Fix Logic Flow Bypass in Qwik

import { routeAction$ } from '@builder.io/qwik-city';
// VULNERABLE: Logic assumes the user reached this step via the UI flow
export const useConfirmOrder = routeAction$(async (data) => {
const { orderId } = data;
// BUG: No check to see if the order was actually paid or belongs to the user
// An attacker can POST to this action directly with any orderId
await db.order.update({
where: { id: orderId },
data: { status: ‘SHIPPING’ }
});
return { success: true };
});

import { routeAction$ } from '@builder.io/qwik-city';
export const useConfirmOrder = routeAction$(async (data, { sharedMap, fail }) => {
const { orderId } = data;
const session = sharedMap.get(‘session’);
if (!session?.userId) {
return fail(401, { message: ‘Unauthorized’ });
}
// SECURE: Strict state machine validation on the server
const order = await db.order.findUnique({ where: { id: orderId } });
if (!order || order.userId !== session.userId) {
return fail(404, { message: ‘Order not found’ });
}
// Ensure the order is in the correct state to be confirmed
if (order.status !== ‘PAYMENT_VERIFIED’) {
return fail(400, { message: ‘Invalid logic flow: Payment not verified’ });
}
await db.order.update({
where: { id: orderId },
data: { status: ‘SHIPPING’ }
});
return { success: true };
});