Backend schema change by Priyamanjare54 · Pull Request #121 · tarinagarwal/Edulume

Priyamanjare54 · 2026-01-17T18:20:37Z

📝 Description

Implemented full Labs CRUD functionality with authentication and authorization.Fixes #58

Key highlights:

Added Create, Read, Update, Delete APIs for Labs
Secured routes using JWT-based authentication
Ensured only the creator can update/delete their lab
Fixed MongoDB connection to support Prisma transactions using a replica set
Verified protected endpoints using Bearer token flow

This completes the Labs module backend functionality and prepares it for frontend integration.

🔗 Related Issue

Closes: N/A

🏷️ Type of Change

🐛 Bug fix (non-breaking change that fixes an issue)
✨ New feature (non-breaking change that adds functionality)
💥 Breaking change (fix or feature that would cause existing functionality to change)
📝 Documentation update
🎨 Style/UI update
♻️ Code refactoring
⚡ Performance improvement
🧪 Test update

📸 Screenshots (if applicable)

N/A (Backend-only changes)

✅ Checklist

My code follows the project's style guidelines
I have performed a self-review of my code
I have commented my code, particularly in hard-to-understand areas
I have made corresponding changes to the documentation
My changes generate no new warnings
I have tested my changes locally
Any dependent changes have been merged and published

🧪 Testing

How I tested:

Generated JWT token via login
Tested protected endpoints using Authorization header
Verified ownership checks for update/delete
Confirmed Prisma works with MongoDB replica set
Tested API endpoints (Postman)
Tested on Chrome
Tested on Firefox
Tested on mobile

📋 Additional Notes

MongoDB replica set was configured locally to support Prisma transactions.
All endpoints return correct HTTP status codes (201, 403, 404, etc.).
Ready for frontend consumption.

SWOC 2026 Participant ✅
Please add the swoc2026 label to this PR 🎉

tarinagarwal

Great work on the Labs CRUD implementation! The core functionality is solid. A few improvements needed:

1. Use existing Prisma instance
Replace const prisma = new PrismaClient(); with import prisma from "../db.js"; to use the existing connection.

2. Add input validation

Validate required fields (title, language, difficulty, etc.)
Validate enum values for difficulty ("beginner", "intermediate", "advanced")
Validate visibility ("private", "public", "link")

3. Add filters to GET /api/labs
Add query parameter support for filtering by language, difficulty, creator, etc.

4. Minor fixes

Add newline at end of schema.prisma file
Add basic validation for empty/invalid ObjectIds

5. Error handling
Add validation for invalid ObjectId format in route parameters.

The MongoDB adaptations and ObjectId usage are perfect for this setup. Core CRUD logic and auth checks look excellent!

Priyamanjare54 · 2026-01-22T10:01:47Z

Hello, @tarinagarwal
I've completed the changes for Backend schema change #121
Please review when you have time. Happy to address any feedback!

Priyamanjare54 · 2026-01-25T07:44:30Z

Hello @tarinagarwal please review the changes

tarinagarwal · 2026-02-04T16:01:47Z

@Priyamanjare54 going thru it

Priyamanjare54 · 2026-02-07T09:50:49Z

Hello any changes required?

tarin-lgtm

Changes Requested 🐈

This PR implements full CRUD functionality for Labs with JWT authentication and authorization. Review found critical performance issue due to missing pagination on GET /api/labs, multiple high-severity documentation gaps, and security concerns on unauthenticated GET endpoints. Additional improvements in validation, error handling, and code structure are recommended.

There are a few things I'd like to see addressed before we merge this:

Before merging

Add pagination and limit to GET /api/labs endpoint to prevent performance degradation.
Provide comprehensive API documentation for all Labs routes including methods, parameters, responses, authentication, and error handling.
Implement authentication and authorization checks on GET endpoints and sanitize user inputs to mitigate security risks.

Findings breakdown (33 total)

1 critical / 6 high / 8 medium / 11 low / 7 info

Confidence: 95%

🔗 View Full Review Report — detailed findings, severity breakdown, and agent analysis

_{Reviewed by Looks Good To Meow — AI-powered code review}

💬 You can interact with me directly in this PR:

@tarin-lgtm fix [any constraints]
@tarin-lgtm explain [your question]
@tarin-lgtm improve [focus area]
@tarin-lgtm test [what to focus on]

tarin-lgtm · 2026-03-19T22:04:50Z

+});
+
+// --- GET ALL Labs ---
+router.get("/", async (req, res) => {


🚨 Critical — The GET /api/labs endpoint fetches all labs without any pagination or limit, potentially returning a very large dataset which can degrade performance and increase memory usage.

