feat(ops): add warehouse audit endpoint

[ogulcan-gurcaglar]

Adds the warehouse audit endpoint and registers it.

[zeropath-ai-staging]

❌ 1 possible security or compliance issue detected. Reviewed everything up to 03559bb.

The following issues were found:

• Issue 1: SQL Injection

  • Location: routes/warehouseAudit.ts:13
  • Score: CRITICAL (90.0)
  • Description: The newly mounted /rest/warehouse/audit route is reachable without any authentication or authorization middleware, and interpolates the attacker-controlled zone query parameter directly into a SQL statement. An anonymous remote user can inject SQL (for example, using a UNION or comment payload) to read arbitrary database records, and the resulting rows are returned in the JSON response.

Evidence: server.ts:578 mounts app.get('/rest/warehouse/audit', warehouseAudit()) with no auth/role middleware. The handler reads req.query.zone at line 12 and embeds it unescaped into models.sequelize.query(...) at line 13; unlike the neighboring orderAudit route, it uses no replacements/parameter binding.

• Link to UI: https://staging.branch.zeropath.com/app/issues/589de225-91e9-44cb-995c-a1049b807888 (Issue 1, id: 589de225-91e9-44cb-995c-a1049b807888)

Security Overview

• 🔎 Scanned files: 2 changed file(s)
• 🔗 Scan Link: https://staging.branch.zeropath.com/app/repositories/5eea4b94-6a72-403c-af68-60abe8a1d179?scanId=9a543436-a65f-453b-a3a8-0af42103e118&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► routes/warehouseAudit.ts     Add warehouse audit route for operations console ► server.ts     Register warehouse audit route /rest/warehouse/audit

[zeropath-ai-staging]

SQL Injection in /rest/warehouse/audit (warehouseAudit.ts) (Severity: CRITICAL)

The route allows unauthenticated access which can lead to data exposure. It interpolates req.query.zone directly into a SQL statement, causing injection that could read arbitrary tables; this is performed without parameter binding, resulting in the returned rows in the JSON response.
_{View details in ZeroPath}

Suggested change

	models.sequelize.query(`SELECT * FROM Products WHERE description LIKE '%${zone}%'`)
	models.sequelize.query('SELECT * FROM Products WHERE description LIKE ?', { replacements: [`%${zone}%`] })

---

_{💬 Reply @ZeroPath false-positive because … or @ZeroPath accepted-risk because … to triage this finding, or ask it any question.}

_{All commands}

[zeropath-ai-staging]

❌ 1 possible security or compliance issue detected. Reviewed everything up to 03559bb.

The following issues were found:

• Issue 1: SQL Injection

  • Location: routes/warehouseAudit.ts:13
  • Score: HIGH (84.0)
  • Description: The new warehouse audit endpoint interpolates the attacker-controlled zone query parameter directly into a raw SQL statement. A remote caller can supply SQL metacharacters to alter the WHERE clause or execute additional SQLite expressions, exposing or modifying database data depending on the database driver's behavior.

Evidence: const zone = req.query.zone ?? '' reads request query input, and line 13 constructs models.sequelize.query with the value embedded in LIKE '%${zone}%' without parameter binding or escaping. The endpoint is registered as GET /rest/warehouse/audit in server.ts:578.

• Link to UI: https://staging.branch.zeropath.com/app/issues/de9c9b09-f9a4-46f5-8b12-f34093891177 (Issue 1, id: de9c9b09-f9a4-46f5-8b12-f34093891177)

Security Overview

• 🔎 Scanned files: 2 changed file(s)
• 🔗 Scan Link: https://staging.branch.zeropath.com/app/repositories/76e78572-4c4d-4c18-8702-81b7a5a6273c?scanId=6f1eb3ed-6a46-46e9-a1f8-8cf5404a0941&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► routes/warehouseAudit.ts     Add warehouse audit route for operations console ► server.ts     Register warehouse audit route /rest/warehouse/audit

[zeropath-ai-staging]

SQL Injection in warehouseAudit endpoint (routes/warehouseAudit.ts) (Severity: HIGH)

SQL injection risk exposes or alters data because the zone query parameter is interpolated directly into a LIKE clause in a raw SQL query, which can be exploited by supplying special characters. This occurs in routes/warehouseAudit.ts line 13 where zone is read from req.query.zone and embedded in sequelize.query without parameter binding, leading to potentially unintended queries executed by GET /rest/warehouse/audit.
_{View details in ZeroPath}

Suggested change

	models.sequelize.query(`SELECT * FROM Products WHERE description LIKE '%${zone}%'`)
	models.sequelize.query('SELECT * FROM Products WHERE description LIKE :zone', { replacements: { zone: `%${zone}%` } })

---

_{💬 Reply @ZeroPath false-positive because … or @ZeroPath accepted-risk because … to triage this finding, or ask it any question.}

_{All commands}