only checks length > 6, but requirements state users must be informed of rules AND validation must check them (uppercase, lowercase, numbers, special characters). Add regex validation for these rules.

mateacademy-ai-mentor · 2026-05-04T11:27:16Z

  },
  rules: {
-    'no-proto': 0
+    'no-proto': 0,


Error handler uses implicit 200 status. Should use appropriate error status codes.

mateacademy-ai-mentor · 2026-05-04T11:27:16Z

  },
-  plugins: ['jest']
+  plugins: ['jest', '@typescript-eslint']
 };


Error handler uses implicit 200 status. Should use appropriate error status codes.

mateacademy-ai-mentor · 2026-05-04T11:27:16Z

+    jest: true,
+    node: true,
  },
  rules: {


Requirement not met: Registration route is accessible to all users. According to REQ-2, registration must be accessible ONLY to non-authenticated users. Add a guard middleware like notAuthMiddleware.

mateacademy-ai-mentor · 2026-05-04T11:27:16Z

  rules: {
-    'no-proto': 0
+    'no-proto': 0,
+    'no-console': 0,


Requirement not met: Login route is accessible to all users. According to REQ-10, login must be accessible ONLY to non-authenticated users. Add a guard middleware.

mateacademy-ai-mentor · 2026-05-04T11:27:16Z

+    '@typescript-eslint/no-unused-vars': ['warn'],
+    'no-shadow': 'off',
+    '@typescript-eslint/no-shadow': ['error'],
+    'no-return-await': 'off',


Requirement not met: Forgot password route is accessible to all users. According to REQ-15, it must be accessible ONLY to non-authenticated users. Add a guard middleware.

mateacademy-ai-mentor · 2026-05-04T11:27:16Z

+    'no-shadow': 'off',
+    '@typescript-eslint/no-shadow': ['error'],
+    'no-return-await': 'off',
  },


Requirement not met: Reset password route is accessible to all users. According to REQ-15, it must be accessible ONLY to non-authenticated users. Add a guard middleware.

mateacademy-ai-mentor · 2026-05-04T11:27:16Z

+  },
  env: {
-    jest: true
+    jest: true,


Requirement not met: Activation route is accessible to all users. According to REQ-6, activation page must be accessible ONLY to non-authenticated users. Add a guard middleware.

mateacademy-ai-mentor · 2026-05-04T11:27:20Z

+
+    await activate(activationToken);


Password validation only checks length > 6. Per requirements, users must be informed of password rules and validation must check them (uppercase, lowercase, numbers, special characters).

mateacademy-ai-mentor · 2026-05-04T11:27:20Z

+
+  try {
+    const newUser = await register(name, email, password);
+


Registration returns the entire user object including hashed password - this is a security vulnerability. Should return user-safe data only (id, name, email).

mateacademy-ai-mentor · 2026-05-04T11:27:20Z

+    const refreshToken = req.cookies.refreshToken;
+


Activation succeeds but doesn't clear the activationToken. The token remains valid after use.

mateacademy-ai-mentor · 2026-05-04T11:27:20Z

+};
+
+export const login = async (req: Request, res: Response) => {
+  try {


changePassword doesn't validate the new password against the password rules enforced at registration. Should check for uppercase, lowercase, numbers, and special characters.

mateacademy-ai-mentor · 2026-05-04T11:27:20Z

+
+    res.send(result.newAccessToken);
+  } catch (error) {
+    res.send({ error: (error as Error).message });


changeEmail immediately updates the email and deactivates the account without requiring confirmation from the new email. Per requirements, email should only change after new email confirmation.

mateacademy-ai-mentor · 2026-05-04T11:27:20Z

+    const newUser = await register(name, email, password);
+
+    res.send(newUser);
+  } catch (error) {


Error responses use res.send() which returns implicit 200 status. Should use res.status(400).send() or similar for validation errors.

mateacademy-ai-mentor · 2026-05-04T11:27:20Z

+    res.send('Акаунт активовано');
+  } catch (error) {


Error responses use res.send() with implicit 200 status. Should return appropriate status codes (401 for unauthorized, 400 for bad request, 500 for server errors).

