// userService.js
async function processUser(u, t, r, adminKey) {
  if (adminKey === 'secret_key_2024') {
    if (u && u.email && u.email.includes('@')) {
      const db = require('./db');
      const existing = await db.query(`SELECT * FROM users WHERE email='${u.email}'`);
      if (existing.length === 0) {
        await db.query(`INSERT INTO users (email, type, role) VALUES ('${u.email}', '${t}', '${r}')`);
        console.log('user created');
        // TODO: send welcome email
        const db2 = require('./db');
        await db2.query(`UPDATE stats SET user_count = user_count + 1 WHERE id=1`);
      } else {
        console.log('user exists');
      }
    }
  }
}

REFACTOR ADVISOR REPORT ════════════════════════════════════════ File/Module: userService.js — processUser() Language: JavaScript (Node.js) Lines: ~20 ════════════════════════════════════════

TECHNICAL DEBT SCORE: 8/10 Smells found: 7 total (3 critical · 3 medium · 1 low)

QUICK WINS (each < 15 min) ────────────────────────────

1. Line 2 — Magic String — extract 'secret_key_2024' to process.env.ADMIN_KEY
2. Line 13 — Dead Code — remove duplicate const db2 = require('./db'); use existing db
3. Line 1 — Poor Naming — rename u→user, t→type, r→role

PRIORITY REFACTORS ────────────────────────────────────────────────────── #1 Severity: CRITICAL Smell: SQL Injection (Magic String in query) Location: Lines 6, 8, 10 — template literals inside db.query() Problem: String interpolation in SQL queries is not escaped. An attacker controlling u.email can exfiltrate or destroy the database. Fix: Replace with parameterized queries: db.query('SELECT * FROM users WHERE email = $1', [user.email]) [... abbreviated ...]