Implement pagination by accepting page and limit query parameters and use Prisma's skip and take options to limit the number of labs returned per request.

_performance

tarin-lgtm · 2026-03-19T22:04:50Z

@@ -0,0 +1,199 @@
+import express from "express";


⚠️ High — The Express router defines multiple API endpoints for labs but lacks any documentation describing the HTTP methods, paths, request body schemas, response schemas, authentication requirements, or error responses.

Add comprehensive JSDoc or API documentation comments above each route handler describing the endpoint's purpose, HTTP method, URL path, expected request parameters and body schema, response format, authentication requirements, and possible error responses.

_{documentation}

tarin-lgtm · 2026-03-19T22:04:50Z

+const ALLOWED_VISIBILITY = ["private", "public", "link"];
+
+// --- CREATE Lab ---
+router.post("/", authenticateToken, async (req, res) => {


⚠️ High — The POST /api/labs endpoint for creating a lab is missing documentation including description, request body schema, response schema, authentication, and error responses.

Add JSDoc or API documentation for this endpoint specifying it is a POST request to create a lab, detailing required and optional fields in the request body, authentication via JWT, the structure of the success response, and possible error responses with status codes.

_{documentation}

tarin-lgtm · 2026-03-19T22:04:50Z

+});
+
+// --- GET ALL Labs ---
+router.get("/", async (req, res) => {


⚠️ High — The GET /api/labs endpoint for fetching all labs is undocumented. It lacks details on query parameters, response schema, and error handling.

Add documentation describing this GET endpoint, including optional query parameters (language, difficulty, creator), the structure of the returned labs array, and error responses.

_{documentation}

tarin-lgtm · 2026-03-19T22:04:50Z

+});
+
+// --- GET SINGLE Lab ---
+router.get("/:id", async (req, res) => {


⚠️ High — The GET /api/labs/:id endpoint for fetching a single lab by ID is undocumented. Missing details on path parameter, response schema, and error cases.

Add documentation specifying this GET endpoint accepts a lab ID as a path parameter, returns the lab object with related data, and possible error responses for invalid ID or not found.

_{documentation}

tarin-lgtm · 2026-03-19T22:04:51Z

+  return res.status(400).json({ error: "Invalid visibility value" });
+}
+
+const lab = await prisma.lab.update({


💡 Suggestion — The PUT /:id route does not handle the case where no fields are provided for update, which may cause Prisma to update with undefined values.

Filter out undefined fields from the update data before passing to Prisma to avoid overwriting fields with undefined.

_{best-practices}

tarin-lgtm · 2026-03-19T22:04:51Z

+
+    if (existing.creatorId !== req.user.id) return res.status(403).json({ error: "Forbidden" });
+
+    await prisma.lab.delete({ where: { id } });


💡 Suggestion — The DELETE /:id route returns a JSON message on success but does not set an explicit HTTP status code. The default 200 is acceptable but 204 No Content is more conventional for successful deletes.

Consider returning status 204 No Content with no body for successful DELETE requests to align with REST conventions.

_{best-practices}

tarin-lgtm · 2026-03-19T22:04:51Z

+});
+
+// --- UPDATE Lab ---
+router.put("/:id", authenticateToken, async (req, res) => {


💡 Suggestion — The PUT /api/labs/:id endpoint updates lab fields without sanitizing or validating string inputs such as title, description, content, tasks, testCases, and solution. This could lead to stored XSS if these fields are rendered in a client without proper escaping.

Implement input sanitization or escaping for user-supplied string fields before storing them in the database. Additionally, consider validating the structure and content of complex fields like tasks and testCases.

_security

tarin-lgtm · 2026-03-19T22:04:51Z

+   visibility,
+} = req.body;
+
+if (difficulty && !ALLOWED_DIFFICULTIES.includes(difficulty)) {


💡 Suggestion — In the UPDATE Lab route, the difficulty validation returns a generic error without listing allowed values, unlike the CREATE Lab route which provides allowed values for better client feedback.

Include the allowedValues array in the error response for consistency and better client-side validation feedback.

_bugs

tarin-lgtm · 2026-03-19T22:04:51Z

+  return res.status(400).json({ error: "Invalid difficulty value" });
+}
+
+if (visibility && !ALLOWED_VISIBILITY.includes(visibility)) {


💡 Suggestion — In the UPDATE Lab route, the visibility validation returns a generic error without listing allowed values, unlike the CREATE Lab route which provides allowed values for better client feedback.