mateacademy-ai-mentor · 2026-05-04T11:27:20Z

+    });
+
+    res.send({ user: resObj.user, accessToken: resObj.accessToken });
+  } catch (error) {


Error responses use res.send() with implicit 200 status instead of proper error status codes.

mateacademy-ai-mentor · 2026-05-04T11:27:20Z

+    res.clearCookie('refreshToken');
+
+    res.send({ message: 'Успішний вихід' });
+  } catch (error) {


Error responses use res.send() with implicit 200 status instead of proper error status codes.

mateacademy-ai-mentor · 2026-05-04T11:27:20Z

+
+    await forgotPass(email);
+    res.send({ message: 'Лист для відновлення пароля відправлено' });
+  } catch (error) {


Error responses use res.send() with implicit 200 status instead of proper error status codes.

mateacademy-ai-mentor · 2026-05-04T11:27:25Z

+
+    await resetPass(resetToken, password);
+    res.send({ message: 'Пароль успішно змінено' });
+  } catch (error) {


Error responses use res.send() with implicit 200 status instead of proper error status codes.

mateacademy-ai-mentor · 2026-05-04T11:27:25Z

+    pass: process.env.SMTP_PASSWORD as string,
+  },
+});
+


Registration route lacks guard for non-authenticated users. Per REQ-2, registration must be accessible ONLY to non-authenticated users. Add a notAuthMiddleware.

mateacademy-ai-mentor · 2026-05-04T11:27:25Z

+  },
+});
+
+export const sendActivationEmail = async (


Activation route lacks guard for non-authenticated users. Per REQ-6, activation must be accessible ONLY to non-authenticated users. Add a notAuthMiddleware.

mateacademy-ai-mentor · 2026-05-04T11:27:25Z

+});
+
+export const sendActivationEmail = async (
+  email: string,


Login route lacks guard for non-authenticated users. Per REQ-10, login must be accessible ONLY to non-authenticated users. Add a notAuthMiddleware.

mateacademy-ai-mentor · 2026-05-04T11:27:25Z

+export const sendActivationEmail = async (
+  email: string,
+  activationToken: string,
+) => {


Logout route is missing authMiddleware. Per REQ-13, logout must be accessible ONLY to authenticated users. Add authMiddleware to this route.

mateacademy-ai-mentor · 2026-05-04T11:27:25Z

+) => {
+  await transporter.sendMail({
+    from: process.env.SMTP_USER,
+    to: email,


Forgot-password route lacks guard for non-authenticated users. Per REQ-15, it must be accessible ONLY to non-authenticated users. Add a notAuthMiddleware.

mateacademy-ai-mentor · 2026-05-04T11:27:25Z

+  await transporter.sendMail({
+    from: process.env.SMTP_USER,
+    to: email,
+    subject: 'Активація акаунта',


Reset-password route lacks guard for non-authenticated users. Per REQ-15, it must be accessible ONLY to non-authenticated users. Add a notAuthMiddleware.

mateacademy-ai-mentor · 2026-05-04T11:27:25Z

+  await transporter.sendMail({
+    from: process.env.SMTP_USER,
+    to: email,


Password validation only checks length < 6. Per REQ-3 and REQ-4, users must be informed of password rules and validation must check them (uppercase, lowercase, numbers, special characters).

mateacademy-ai-mentor · 2026-05-04T11:27:25Z

+    from: process.env.SMTP_USER,
+    to: email,
+    subject: 'Відновлення пароля',
+    html: `<a href="${process.env.CLIENT_URL}/reset-password/${resetToken}">Змінити пароль</a>`,


Registration returns the entire user object including the hashed password. This is a security vulnerability - the response should only return a success message.

mateacademy-ai-mentor · 2026-05-04T11:27:25Z

+
+  if (existingUser) {
+    throw new Error('Користувач з таким емейлом уже зареєстрований');
+  }


REQ-13 not met: Logout route has no authMiddleware. Per requirements, logout must be accessible ONLY to authenticated users. Add authMiddleware here.

