Add app source code for AI code review comparison

.github/workflows/claude-code-review.yml

@@ -13,7 +13,7 @@ jobs:
       contents: read
       pull-requests: write
       issues: write
-      id-token: write  # ← was missing, required by the action
+      id-token: write
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -24,11 +24,17 @@ jobs:
         uses: anthropics/claude-code-action@beta
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-          github_token: ${{ secrets.GITHUB_TOKEN }}  # ← was missing
+          github_token: ${{ secrets.GITHUB_TOKEN }}
           direct_prompt: |
             Please review this entire PR for bugs. Focus on SQL injection and auth vulnerabilities,
             logic errors, performance issues and memory leaks, and UI/UX accessibility violations.
             Flag every issue with file, line number, severity, and explanation.
+
+            IMPORTANT: For each issue you find, post an inline review comment on the specific line
+            of the file where the issue occurs. Do NOT put all findings in a single comment — use
+            individual inline comments so each issue appears directly on the relevant line in the diff.
+            After posting all inline comments, post a brief summary comment listing the total count
+            of issues found by severity.
           trigger_phrase: "@claude"
           custom_instructions: |
             You are reviewing a TypeScript expense tracker app (Node/Express + React + SQLite).
@@ -38,3 +44,4 @@ jobs:
             3. Performance issues and memory leaks
             4. UI/UX and accessibility violations
             Be thorough — flag every issue you find with file, line, severity, and explanation.
+            Always post findings as inline review comments on the exact lines where the issues are.

.github/workflows/openai-code-review.yml

@@ -22,13 +22,9 @@ jobs:
           git diff origin/${{ github.base_ref }}...HEAD > pr_diff.txt
 
       - name: OpenAI Review via API
-        id: review
         env:
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
         run: |
-          DIFF=$(cat pr_diff.txt | head -c 20000)
-
-          # Write request body to a temp file to avoid shell escaping issues
           python3 - <<'PYEOF'
           import os, json, urllib.request, sys
 
@@ -37,17 +33,34 @@ jobs:
 
           payload = json.dumps({
             "model": "gpt-4o",
+            "response_format": {"type": "json_object"},
             "messages": [
               {
                 "role": "system",
                 "content": (
-                  "You are a senior code reviewer. Review this PR diff for a TypeScript expense tracker "
-                  "(Node/Express + React + SQLite). Find ALL bugs in these categories: SQL injection/auth "
-                  "vulnerabilities, logic errors, performance/memory leaks, and accessibility issues. "
-                  "For each bug: state the file, approximate line, severity (critical/high/medium/low), and explanation."
+                  "You are reviewing a TypeScript expense tracker app (Node/Express + React + SQLite).\n"
+                  "Focus on:\n"
+                  "1. SQL injection and authentication vulnerabilities\n"
+                  "2. Logic errors and off-by-one bugs\n"
+                  "3. Performance issues and memory leaks\n"
+                  "4. UI/UX and accessibility violations\n"
+                  "Be thorough — flag every issue you find with file, line, severity, and explanation.\n\n"
+                  "You MUST respond with a JSON object in this exact format:\n"
+                  '{"comments": [{"path": "relative/file/path.ts", "line": 42, "severity": "critical|high|medium|low", "body": "explanation of the issue"}]}\n'
+                  "The path must match the file path in the diff (e.g. backend/src/routes/auth.ts).\n"
+                  "The line number must be a line that exists in the NEW version of the file in the diff.\n"
+                  "Return ONLY the JSON object, no other text."
                 )
               },
-              {"role": "user", "content": f"PR Diff:\n\n{diff}"}
+              {
+                "role": "user",
+                "content": (
+                  "Please review this entire PR for bugs. Focus on SQL injection and auth vulnerabilities, "
+                  "logic errors, performance issues and memory leaks, and UI/UX accessibility violations. "
+                  "Flag every issue with file, line number, severity, and explanation.\n\n"
+                  f"PR Diff:\n\n{diff}"
+                )
+              }
             ]
           }).encode()
 
@@ -63,28 +76,83 @@ jobs:
           try:
             with urllib.request.urlopen(req) as resp:
               data = json.loads(resp.read())
-              review = data["choices"][0]["message"]["content"]
+              review_json = data["choices"][0]["message"]["content"]
           except urllib.error.HTTPError as e:
             body = e.read().decode()
             print(f"OpenAI API error {e.code}: {body}", file=sys.stderr)
-            review = f"⚠️ OpenAI API error {e.code} — check that OPENAI_API_KEY secret is set correctly.\n\n{body}"
+            with open("review_result.json", "w") as f:
+              json.dump({"error": f"OpenAI API error {e.code}: {body}"}, f)
+            sys.exit(1)
 
