# [CRUCIBLE-SEED]
# category: sql_injection
# severity: critical
# language: python
# expected: SQL injection via SQLAlchemy text() with string concatenation

from sqlalchemy import text, create_engine
from sqlalchemy.orm import Session

engine = create_engine("postgresql://user:pass@localhost/appdb")


def find_orders(user_id: str, status: str, sort_field: str) -> list:
    with Session(engine) as session:
        # text() used correctly — but string concatenation defeats parameterization
        sql = text(
            "SELECT * FROM orders WHERE user_id = '"
            + user_id
            + "' AND status = '"
            + status
            + "' ORDER BY "
            + sort_field
        )
        result = session.execute(sql)
        return result.fetchall()


def bulk_update_status(ids: list, new_status: str) -> int:
    id_list = ", ".join(str(i) for i in ids)
    with Session(engine) as session:
        result = session.execute(
            text(f"UPDATE orders SET status = '{new_status}' WHERE id IN ({id_list})")
        )
        session.commit()
        return result.rowcount