fix: enforce authKey on GET /v1/customer/bycompany/:id (closes #3)

[CryptoJones]

Closes #3.

Stacked on #33 → #34 → #35. Merge those in order or this PR's diff against master will include their changes too.

The bug

Five-year-old security issue (open since Feb 2021): getAllByCompanyId never checked the authKey header before issuing the database query. Anyone who guessed or scraped a company ID could list customers for that company. No authentication was applied at all to this endpoint.

// Before — no auth check at all:
exports.getAllByCompanyId = (req, res) => {
    Customer.findAll({ where: { custCompId: req.params.id } })
        .then(/* … */);
};

The fix

Mirrors getCustomerById's existing auth pattern:

1. authKey header must be present → 403 "Authorization key not sent."
2. authKey may be a master key → proceed (sees all companies)
3. Otherwise the authKey's own company must equal :id → proceed
4. Otherwise → 403 "Invalid Authorization Key."

Implementation:

• Handler converted to async so it can await the existing IsMaster and GetCompanyId helpers (same pattern getCustomerById already uses).
• String-coerced equality on company IDs because req.params.id arrives as a string while akCompanyId returns INT from Sequelize. Both sides are narrowed to numerics, so a String() comparison is the simplest correct check.

Test changes

PR #35 added a test.fails regression pin for this exact bug, with the intent that whoever fixed the bug would flip it to plain test. That's this PR. The pin is now a permanent assertion:

test('returns 403 when authKey is missing (regression for #3)', async () => {
    const res = await request(app).get('/v1/customer/bycompany/1');
    expect(res.status).toBe(403);
    expect(res.body).toMatchObject({
        message: expect.stringMatching(/Authorization key not sent/i),
    });
});

Suite after the fix:

 Test Files  2 passed (2)
      Tests  4 passed (4)

All four tests now pass plain (no more expected fail).

Not in scope

getCustomerById has its own latent bug — the master-key path kicks off Customer.findByPk(...).then(...) but doesn't return, so execution falls through to the company-match check, which can send a second response and produce a race. That deserves its own PR with its own test coverage; this one is focused on the named #3 issue and the regression pin.

Proudly Made in Nebraska. Go Big Red! 🌽 https://xkcd.com/2347/