mateacademy-ai-mentor · 2026-05-04T11:27:30Z

+  const existingUser = await User.findOne({ where: { email: email } });
+
+  if (existingUser) {
+    throw new Error('Користувач з таким емейлом уже зареєстрований');
+  }
+
+  if (password.length < 6) {
+    throw new Error('Довжина паролю має бути більше 6 символів');


REQ-2, REQ-6, REQ-10, REQ-15 not met: These routes lack non-authenticated user guards. Per requirements, registration, activation, login, forgot-password, and reset-password must be accessible ONLY to non-authenticated users. Need to create and apply a notAuthMiddleware to these routes.

mateacademy-ai-mentor · 2026-05-04T11:27:30Z

+
+  if (password.length < 6) {
+    throw new Error('Довжина паролю має бути більше 6 символів');


REQ-4 not met: Password validation only checks length > 6. Per requirements, validation must check for uppercase, lowercase, numbers, and special characters. Add regex validation for these rules.

mateacademy-ai-mentor · 2026-05-04T11:27:30Z

+  });
+
+  await sendActivationEmail(email, activationToken);
+


Security issue: return newUser exposes the user object including hashed password to the controller. Return only safe data like { message: '...' } or extract only safe fields.

mateacademy-ai-mentor · 2026-05-04T11:27:30Z

+
+  user.isActive = true;


Security issue: After activation, the activationToken is not cleared from the user record. It should be set to null to prevent token reuse.

mateacademy-ai-mentor · 2026-05-04T11:27:30Z

+  if (!user) {
+    throw new Error('Недійсне або застаріле посилання');
+  }
+


REQ-4 not met: The new password is not validated against the stated password rules. The resetPassword function should check for uppercase, lowercase, numbers, and special characters.

mateacademy-ai-mentor · 2026-05-04T11:27:30Z

+} from '../controllers/authController';
+
+export const authRouter = Router();
+


REQ-2 not met: Registration route is accessible to all users. Per requirements, registration must be accessible ONLY to non-authenticated users. Add notAuthMiddleware guard.

mateacademy-ai-mentor · 2026-05-04T11:27:30Z

+
+export const authRouter = Router();
+
+authRouter.post('/registration', registration);


REQ-6 not met: Activation route is accessible to all users. Per requirements, activation must be accessible ONLY to non-authenticated users. Add notAuthMiddleware guard.

mateacademy-ai-mentor · 2026-05-04T11:27:30Z

+export const authRouter = Router();
+
+authRouter.post('/registration', registration);
+authRouter.get('/activation/:activationToken', activation);


REQ-10 not met: Login route is accessible to all users. Per requirements, login must be accessible ONLY to non-authenticated users. Add notAuthMiddleware guard.

mateacademy-ai-mentor · 2026-05-04T11:27:30Z

+authRouter.post('/registration', registration);
+authRouter.get('/activation/:activationToken', activation);
+authRouter.post('/login', login);
+authRouter.post('/refresh', refreshing);


REQ-13 not met: Logout route is not protected. Per requirements, logout must be accessible ONLY to authenticated users. Add authMiddleware guard.

mateacademy-ai-mentor · 2026-05-04T11:27:30Z

+authRouter.post('/login', login);
+authRouter.post('/refresh', refreshing);
+authRouter.post('/logout', logout);
+


REQ-15 not met: Forgot password route is accessible to all users. Per requirements, password reset must be accessible ONLY to non-authenticated users. Add notAuthMiddleware guard.

mateacademy-ai-mentor · 2026-05-04T11:27:34Z

+authRouter.post('/refresh', refreshing);
+authRouter.post('/logout', logout);
+
+authRouter.post('/forgot-password', forgotPassword);


REQ-15 not met: Reset password route is accessible to all users. Per requirements, password reset must be accessible ONLY to non-authenticated users. Add notAuthMiddleware guard.

mateacademy-ai-mentor · 2026-05-04T11:27:34Z

+authRouter.post('/logout', logout);
+
+authRouter.post('/forgot-password', forgotPassword);


