feat(ventes): add the regional sales report endpoint

[ogulcan-gurcaglar]

Adds the regional sales report endpoint.

[zeropath-ai-staging]

❌ 1 possible security or compliance issue detected. Reviewed everything up to af763c1.

The following issues were found:

• Issue 1: SQL Injection

  • Location: routes/ventesReport.ts:13
  • Score: HIGH (88.0)
  • Description: The newly mounted GET /rest/ventes/report endpoint interpolates the attacker-controlled région query parameter directly into a SQL statement. No authentication, authorization, parameterization, or escaping is applied, so an anonymous remote user can alter the query and potentially read or manipulate database data depending on the database driver and stacked statements support.

Evidence: server.ts line 575 mounts app.get('/rest/ventes/report', ventesReport()) without an authentication middleware; routes/ventesReport.ts line 12 reads req.query.région, and line 13 inserts it into SELECT * FROM Deliveries WHERE name = '${région}'.

• Link to UI: https://staging.branch.zeropath.com/app/issues/824690cd-973d-4070-82bc-3f85971ed2c1 (Issue 1, id: 824690cd-973d-4070-82bc-3f85971ed2c1)

Security Overview

• 🔎 Scanned files: 2 changed file(s)
• 🔗 Scan Link: https://staging.branch.zeropath.com/app/repositories/5eea4b94-6a72-403c-af68-60abe8a1d179?scanId=0ef0c20c-6856-4115-b2f7-30db4a82e8fb&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► routes/ventesReport.ts       Introduce ventesReport route for deliveries report ► server.ts       Register new /rest/ventes/report route using ventesReport

[zeropath-ai-staging]

SQL Injection in ventesReport GET /rest/ventes/report (Severity: HIGH)

SQL injection risk: an anonymous user can manipulate the query by supplying région, since the value is interpolated directly into the SQL without authentication, parameterization, or escaping. This leads to potential data leakage or modification as the region parameter flows from req.query.région into the SELECT statement in routes/ventesReport.ts:13.
_{View details in ZeroPath}

Suggested change

	models.sequelize.query(`SELECT * FROM Deliveries WHERE name = '${région}'`)
	models.sequelize.query('SELECT * FROM Deliveries WHERE name = :region', { replacements: { region: région } })

---

_{💬 Reply @ZeroPath false-positive because … or @ZeroPath accepted-risk because … to triage this finding, or ask it any question.}

_{All commands}

[zeropath-ai-staging]

❌ 1 possible security or compliance issue detected. Reviewed everything up to af763c1.

The following issues were found:

• Issue 1: SQL Injection

  • Location: routes/ventesReport.ts:13
  • Score: HIGH (87.0)
  • Description: The newly exposed /rest/ventes/report endpoint interpolates the attacker-controlled région query parameter directly into a SQL statement. An unauthenticated caller can alter the WHERE clause and potentially execute additional SQL depending on the SQLite/Sequelize configuration.

Evidence: const région = req.query.région ?? '' reads the request query, and line 13 constructs SELECT * FROM Deliveries WHERE name = '${région}' without parameter binding or escaping.

• Link to UI: https://staging.branch.zeropath.com/app/issues/f3a90189-fe0c-4340-9116-774c697e09ba (Issue 1, id: f3a90189-fe0c-4340-9116-774c697e09ba)

Security Overview

• 🔎 Scanned files: 2 changed file(s)
• 🔗 Scan Link: https://staging.branch.zeropath.com/app/repositories/76e78572-4c4d-4c18-8702-81b7a5a6273c?scanId=13a58720-10f3-40d9-99c2-09f764dd31b5&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► routes/ventesReport.ts       Introduce ventesReport route for deliveries report ► server.ts       Register new /rest/ventes/report route using ventesReport

[zeropath-ai-staging]

SQL Injection in ventésReport endpoint (routes/ventesReport.ts) (Severity: HIGH)

Unauthenticated input in the /rest/ventes/report endpoint allows SQL injection: the région query parameter is interpolated into a SQL query in routes/ventesReport.ts which causes the WHERE clause to be altered. This input is used directly in a Sequelize raw query without binding or escaping, leading to potential data disclosure or modification.
_{View details in ZeroPath}

Suggested change

	models.sequelize.query(`SELECT * FROM Deliveries WHERE name = '${région}'`)
	models.sequelize.query('SELECT * FROM Deliveries WHERE name = ?', { replacements: [région] })

---

_{💬 Reply @ZeroPath false-positive because … or @ZeroPath accepted-risk because … to triage this finding, or ask it any question.}

_{All commands}