-          with open(os.environ["GITHUB_ENV"], "a") as f:
-            f.write("OPENAI_REVIEW<<DELIM\n")
-            f.write(review + "\n")
-            f.write("DELIM\n")
+          with open("review_result.json", "w") as f:
+            f.write(review_json)
           PYEOF
 
-      - name: Post Review Comment
+      - name: Post Inline Review Comments
         uses: actions/github-script@v7
         with:
           script: |
-            const review = `## 🤖 OpenAI Code Review\n\n${process.env.OPENAI_REVIEW}`;
-            github.rest.issues.createComment({
-              issue_number: context.issue.number,
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              body: review
+            const fs = require('fs');
+            const result = JSON.parse(fs.readFileSync('review_result.json', 'utf8'));
+
+            if (result.error) {
+              await github.rest.issues.createComment({
+                issue_number: context.issue.number,
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                body: `## OpenAI Code Review\n\n⚠️ ${result.error}`
+              });
+              return;
+            }
+
+            const comments = result.comments || [];
+            if (comments.length === 0) {
+              await github.rest.issues.createComment({
+                issue_number: context.issue.number,
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                body: '## OpenAI Code Review\n\nNo issues found.'
+              });
+              return;
+            }
+
+            // Build inline comments for the review
+            const reviewComments = comments.map(c => ({
+              path: c.path,
+              line: c.line,
+              body: `**[${c.severity.toUpperCase()}]** ${c.body}`
+            }));
+
+            // Count by severity for summary
+            const counts = {};
+            comments.forEach(c => {
+              const s = c.severity.toLowerCase();
+              counts[s] = (counts[s] || 0) + 1;
             });
-        env:
-          OPENAI_REVIEW: ${{ env.OPENAI_REVIEW }}
+            const summary = Object.entries(counts)
+              .map(([s, n]) => `- **${s}**: ${n}`)
+              .join('\n');
+
+            try {
+              await github.rest.pulls.createReview({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                pull_number: context.issue.number,
+                event: 'COMMENT',
+                body: `## OpenAI Code Review\n\nFound **${comments.length}** issues:\n${summary}`,
+                comments: reviewComments
+              });
+            } catch (err) {
+              // If inline comments fail (e.g. line not in diff), fall back to single comment
+              let body = `## OpenAI Code Review\n\nFound **${comments.length}** issues:\n${summary}\n\n`;
+              body += '| File | Line | Severity | Issue |\n|------|------|----------|-------|\n';
+              comments.forEach(c => {
+                body += `| \`${c.path}\` | ${c.line} | ${c.severity} | ${c.body} |\n`;
+              });
+              await github.rest.issues.createComment({
+                issue_number: context.issue.number,
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                body
+              });
+            }

backend/src/db.ts

@@ -0,0 +1,30 @@
+import Database from "better-sqlite3";
+import path from "path";
+
+const dbPath = path.join(__dirname, "..", "teamexpense.db");
+const db = new Database(dbPath);
+
+db.pragma("journal_mode = WAL");
+
+db.exec(`
+  CREATE TABLE IF NOT EXISTS users (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    email TEXT UNIQUE NOT NULL,
+    password TEXT NOT NULL,
+    name TEXT NOT NULL,
+    role TEXT NOT NULL DEFAULT 'member'
+  );
+
+  CREATE TABLE IF NOT EXISTS expenses (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    user_id INTEGER NOT NULL,
+    amount REAL NOT NULL,
+    description TEXT NOT NULL,
+    category TEXT NOT NULL,
+    status TEXT NOT NULL DEFAULT 'pending',
+    created_at TEXT NOT NULL DEFAULT (datetime('now')),
+    FOREIGN KEY (user_id) REFERENCES users(id)
+  );
+`);
+
+export default db;