Include the allowedValues array in the error response for consistency and better client-side validation feedback.

_bugs

tarin-lgtm

Changes Requested 🐈

PR #121 adds Labs CRUD APIs with JWT auth and creator-only update/delete, plus a Prisma/Mongo replica set connection fix. Review flags several high-severity problems in server/routes/labs.js including a malformed/misaligned Prisma include block (potential runtime failure) and missing rate limiting, pagination, and endpoint documentation for state-changing and listing endpoints.

There are a few things I'd like to see addressed before we merge this:

Before merging

Fix the malformed Prisma include block / any likely syntax or brace/indentation issues in server/routes/labs.js (validate route loads and queries are correct).
Add rate limiting (and ideally abuse controls) to authenticated state-changing endpoints: POST /labs, PUT /labs/:id, DELETE /labs/:id.
Add pagination/limits for GET /api/labs and reduce eager relational includes; also fill in missing validation and endpoint documentation (request/response, auth rules, error cases).

Findings

🎯 6 actionable · 💡 4 suggestions

Severity breakdown (23 total)

6 high / 13 medium / 4 low

Confidence: 93%

🔗 View Full Review Report — detailed findings, severity breakdown, and agent analysis

_{Reviewed by Looks Good To Meow — AI-powered code review}

tarin-lgtm · 2026-07-29T06:21:11Z

+    if (difficulty) where.difficulty = difficulty;
+    if (creator) where.creatorId = creator;
+
+    const labs = await prisma.lab.findMany({


🎯 Actionable — High — The include block is malformed: progress: true is indented inconsistently and there’s a missing closing brace/parenthesis alignment, which can cause a runtime syntax error or incorrect query structure.

Fix the indentation/bracing so the include object is correctly closed before ending the findMany call.

_{Flagged by: best-practices, bugs, performance, readability}

tarin-lgtm · 2026-07-29T06:21:11Z

+
+    if (existing.creatorId !== req.user.id) return res.status(403).json({ error: "Forbidden" });
+
+  const {


🎯 Actionable — High — The update handler has inconsistent indentation around destructuring and const lab = await prisma.lab.update...; while not strictly semantic, this commonly indicates a missing brace/semicolon or mis-scoped block that can prevent the server from loading the route.

Reformat and verify all braces are balanced in the PUT /:id handler, ensuring the destructuring and update call are inside the try block.

_{Flagged by: best-practices, bugs, readability}

tarin-lgtm · 2026-07-29T06:21:11Z

+const ALLOWED_VISIBILITY = ["private", "public", "link"];
+
+// --- CREATE Lab ---
+router.post("/", authenticateToken, async (req, res) => {


🎯 Actionable — High — The new lab creation endpoint accepts authenticated requests but has no rate limiting. An attacker with a valid token (or via token theft) could repeatedly create labs and cause storage/compute exhaustion in the database.

_{Flagged by: documentation, security}

tarin-lgtm · 2026-07-29T06:21:11Z

+});
+
+// --- DELETE Lab ---
+router.delete("/:id", authenticateToken, async (req, res) => {


🎯 Actionable — High — The new DELETE lab endpoint is authenticated but has no rate limiting. With a valid token, an attacker could rapidly delete resources causing denial of service and integrity damage.

_{Flagged by: documentation, security}

tarin-lgtm · 2026-07-29T06:21:11Z

+});
+
+// --- UPDATE Lab ---
+router.put("/:id", authenticateToken, async (req, res) => {


🎯 Actionable — High — The new lab update endpoint is authenticated but has no rate limiting. With a valid token, an attacker could repeatedly update labs to degrade service availability and increase database write load.

_{Flagged by: documentation, security}

tarin-lgtm · 2026-07-29T06:21:11Z

+});
+
+// --- GET ALL Labs ---
+router.get("/", async (req, res) => {


🎯 Actionable — High — GET /api/labs returns an unbounded list of labs with no limit/offset (or cursor) controls. Under real usage, this can cause large payloads and slow database response times as the dataset grows.

Add pagination parameters (e.g., limit/offset or cursor) and apply them to prisma.lab.findMany; also consider selecting only needed fields and/or adding default sorting.

_{Flagged by: best-practices, documentation, performance}

tarin-lgtm · 2026-07-29T06:21:11Z

+      return res.status(400).json({
+        error: "Invalid visibility value",
+        allowedValues: ALLOWED_VISIBILITY,
+      });


💡 Suggestion — Medium — visibility is validated only if truthy; this means an empty string bypasses validation but is still stored (or overwritten) with '', which may not match the intended enum values.

