fixture(demo/login-route): implement login API route with vulnerable template literal and passwordHash leak

[waleedcodes]

📌 Pull Request #56 of 58: route.ts

📂 File & Architectural Context

• Target File: examples/demo-app/src/app/api/auth/login/route.ts
• Architectural Layer: Demo App Fixture (API Route Layer)
• Scope Identifier: demo/login-route

🎯 Overview & Motivation

Implements Next.js App Router POST login route with unescaped SQL template literal and passwordHash exposure to trigger ProofCode risk detectors.

🔍 Detailed Delta & Technical Implementation

• Implemented POST route receiving email and password.
• Uses unescaped template literal db.query exposing SQL injection (PC-SEC-001).
• Accesses database without auth check (PC-AUTH-001).
• Returns user record containing passwordHash violating privacy rule.

🛡️ Quality Gates & Verification

• Target Base Branch: working
• TypeScript Type Safety: 0 errors (tsc --noEmit).
• Code Quality: 0 ESLint warnings (eslint src --ext .ts).
• Test Suite: 34 / 34 passing tests across 13 test suites (vitest run).
• Production Bundle: Bundled in <700ms with esbuild.
• Verification Details: Verified detection by RiskEngine and ProjectRulesEngine.

---

Generated by ProofCode automated delivery pipeline with granular 3-commit pull requests against development branch working.