REQ-4 not met: Password validation only checks length < 6. Per requirements, users must be informed of password rules AND validation must check them (uppercase, lowercase, numbers, special characters). Add regex validation for these rules.

mateacademy-ai-mentor · 2026-05-04T11:27:34Z

+
+userRouter.use(authMiddleware);
+
+userRouter.patch('/name', updateName);


Requirement not met: Registration route is accessible to all users. Per REQ-2, registration must be accessible ONLY to non-authenticated users. Add a guard middleware (e.g., notAuthMiddleware).

mateacademy-ai-mentor · 2026-05-04T11:27:34Z

+userRouter.use(authMiddleware);
+
+userRouter.patch('/name', updateName);
+userRouter.patch('/email', updateEmail);


Requirement not met: Activation route is accessible to all users. Per REQ-6, activation page must be accessible ONLY to non-authenticated users. Add a guard middleware.

mateacademy-ai-mentor · 2026-05-04T11:27:34Z

+
+userRouter.patch('/name', updateName);
+userRouter.patch('/email', updateEmail);
+userRouter.patch('/password', updatePassword);


Requirement not met: Login route is accessible to all users. Per REQ-10, login must be accessible ONLY to non-authenticated users. Add a guard middleware.

mateacademy-ai-mentor · 2026-05-04T11:27:34Z

+
+export const changePassword = async (
+  email: string,
+  oldPassword: string,
+  newPassword: string,
+) => {
+  const user = await User.findOne({ where: { email } });
+
+  if (!user) {
+    throw new Error('Користувача не існує');
+  }
+
+  const valid = await bcrypt.compare(oldPassword, user.password);
+
+  if (!valid) {
+    throw new Error('Невірний старий пароль');
+  }
+
+  const hashedNewPass = await bcrypt.hash(newPassword, 10);
+
+  user.password = hashedNewPass;
+  await user.save();


The changePassword function doesn't validate the new password against the stated password rules. Per requirements, the new password must follow the same rules enforced during registration (uppercase, lowercase, numbers, special characters). Add validation similar to what's in the register function in authService.ts.

mateacademy-ai-mentor

Review Summary

The implementation shows solid progress with correct password validation, proper route guards, token cleanup, and safe field patterns. However, two key issues need fixing: (1) Express response chaining must be corrected from 'res.send(201).send(newUser)' to 'res.status(201).send(newUser)', and (2) Data exposure in login/refresh functions must be addressed by returning only safe fields like { id, name, email, isActive } instead of the full Sequelize User object. A minor fix is also needed in authMiddleware.ts where the error message typo 'He авторизовано' should use Cyrillic 'Не'. These fixes will make the auth system production-ready.

✨ Please rate this review in the Platform's notification center¹. I will be grateful for your feedback! ✨

Important

Fix the issues, commit the changes, and then re-request my review using the Re-request review button² in the Reviewers tab.

Tip

If you have any comments about this review, please leave a message in the Add a comment section below and mention me with the @mateacademy-ai-mentor tag³.
I will read your message during my next review of your pull request. Please do not reply directly to my comments, as that feature is not supported yet.

Caution

Do not close the pull request until the review is complete. Closing it early can lead to unexpected behavior and disrupt the review process.

mateacademy-ai-mentor · 2026-05-05T11:22:18Z

  rules: {
-    'no-proto': 0
+    'no-proto': 0,
+    'no-console': 0,


Invalid syntax: res.send(201).send(newUser). Express res.send() returns Response but chaining two send() calls causes TypeError. Use res.status(201).send(newUser) instead.

mateacademy-ai-mentor · 2026-05-05T11:22:18Z

+    'no-proto': 0,
+    'no-console': 0,
+    'indent': 'off',
+    '@typescript-eslint/no-shadow': ['error'],


Invalid syntax: res.send(400).send(...). Use res.status(400).send(...).

mateacademy-ai-mentor · 2026-05-05T11:22:18Z

  },
-  plugins: ['jest']
+  plugins: ['jest', '@typescript-eslint']
 };


Invalid syntax: res.send(200).send(...). Use res.status(200).send(...).

