HIGH: crypto.randomUUID() used without importing the crypto module (AuthService.ts and SubscriptionController.ts) #7

New issue

Closed

opened 2026-05-09 00:00:37 +00:00 by Mark · 0 comments

Mark commented

2026-05-09 00:00:37 +00:00

Owner

Severity: High

Location

backend/src/services/AuthService.ts line 21
backend/src/controllers/SubscriptionController.ts line 75

Description

Both files use crypto.randomUUID() to generate IDs, but neither file imports the crypto module:

AuthService.ts (no import at line 1, only imports UserRepository, User, and auth helpers):

const user: User = {
  id: crypto.randomUUID(),

SubscriptionController.ts (only imports Response from express):

id: crypto.randomUUID(),

This code currently works in Node.js 19+ where globalThis.crypto has a randomUUID() method, but it will fail at runtime on Node.js 18.x or in environments where the global Web Crypto API does not include randomUUID(). It also produces a TypeScript compile error in strict mode since the global crypto type does not include randomUUID().

By contrast, backend/src/auth.ts correctly imports crypto on line 3.

Suggested Fix

Add the import to both files:

import crypto from 'crypto';

Or consider using uuid package which is already in the dependencies:

import { v4 as uuidv4 } from 'uuid';

## Severity: High ## Location - `backend/src/services/AuthService.ts` line 21 - `backend/src/controllers/SubscriptionController.ts` line 75 ## Description Both files use `crypto.randomUUID()` to generate IDs, but neither file imports the `crypto` module: **AuthService.ts** (no import at line 1, only imports UserRepository, User, and auth helpers): ```typescript const user: User = { id: crypto.randomUUID(), ``` **SubscriptionController.ts** (only imports Response from express): ```typescript id: crypto.randomUUID(), ``` This code currently works in Node.js 19+ where `globalThis.crypto` has a `randomUUID()` method, but it will **fail at runtime** on Node.js 18.x or in environments where the global Web Crypto API does not include `randomUUID()`. It also produces a TypeScript compile error in strict mode since the global `crypto` type does not include `randomUUID()`. By contrast, `backend/src/auth.ts` correctly imports `crypto` on line 3. ## Suggested Fix Add the import to both files: ```typescript import crypto from 'crypto'; ``` Or consider using `uuid` package which is already in the dependencies: ```typescript import { v4 as uuidv4 } from 'uuid'; ```