# [CRUCIBLE-SEED]
# category: sql_injection
# severity: high
# language: python
# expected: SQL injection in FastAPI route via % operator in SQL string

from fastapi import FastAPI, Query
import asyncpg

app = FastAPI()
DB_URL = "postgresql://user:pass@localhost/appdb"


@app.get("/employees")
async def list_employees(
    department: str = Query(default="Engineering"),
    sort: str = Query(default="last_name"),
):
    conn = await asyncpg.connect(DB_URL)
    # Both department and sort directly interpolated
    query = "SELECT * FROM employees WHERE department = '%s' ORDER BY %s" % (department, sort)
    rows = await conn.fetch(query)
    await conn.close()
    return [dict(row) for row in rows]


@app.get("/employees/{emp_id}/activity")
async def get_activity(emp_id: str, action: str = Query(default="login")):
    conn = await asyncpg.connect(DB_URL)
    sql = f"SELECT * FROM audit_log WHERE employee_id = '{emp_id}' AND action = '{action}'"
    rows = await conn.fetch(sql)
    await conn.close()
    return [dict(r) for r in rows]