Task1-vuln.js

const express = require('express');
const app = express();
app.use(express.json());

// Mock database functions
const db = {
  users: [
    { id: 1, role: 'admin' },
    { id: 2, role: 'user' }
  ],
  async getUserById(userId) {
    return this.users.find(user => user.id === userId);
  },
  async deleteProject(projectId) {
    console.log(`Project ${projectId} deleted by admin.`);
  }
};

//auth.js
async function isAdmin(userId) {
  const user = await db.getUserById(userId);
  return user && user.role === 'admin';
}
//routes.js
app.post('/project/:id/delete', async (req, res) => {
  const userId = parseInt(req.body.userId, 10); // Convert string to integer
  const projectId = req.params.id;

  if (await isAdmin(userId)) {
    await db.deleteProject(projectId);
    return res.send('Project deleted');
  }

  return res.status(403).send('Not allowed');
});

app.listen(3000, () => {
  console.log('Server started on port 3000');
});