feat(tenant): add tenant report endpoint

[ogulcan-gurcaglar]

Adds the tenant report endpoint.

[zeropath-ai-staging]

❌ 1 possible security or compliance issue detected. Reviewed everything up to 251bae9.

The following issues were found:

• Issue 1: SQL Injection

  • Location: routes/tenantReport.ts:24
  • Score: HIGH (87.0)
  • Description: The newly mounted public GET /rest/tenant/report endpoint interpolates the attacker-controlled tenant query parameter directly into a SQL query. An anonymous remote attacker can inject SQL syntax to alter the WHERE clause or append additional statements depending on the database driver, exposing arbitrary user records and potentially enabling database modification.

Evidence: server.ts:575 mounts tenantReport() without an authentication or authorization middleware, while routes/tenantReport.ts:23-24 reads req.query.tenant and embeds it directly in SELECT * FROM Users WHERE email = '${tenant}'. The result is returned to the caller at line 25.

• Link to UI: https://staging.branch.zeropath.com/app/issues/9c06ae6c-dc76-4615-b1f5-876be7a3c728 (Issue 1, id: 9c06ae6c-dc76-4615-b1f5-876be7a3c728)

Security Overview

• 🔎 Scanned files: 2 changed file(s)
• 🔗 Scan Link: https://staging.branch.zeropath.com/app/repositories/5eea4b94-6a72-403c-af68-60abe8a1d179?scanId=d1b391a1-1d7e-40dc-9579-e1382c059431&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► routes/tenantReport.ts       Implement new tenantReport route to fetch users by email Bug Fix

[zeropath-ai-staging]

SQL Injection in GET /rest/tenant/report (tenant param) (Severity: HIGH)

The endpoint accepts a tenant query parameter and directly embeds it into a SQL query, which causes an attacker-controlled value to alter the WHERE clause or run additional statements. This occurs in routes/tenantReport.ts where req.query.tenant is interpolated into the SELECT * FROM Users query, and the lack of authentication on server.ts:575 permits unauthenticated access.
_{View details in ZeroPath}

Suggested change

	models.sequelize.query(`SELECT * FROM Users WHERE email = '${tenant}'`)
	models.sequelize.query('SELECT * FROM Users WHERE email = ?', { replacements: [String(tenant)] })

---

_{💬 Reply @ZeroPath false-positive because … or @ZeroPath accepted-risk because … to triage this finding, or ask it any question.}

_{All commands}

[zeropath-ai-staging]

✅ No security or compliance issues detected. Reviewed everything up to 251bae9.

Security Overview

• 🔎 Scanned files: 2 changed file(s)
• 🔗 Scan Link: https://staging.branch.zeropath.com/app/repositories/76e78572-4c4d-4c18-8702-81b7a5a6273c?scanId=3ef21d1e-c4c6-46b5-bbb1-6aceb719ab58&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► routes/tenantReport.ts       Implement new tenantReport route to fetch users by email Bug Fix