Validate visibility whenever the field is present in the request body (e.g., check visibility !== undefined), and reject empty strings.

_{Flagged by: bugs}

tarin-lgtm · 2026-07-29T06:21:11Z

+   visibility,
+} = req.body;
+
+if (difficulty && !ALLOWED_DIFFICULTIES.includes(difficulty)) {


💡 Suggestion — Medium — In the update route, the enum validation also only runs when visibility/difficulty are truthy, so difficulty: '' or visibility: '' will bypass validation and be written to the database.

Change the conditionals to validate when the key is provided (e.g., difficulty !== undefined) rather than when it’s truthy.

_{Flagged by: bugs, readability}

tarin-lgtm · 2026-07-29T06:21:11Z

+const router = express.Router();
+
+
+const ALLOWED_DIFFICULTIES = ["beginner", "intermediate", "advanced"];


💡 Suggestion — Medium — The route imports/exports are fine, but there are multiple indentation/formatting inconsistencies (e.g., uneven alignment around required fields and include blocks) that make reviews harder and increase the chance of introducing subtle syntax errors later.

_{Flagged by: best-practices}

tarin-lgtm · 2026-07-29T06:21:11Z

+});
+
+// --- GET SINGLE Lab ---
+router.get("/:id", async (req, res) => {


💡 Suggestion — Medium — GET /api/labs/:id returns a lab with creator/shares/progress included, but there is no documentation for access control/visibility rules (especially for private/link labs) or response schema. This is non-obvious given the include fields and the presence of a custom ObjectId validator.

Document GET /api/labs/:id access rules (auth/visibility), required/optional response fields (including nested relations: creator, shares, progress), and explicit error responses (400 invalid ID, 404 not found, 500).

_{Flagged by: documentation}

Backend schema change

97d0831

tarinagarwal requested changes Jan 19, 2026

View reviewed changes

Priyamanjare54 added 2 commits January 22, 2026 08:44

fix: address review feedback for labs CRUD

a308f8b

fix: restore correct package versions

b5b2897

Priyamanjare54 requested a review from tarinagarwal January 23, 2026 12:32

tarin-lgtm Bot requested changes Mar 19, 2026

View reviewed changes

Merge branch 'main' into database-schema-change

26a7f6f

tarin-lgtm Bot requested changes Jul 29, 2026

View reviewed changes


		if (existing.creatorId !== req.user.id) return res.status(403).json({ error: "Forbidden" });

		await prisma.lab.delete({ where: { id } });


		if (existing.creatorId !== req.user.id) return res.status(403).json({ error: "Forbidden" });

		const {

		const router = express.Router();


		const ALLOWED_DIFFICULTIES = ["beginner", "intermediate", "advanced"];

Conversation

Priyamanjare54 commented Jan 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📝 Description

Key highlights:

🔗 Related Issue

🏷️ Type of Change

📸 Screenshots (if applicable)

✅ Checklist

🧪 Testing

How I tested:

📋 Additional Notes

Uh oh!

tarinagarwal left a comment

Choose a reason for hiding this comment

Uh oh!

Priyamanjare54 commented Jan 22, 2026

Uh oh!

Priyamanjare54 commented Jan 25, 2026

Uh oh!

tarinagarwal commented Feb 4, 2026

Uh oh!

Priyamanjare54 commented Feb 7, 2026

Uh oh!

tarin-lgtm Bot left a comment

Choose a reason for hiding this comment

Changes Requested 🐈

Before merging

Uh oh!

tarin-lgtm Bot Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

tarin-lgtm Bot Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

tarin-lgtm Bot Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

tarin-lgtm Bot Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

tarin-lgtm Bot Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

tarin-lgtm Bot Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

tarin-lgtm Bot Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

tarin-lgtm Bot Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

tarin-lgtm Bot Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

tarin-lgtm Bot Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

tarin-lgtm Bot left a comment

Choose a reason for hiding this comment

Changes Requested 🐈

Before merging

Findings

Uh oh!

tarin-lgtm Bot Jul 29, 2026

Choose a reason for hiding this comment

Uh oh!

tarin-lgtm Bot Jul 29, 2026

Choose a reason for hiding this comment

Uh oh!

tarin-lgtm Bot Jul 29, 2026

Choose a reason for hiding this comment

Uh oh!

tarin-lgtm Bot Jul 29, 2026

Choose a reason for hiding this comment

Uh oh!

tarin-lgtm Bot Jul 29, 2026

Choose a reason for hiding this comment

Uh oh!

Priyamanjare54 commented Jan 17, 2026 •

edited

Loading