mateacademy-ai-mentor · 2026-05-05T11:22:18Z

-    jest: true
+    jest: true,
+    node: true,
  },


Invalid syntax: res.send(200).send(...). Use res.status(200).send(...).

mateacademy-ai-mentor · 2026-05-05T11:22:18Z

  },
  rules: {
-    'no-proto': 0
+    'no-proto': 0,


Invalid syntax: res.send(400).send(...). Use res.status(400).send(...).

mateacademy-ai-mentor · 2026-05-05T11:22:18Z

+    'no-shadow': 'off',
+    '@typescript-eslint/no-shadow': ['error'],
+    'no-return-await': 'off',
  },


Invalid syntax: res.send(200).send(...). Use res.status(200).send(...).

mateacademy-ai-mentor · 2026-05-05T11:22:18Z

  },
-  plugins: ['jest']
+  plugins: ['jest', '@typescript-eslint']
 };


Invalid syntax: res.send(400).send(...). Use res.status(400).send(...).

mateacademy-ai-mentor · 2026-05-05T11:22:18Z

+
+    res.send(200).send({ message: 'Лист для підтвердження відправлено на нову пошту' });
+  } catch (error) {
+    res.send(400).send({ error: (error as Error).message });


BUG: res.send() returns undefined, so .send(newUser) never executes. Use res.status(201).send(newUser) instead.

mateacademy-ai-mentor · 2026-05-05T11:22:18Z

+    await changeName(email, newName);
+
+    res.send(200).send({ message: "Ім'я змінено" });
+  } catch (error) {


BUG: Should be res.status(200).send(...)

mateacademy-ai-mentor · 2026-05-05T11:22:18Z

+    res.send(200).send({ message: "Ім'я змінено" });
+  } catch (error) {
+    res.send(400).send({ error: (error as Error).message });
+  }


BUG: Should be res.status(400).send(...)

mateacademy-ai-mentor · 2026-05-05T11:22:23Z

+
+    await changePassword(email, oldPassword, newPassword);
+
+    res.send(200).send({ message: 'Пароль змінено' });


BUG: Should be res.status(200).send({ user: resObj.user, accessToken: resObj.accessToken })

mateacademy-ai-mentor · 2026-05-05T11:22:23Z

+
+    res.send(200).send({ message: 'Пароль змінено' });
+  } catch (error) {
+    res.send(400).send({ error: (error as Error).message });


BUG: Should be res.status(401).send(...)

mateacademy-ai-mentor · 2026-05-05T11:22:23Z

+    const { newEmail, password } = req.body;
+
+    await changeEmail(oldEmail, newEmail, password);
+


BUG: Should be res.status(200).send(...)

mateacademy-ai-mentor · 2026-05-05T11:22:23Z

+    await changeEmail(oldEmail, newEmail, password);
+
+    res.send(200).send({ message: 'Лист для підтвердження відправлено на нову пошту' });
+  } catch (error) {


BUG: Should be res.status(400).send(...)

mateacademy-ai-mentor · 2026-05-05T11:22:23Z

+    const { newName } = req.body;
+
+    await changeName(email, newName);
+


BUG: Should be res.status(200).send(...)

mateacademy-ai-mentor · 2026-05-05T11:22:23Z

+    await changeName(email, newName);
+
+    res.send(200).send({ message: "Ім'я змінено" });
+  } catch (error) {


BUG: Should be res.status(400).send(...)

mateacademy-ai-mentor · 2026-05-05T11:22:23Z

+    }
+
+    await changePassword(email, oldPassword, newPassword);
+


BUG: Should be res.status(200).send(...)

mateacademy-ai-mentor · 2026-05-05T11:22:23Z

+    await changePassword(email, oldPassword, newPassword);
+
+    res.send(200).send({ message: 'Пароль змінено' });
+  } catch (error) {


BUG: Should be res.status(400).send(...)

mateacademy-ai-mentor · 2026-05-05T11:22:23Z

+
+  try {
+    const newUser = await register(name, email, password);
+


BUG: res.send(201).send(newUser) is incorrect. res.send() sends the response and cannot be chained with another send(). Use res.status(201).send(newUser) instead. Same issue on all error handlers in this file - should be res.status(400).send(...).

