Profile update accepts any field

Code reviewSecuritySenior–Staff~25 min

Review this TypeScript profile-update handler.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix, specific and kind.

0:00 of about 25 min

Mark a line and say what kind of problem it is.0 findings

1// PATCH /users/:id

2router.patch('/users/:id', requireAuth, async (req, res) => {

3 const updates = req.body;

4 const user = await User.findByPk(req.params.id);

5 if (!user) return res.status(404).json({ error: 'not found' });

7 Object.assign(user, updates);

8 await user.save();

10 res.json(user);

11});

Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.