Who Is Calling, and What May They Do

import session from 'express-session';

app.use(session({
  name: 'sid',
  secret: process.env.SESSION_SECRET,
  resave: false,
  saveUninitialized: false,                 // no cookie until there is a session
  store: new RedisStore({ client: redis }), // server-side state: revocable
  cookie: {
    httpOnly: true,   // script cannot read it, so XSS cannot exfiltrate it
    secure: true,     // never sent over plaintext HTTP
    sameSite: 'lax',  // blunts CSRF on cross-site POSTs; 'strict' breaks OAuth returns
    path: '/',
    maxAge: 12 * 60 * 60 * 1000,
  },
}));

// SameSite is a mitigation, not the control. Keep a CSRF token for
// state-changing requests from forms.
app.post('/orders', csrfProtection, createOrder);

// Why this beats a token in localStorage for a first-party app:
//  - HttpOnly means XSS cannot read the credential
//  - server-side store means logout and revocation are real, immediately
//  - the browser attaches it, so no client code touches the credential at all
// What it costs: CSRF protection, and it does not work for a third-party client.

// Too coarse: every integration gets everything, so the check proves nothing.
//   scope: "api"

// Too fine: nobody can reason about it and every new endpoint needs a
// migration of every API key.
//   scope: "orders.shipping_address.read orders.total_cents.read ..."

// About right: resource plus action, with read and write split, because
// read-only integrations are the common case and the valuable restriction.
const SCOPES = [
  'orders:read', 'orders:write',
  'customers:read', 'customers:write',
  'refunds:write',          // deliberately separate from orders:write
  'reports:read',
];

// Writes need the write scope AND the object check; the scope alone is
// a statement about the caller, not about the row.
router.post('/orders/:id/refunds',
  authenticate,
  requireScope('refunds:write'),
  async (req, res) => {
    const order = await orderForPrincipal(req.principal, req.params.id);
    if (!order) return res.status(404).json(problem('order-not-found', 404));
    res.status(201).json(await refunds.create(order, req.body));
  });

// BROKEN: the caller decides which columns change.
// POST /users/42 {"name":"Ada","role":"admin","account_id":9}
router.patch('/users/:id', authenticate, async (req, res) => {
  await db.query('UPDATE users SET ? WHERE id = ?', [req.body, req.params.id]);
});

// FIXED: an allowlist per role. Fields absent from the list are not an error
// to argue about -- they simply do not exist as far as this handler is concerned.
const WRITABLE = {
  member: ['name', 'locale', 'timezone'],
  admin:  ['name', 'locale', 'timezone', 'role'],   // role, but still never account_id
};

router.patch('/users/:id', authenticate, requireScope('users:write'), async (req, res) => {
  const target = await db.oneOrNone(
    'SELECT id FROM users WHERE id = $1 AND account_id = $2',   // object check first
    [req.params.id, req.principal.accountId]);
  if (!target) return res.status(404).json(problem('user-not-found', 404));

  const allowed = WRITABLE[req.principal.role] ?? [];
  const patch = Object.fromEntries(
    Object.entries(req.body).filter(([k]) => allowed.includes(k)));
  if (Object.keys(patch).length === 0)
    return res.status(422).json(problem('no-writable-fields', 422));

  res.json(await users.update(target.id, patch));
});