mateacademy-ai-mentor · 2026-05-05T11:22:24Z

+    const newUser = await register(name, email, password);
+
+    res.send(201).send(newUser);
+  } catch (error) {


BUG: res.send(400).send(...) should be res.status(400).send(...). The send() method ends the response cycle.

mateacademy-ai-mentor · 2026-05-05T11:22:28Z

+    const activationToken = req.params.activationToken as string;
+
+    await activate(activationToken);
+


BUG: res.send(200).send(...) should be res.status(200).send(...).

mateacademy-ai-mentor · 2026-05-05T11:22:28Z

+    await activate(activationToken);
+
+    res.send(200).send('Акаунт активовано');
+  } catch (error) {


BUG: res.send(400).send(...) should be res.status(400).send(...).

mateacademy-ai-mentor · 2026-05-05T11:22:28Z

+      maxAge: 30 * 24 * 60 * 60 * 1000,
+      httpOnly: true,
+    });
+


SECURITY ISSUE: resObj.user returns the entire Sequelize User object including the hashed password field. Return only safe fields like { id, name, email, isActive } instead.

mateacademy-ai-mentor · 2026-05-05T11:22:28Z

+    });
+
+    res.send(200).send({ user: resObj.user, accessToken: resObj.accessToken });
+  } catch (error) {


BUG: res.send(401).send(...) should be res.status(401).send(...).

mateacademy-ai-mentor · 2026-05-05T11:22:28Z

+      maxAge: 30 * 24 * 60 * 60 * 1000,
+      httpOnly: true,
+    });
+


BUG: res.send(200).send(...) should be res.status(200).send(...).

mateacademy-ai-mentor · 2026-05-05T11:22:28Z

+    });
+
+    res.send(200).send(result.newAccessToken);
+  } catch (error) {


BUG: res.send(401).send(...) should be res.status(401).send(...).

mateacademy-ai-mentor · 2026-05-05T11:22:28Z

+    await lout(refreshToken);
+
+    res.clearCookie('refreshToken');
+


BUG: res.send(204).send(...) should be res.status(204).send(...) or simply res.sendStatus(204).

mateacademy-ai-mentor · 2026-05-05T11:22:28Z

+    res.clearCookie('refreshToken');
+
+    res.send(204).send({ message: 'Успішний вихід' });
+  } catch (error) {


BUG: res.send(400).send(...) should be res.status(400).send(...).

mateacademy-ai-mentor · 2026-05-05T11:22:28Z

+  try {
+    const email = req.body.email;
+
+    await forgotPass(email);


BUG: res.send(200).send(...) should be res.status(200).send(...).

mateacademy-ai-mentor · 2026-05-05T11:22:28Z

+
+    await forgotPass(email);
+    res.send(200).send({ message: 'Лист для відновлення пароля відправлено' });
+  } catch (error) {


BUG: res.send(400).send(...) should be res.status(400).send(...).

mateacademy-ai-mentor · 2026-05-05T11:22:32Z

+      throw new Error('Паролі не збігаються');
+    }
+
+    await resetPass(resetToken, password);


BUG: res.send(200).send(...) should be res.status(200).send(...).

mateacademy-ai-mentor · 2026-05-05T11:22:32Z

+
+    await resetPass(resetToken, password);
+    res.send(200).send({ message: 'Пароль успішно змінено' });
+  } catch (error) {


BUG: res.send(400).send(...) should be res.status(400).send(...).

mateacademy-ai-mentor · 2026-05-05T11:22:32Z

+  const { name, email, password } = req.body;
+
+  try {
+    const newUser = await register(name, email, password);


BUG: res.send(400).send(...) should be res.status(400).send(...).

mateacademy-ai-mentor · 2026-05-05T11:22:32Z

+  try {
+    const activationToken = req.params.activationToken as string;
+
+    await activate(activationToken);


BUG: res.send(400).send(...) should be res.status(400).send(...).

