Security issues

[thomas-klein-cf]

1. GQL resolvers do not use the userId from the session to pull private data. Any user can pass up a valid userId and get information about that user. Examples include fetchUserDetails and fetchMyAccountSettings.
2. Anyone with a session can call updateUserProfile and update anyones profile.
3. config.yml is storing secrets in plaintext.
4. next and next-auth are pinned to latest, which can introduce vulnerabilities if new versions are deployed.
5. Permission checks in UserDetails and AccountDetails should ideally be done on the server, either in middleware or getServerSideProps.
6. Assigning roles based on name isn't the most secure.
7. REST API doesn't have an authorization header
8. newProfileData in updateUserProfile is not sanitized before being saved.
9. deleteUser should have its own mutation resolver to isolate permissions instead of using the updateUserProfile resolver. CAN_DELETE_USERS should also be checked server side.
10. processTransaction should do validation on the amount