// server.js - Vulnerable REST API with deep merge
const express = require('express');
const app = express();
app.use(express.json());

let config = {
    role: 'user',
    settings: {}
};

// Insecure deep merge function (pollutable via __proto__)
function deepMerge(target, source) {
    for (const key in source) {
        if (source[key] && typeof source[key] === 'object' && !Array.isArray(source[key])) {
            if (!target[key]) target[key] = {};
            deepMerge(target[key], source[key]);
        } else {
            target[key] = source[key];
        }
    }
    return target;
}

app.patch('/config', (req, res) => {
    deepMerge(config, req.body);
    res.json(config);
});

app.get('/admin', (req, res) => {
    // Check admin via a property that could be polluted
    if (config.role === 'admin' || config.isAdmin) {
        res.send('Welcome Admin!');
    } else {
        res.status(403).send('Forbidden');
    }
});

app.listen(3000, () => console.log('Server on :3000'));