mateacademy-ai-mentor · 2026-05-05T11:22:33Z

+    const activationToken = req.params.activationToken as string;
+
+    await activate(activationToken);
+


BUG: res.send(400).send(...) should be res.status(400).send(...).

mateacademy-ai-mentor · 2026-05-05T11:22:33Z

+      maxAge: 30 * 24 * 60 * 60 * 1000,
+      httpOnly: true,
+    });
+


BUG: res.send(400).send(...) should be res.status(400).send(...).

mateacademy-ai-mentor · 2026-05-05T11:22:33Z

+      httpOnly: true,
+    });
+
+    res.send(200).send({ user: resObj.user, accessToken: resObj.accessToken });


BUG: res.send(400).send(...) should be res.status(400).send(...).

mateacademy-ai-mentor · 2026-05-05T11:22:33Z

+) => {
+  const header = req.headers.authorization;
+
+  if (!header) {


Minor: 'He авторизовано' appears to be a typo (Latin 'He' instead of Cyrillic 'Не'), but matches the pattern on line 25 where 'Не авторизовано' is used correctly.

mateacademy-ai-mentor · 2026-05-05T11:22:33Z

+    refreshToken: refreshToken,
+  });
+
+  return {


SECURITY ISSUE: Returns entire User object including hashed password. Change to { id: user.id, name: user.name, email: user.email, isActive: user.isActive } to match the safe pattern used in register function (lines 37-42).

Anton-Kuchmasov

Good job!

Anton-Kuchmasov · 2026-05-05T13:03:04Z

+  const user = await User.findOne({ where: { email } });
+
+  if (!user) {
+    throw new Error('Невірний емейл або пароль');


consider avoiding non-English comments in your code

add task implementation

44d33f8

mateacademy-ai-mentor suggested changes May 4, 2026

View reviewed changes

mateacademy-ai-mentor reviewed May 4, 2026

View reviewed changes

add linter changes

768104a

ANDRIYTS1234 requested a review from mateacademy-ai-mentor May 4, 2026 11:23

mateacademy-ai-mentor suggested changes May 4, 2026

View reviewed changes

mateacademy-ai-mentor reviewed May 4, 2026

View reviewed changes

add needed changes

6c35dea

ANDRIYTS1234 requested a review from mateacademy-ai-mentor May 5, 2026 11:18

mateacademy-ai-mentor suggested changes May 5, 2026

View reviewed changes

mateacademy-ai-mentor reviewed May 5, 2026

View reviewed changes

fix: issue with status code and object returning

10aea1a

ANDRIYTS1234 requested a review from mateacademy-ai-mentor May 5, 2026 11:36

Anton-Kuchmasov approved these changes May 5, 2026

View reviewed changes


		if (password.length < 6) {
		throw new Error('Довжина паролю має бути більше 6 символів');

		import { authMiddleware } from '../middlewares/authMiddleware';

		export const userRouter = Router();


		const hashedNewPass = await bcrypt.hash(newPassword, 10);

		user.password = hashedNewPass;

		res.send('Акаунт активовано');
		} catch (error) {

		} from '../controllers/authController';

		export const authRouter = Router();


		export const authRouter = Router();

		authRouter.post('/registration', registration);

		authRouter.post('/logout', logout);

		authRouter.post('/forgot-password', forgotPassword);


		userRouter.use(authMiddleware);

		userRouter.patch('/name', updateName);


		await changePassword(email, oldPassword, newPassword);

		res.send(200).send({ message: 'Пароль змінено' });

		const { newEmail, password } = req.body;

		await changeEmail(oldEmail, newEmail, password);

		const { newName } = req.body;

		await changeName(email, newName);

		const activationToken = req.params.activationToken as string;

		await activate(activationToken);

Conversation

ANDRIYTS1234 commented May 4, 2026

Uh oh!

mateacademy-ai-mentor left a comment

Choose a reason for hiding this comment

Review Summary

Footnotes

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mateacademy-ai-mentor left a comment

Choose a reason for hiding this comment

Review Summary

Footnotes

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment