copilot-dev: Command for Claude Code

Perform a thorough review of the REST API endpoint in ${selection}.

If no code is selected, ask the user to paste the endpoint handler they want reviewed.

---

Review checklist

Work through each section systematically. For each item, state: PASS, FAIL, or N/A, followed by a brief explanation and (for FAILs) a concrete fix.

---

1. Input validation

• Are all path parameters, query parameters, and request body fields validated before use?
• Is validation done with a schema library (Zod, Pydantic, Joi, marshmallow) — not ad-hoc if checks?
• Are unknown fields rejected or stripped (no mass-assignment vulnerability)?
• Are field types, lengths, and formats enforced (e.g., email regex, ID must be UUID)?

What to look for:

// FAIL — no validation, trusting raw input
app.post('/users', (req, res) => {
  db.insert(req.body)  // dangerous: any fields accepted
})

// PASS — validate with Zod before touching the database
const CreateUserSchema = z.object({
  email: z.string().email(),
  name: z.string().min(1).max(100),
  role: z.enum(['admin', 'viewer'])
})

app.post('/users', (req, res) => {
  const parsed = CreateUserSchema.safeParse(req.body)
  if (!parsed.success) return res.status(400).json({ error: parsed.error.flatten() })
  db.insert(parsed.data)
})

---

2. Authentication and authorization

• Is the endpoint protected by an authentication middleware (JWT verification, session check, API key)?
• Is authorization checked — not just "is the user logged in" but "does THIS user own THIS resource"?
• Are admin-only endpoints guarded with a role check?
• Are anonymous requests rejected with 401 (not 403)?

What to look for:

// FAIL — endpoint readable by any authenticated user, even ones who don't own the resource
app.get('/users/:id/private-data', authMiddleware, async (req, res) => {
  const data = await db.getPrivateData(req.params.id)  // no ownership check!
  return res.json(data)
})

// PASS — verify the requesting user owns the resource
app.get('/users/:id/private-data', authMiddleware, async (req, res) => {
  if (req.user.id !== req.params.id && req.user.role !== 'admin') {
    return res.status(403).json({ error: 'Forbidden' })
  }
  const data = await db.getPrivateData(req.params.id)
  return res.json(data)
})