Course Introduction

# Example test failures and stack traces (console output)
effect = self.side_effect
if effect is not None:
    if _is_exception(effect):
        raise effect
E   Exception: HTTP 404

/Library/Frameworks/Python.framework/Versions/3.12/lib/python3.12/unittest/mock.py:1196: Exception
    TestEdgeCases.test_extreme_wind_directions

self = <test_app.TestEdgeCases object at 0x1148e3d10>

def test_extreme_wind_directions(self):
    """Test edge cases for wind direction conversion."""
    # Test boundary conditions
    assert self.decoder.get_wind_direction_text(361) == 'north'  # Should wrap around
    assert self.decoder.get_wind_direction_text(-1) == 'north-northwest'  # Negative wrapping
E   AssertionError: assert 'north' == 'north-northwest'
E     - north-northwest
E     + north

test_app.py:278: AssertionError

FAILED test_app.py::TestMETARDecoder::test_decode_weather_phenomena - AssertionError: assert 'rain, thunderstorm' == 'thunderstorm, rain'
FAILED test_app.py::TestMETARDecodingIntegration::test_decode_metar_with_weather - AssertionError: assert 'scattered clouds at 800 feet' in 'overcast at 2500 feet'
FAILED test_app.py::TestMETARDecodingIntegration::test_decode_multiple_weather_phenomena - AssertionError: assert 'heavy thunderstorm, heavy rain' in 'heavy rain, heavy thunderstorm'
FAILED test_app.py::TestFetchMETAR::test_fetch_metar_network_error - Exception: Network error
FAILED test_app.py::TestFetchMETAR::test_fetch_metar_http_error - Exception: HTTP 404
FAILED test_app.py::TestEdgeCases::test_extreme_wind_directions - AssertionError: assert 'north' == 'north-northwest'

Welcome to the KodeKloud Hands-On lab

KODEKLOUD

All rights reserved

root@controlplane ~ via v3.12.3 ➜

● Write(audits/ERROR_HANDLING_COMPREHENSIVE_REVIEW.md)
└─ Wrote 596 lines to audits/ERROR_HANDLING_COMPREHENSIVE_REVIEW.md
# Error Handling Comprehensive Review
## Executive Summary
**Status:** ❌ **CRITICAL DEFICIENCIES IDENTIFIED**
**Overall Score:** 3.5/10
The Express Login Demo exhibits severe error handling vulnerabilities that create significant security risks and operational issues. The application lacks centralized error management, exposes sensitive information through verbose error messages, and has inconsistent handling across routes.
## Critical Findings Overview
+586 lines (ctrl+r to expand)
* Whirlpooling... (esc to interrupt)

- config/database.js - PostgreSQL database connection pool
- routes/auth.js - Authentication routes (currently only login)
- schema.sql - Database schema definition

Route-Controller Architecture:

Routes are directly connected using Express Router patterns:
- Main server mounts auth routes at /api/auth (server.js:11)
- Auth router handles /login endpoint with inline controller logic (routes/auth.js:9-96)
- No separate controller layer - business logic is embedded in route handlers

Database:

PostgreSQL with:
- Connection via pg library with connection pooling (config/database.js:3-9)
- Single users table with id, email, name, password, timestamps (schema.sql:8-15)
- Email index for performance (schema.sql:18)
- Uses bcrypt for password hashing and JWT for authentication tokens

$ grep -r "console\.log\|console\.error" /Users/jeremy/Repos/Claude\ Code\ Course/Express-login-demo/ --include="*.js" --exclude-dir=node_modules
/Users/jeremy/Repos/Claude Code Course/Express-login-demo/config/database.js: console.log('Connected to PostgreSQL database');
/Users/jeremy/Repos/Claude Code Course/Express-login-demo/config/database.js: console.error('Database connection error:', err);
 /Users/jeremy/Repos/Claude Code Course/Express-login-demo/server.js: console.log(`Server running on port ${PORT}`)

$ grep -r "password\|secret\|token\|key" /Users/jeremy/Repos/Claude\ Code\ Course/Express-login-demo/.env
/Users/jeremy/Repos/Claude Code Course/Express-login-demo/.env:JWT_SECRET=your_jwt_secret_key_here
/Users/jeremy/Repos/Claude Code Course/Express-login-demo/.env:DB_PASSWORD=your_db_password

Update Todos
- Examine codebase structure and identify database files
- Analyze database schema and configuration
- Review all database queries for SQL injection vulnerabilities
- Check connection string and credential security
- Verify parameterized queries and ORM usage
- Assess database permissions and access controls
- Review sensitive data handling and encryption
- Check transaction handling and error management
- Analyze logging and audit capabilities
- Generate comprehensive security report

Write(audits/DATABASE_SECURITY_AUDIT_REPORT.md)

Opened changes in Visual Studio Code ✎
Save file to continue...

Do you want to make this edit to DATABASE_SECURITY_AUDIT_REPORT.md?
1. Yes
2. Yes, for this session only (shift+tab)
3. No, and tell Cloud what to do differently (esc)

#!/usr/bin/env python3
import os
import sys
import argparse
from pathlib import Path

class ProjectGenerator:
    def __init__(self):
        self.dist_dir = Path("dist")
        self.templates = {
            # ... template definitions ...
        }

    def generate(self, project_type: str, name: str):
        # Implementation that writes project files to dist/
        pass

if __name__ == "__main__":
    parser = argparse.ArgumentParser(description="Generate starter projects.")
    parser.add_argument("type", help="Type of project to generate")
    parser.add_argument("name", help="Name of the project")
    args = parser.parse_args()

    gen = ProjectGenerator()
    gen.generate(args.type, args.name)
# (Output truncated — generator wrote many files)

$ mkdir -p dist