backend/src/index.ts

@@ -0,0 +1,30 @@
+import express from "express";
+import cors from "cors";
+import authRoutes from "./routes/auth";
+import expenseRoutes from "./routes/expenses";
+import reportRoutes from "./routes/reports";
+
+const app = express();
+const PORT = process.env.PORT || 3001;
+
+// BUG: Wildcard CORS — allows any origin to make authenticated requests
+app.use(cors());
+app.use(express.json());
+
+app.use("/api/auth", authRoutes);
+app.use("/api/expenses", expenseRoutes);
+app.use("/api/reports", reportRoutes);
+
+// BUG: No rate limiting on any endpoints — susceptible to brute-force attacks
+
+// BUG: Global error handler leaks stack traces to the client in production
+app.use((err: any, _req: express.Request, res: express.Response, _next: express.NextFunction) => {
+  console.error(err);
+  res.status(500).json({ error: err.message, stack: err.stack });
+});
+
+app.listen(PORT, () => {
+  console.log(`Server running on port ${PORT}`);
+});
+
+export default app;

backend/src/middleware/auth.ts

@@ -0,0 +1,36 @@
+import { Request, Response, NextFunction } from "express";
+import jwt from "jsonwebtoken";
+
+const JWT_SECRET = "supersecretkey123"; // BUG: Hardcoded JWT secret — should use environment variable
+
+export interface AuthRequest extends Request {
+  user?: { id: number; email: string; role: string };
+}
+
+export function authenticate(req: AuthRequest, res: Response, next: NextFunction) {
+  const header = req.headers.authorization;
+  if (!header) {
+    return res.status(401).json({ error: "No token provided" });
+  }
+
+  // BUG: Does not validate "Bearer " prefix — any string with a valid JWT payload passes
+  const token = header.replace("Bearer ", "");
+
+  try {
+    const payload = jwt.verify(token, JWT_SECRET) as any;
+    req.user = payload;
+    next();
+  } catch {
+    return res.status(401).json({ error: "Invalid token" });
+  }
+}
+
+export function requireAdmin(req: AuthRequest, res: Response, next: NextFunction) {
+  // BUG: Checks role from the JWT payload which the user controls — should verify role from DB
+  if (req.user?.role !== "admin") {
+    return res.status(403).json({ error: "Admin access required" });
+  }
+  next();
+}
+
+export { JWT_SECRET };

backend/src/routes/auth.ts

@@ -0,0 +1,74 @@
+import { Router, Request, Response } from "express";
+import bcrypt from "bcryptjs";
+import jwt from "jsonwebtoken";
+import db from "../db";
+import { JWT_SECRET } from "../middleware/auth";
+import { isValidEmail } from "../utils/validate";
+
+const router = Router();
+
+// POST /api/auth/register
+router.post("/register", async (req: Request, res: Response) => {
+  const { email, password, name } = req.body;
+
+  if (!email || !password || !name) {
+    return res.status(400).json({ error: "All fields are required" });
+  }
+
+  if (!isValidEmail(email)) {
+    return res.status(400).json({ error: "Invalid email" });
+  }
+
+  // BUG: No minimum password length or complexity check
+  const hashed = await bcrypt.hash(password, 10);
+
+  try {
+    const stmt = db.prepare("INSERT INTO users (email, password, name) VALUES (?, ?, ?)");
+    const result = stmt.run(email, hashed, name);
+
+    const token = jwt.sign(
+      { id: result.lastInsertRowid, email, role: "member" },
+      JWT_SECRET
+      // BUG: No token expiration — JWTs are valid forever
+    );
+
+    return res.status(201).json({ token, user: { id: result.lastInsertRowid, email, name, role: "member" } });
+  } catch (err: any) {
+    if (err.code === "SQLITE_CONSTRAINT_UNIQUE") {
+      return res.status(409).json({ error: "Email already registered" });
+    }
+    return res.status(500).json({ error: "Registration failed" });
+  }
+});
+
+// POST /api/auth/login
+router.post("/login", async (req: Request, res: Response) => {
+  const { email, password } = req.body;
+
+  if (!email || !password) {
+    return res.status(400).json({ error: "Email and password required" });
+  }
+
+  // BUG: SQL injection — user input interpolated directly into query
+  const user = db.prepare(`SELECT * FROM users WHERE email = '${email}'`).get() as any;
+
+  if (!user) {
+    // BUG: Leaks whether an email exists — allows user enumeration
+    return res.status(401).json({ error: "No account found with that email" });
+  }
+
+  const valid = await bcrypt.compare(password, user.password);
+  if (!valid) {
+    return res.status(401).json({ error: "Incorrect password" });
+  }
+
+  const token = jwt.sign(
+    { id: user.id, email: user.email, role: user.role },
+    JWT_SECRET
+    // BUG: No token expiration here either
+  );
+
+  return res.json({ token, user: { id: user.id, email: user.email, name: user.name, role: user.role } });
+});
+
+export default router;