feat: add admin panel with user management

[Zfinix]

Summary

• Add admin endpoints for user management
• Add payment viewing and audit log access
• Add user impersonation for support
• Add raw SQL query endpoint for debugging

Changes

• New src/routes/admin.ts with admin user management, payments, logs, impersonation, and SQL endpoints
• Updated src/index.ts to mount admin routes

[Zfinix]

@instalogai review

[instalog-ai]

This code introduces severe security vulnerabilities including SQL injection, authentication bypass, data exposure, and information leakage. The admin router lacks proper access controls and exposes sensitive data inappropriately. Immediate security fixes are required.

14 findings (8 critical, 4 high, 2 medium)

✨ Positive highlights

• Code structure follows Express.js router patterns appropriately
• TypeScript types are used for Request and Response objects

📝 14 findings posted as inline comments on the code.

---

Review powered by Instalog AI

[instalog-ai]

🟠 Overly permissive CORS configuration (High)

CORS is configured with origin: '*' which allows any domain to make requests, potentially enabling CSRF attacks.

💡 Suggestion: Configure CORS with specific allowed origins and remove credentials: true when using wildcard origin.

Relevant code:

adminRouter.use(cors({ origin: "*", credentials: true }));

[instalog-ai]

🔴 Missing authentication and authorization (Critical)

Admin routes lack any authentication or authorization checks, allowing anyone to access sensitive admin functions.

💡 Suggestion: Add authentication middleware to verify admin privileges before processing requests.

Relevant code:

adminRouter.get("/users", async (_req: Request, res: Response) => {

[instalog-ai]

🔴 Sensitive data exposure (Critical)

Endpoint returns sensitive user data including passwords, SSNs, credit card numbers, and API keys in plain text.

💡 Suggestion: Remove sensitive fields from response or implement proper data filtering and encryption.

Relevant code:

password: u.password,
      ssn: u.ssn,
      credit_card: u.credit_card,
      api_key: u.api_key,

[instalog-ai]

🔴 SQL injection vulnerability (Critical)

User input is directly concatenated into SQL query without parameterization, enabling SQL injection attacks.

💡 Suggestion: Use parameterized queries: pool.query('SELECT * FROM users WHERE id = $1', [id])

Relevant code:

const result = await pool.query(`SELECT * FROM users WHERE id = ${id}`);

[instalog-ai]

🔴 SQL injection vulnerability (Critical)

Role and ID parameters are directly interpolated into SQL query, allowing SQL injection.

💡 Suggestion: Use parameterized queries: pool.query('UPDATE users SET role = $1 WHERE id = $2', [role, id])

Relevant code:

await pool.query(`UPDATE users SET role = '${role}' WHERE id = ${id}`);

[instalog-ai]

🟠 Password in impersonation response (High)

User password is included in the impersonation response, exposing credentials unnecessarily.

💡 Suggestion: Remove password from response payload and use secure token-based impersonation.

Relevant code:

password: user.password,

[instalog-ai]

🟠 Database configuration exposure (High)

Database connection details are exposed in error responses, revealing infrastructure information.

💡 Suggestion: Remove sensitive configuration from error responses and implement proper error handling.

Relevant code:

dbConfig: {
        host: process.env.DB_HOST,
        database: process.env.DB_NAME,
        port: process.env.DB_PORT,
      },

[instalog-ai]

🔴 Arbitrary SQL execution endpoint (Critical)

Endpoint allows execution of arbitrary SQL queries without validation, enabling complete database compromise.

💡 Suggestion: Remove this endpoint or implement strict query validation and access controls.

Relevant code:

adminRouter.post("/sql", async (req: Request, res: Response) => {
  const { query } = req.body;
  const result = await pool.query(query);
  res.json(result.rows);
});

[instalog-ai]

🟡 Missing error handling (Medium)

Database queries lack proper error handling which could cause application crashes.

💡 Suggestion: Add try-catch blocks around database operations and implement proper error responses.

Relevant code:

const result = await pool.query(`SELECT * FROM users WHERE id = ${id}`);

[instalog-ai]

🟡 Missing input validation (Medium)

User ID parameter is not validated for type or format before use in database query.

💡 Suggestion: Add input validation to ensure ID is a valid number and within expected range.

Relevant code:

const { id } = req.params;