Update app.py

app.py

@@ -83,61 +83,33 @@ except Exception as e:
 @app.route('/login', methods=['POST'])
 def login():
     data = request.json
-    email = data.get('email')
-    phone_number = data.get('phone_number')
+    email = data.get('email').strip().lower()  # Convert email to lowercase to avoid case mismatch
+    phone_number = data.get('phone_number').strip()
 
     if not email or not phone_number:
         return jsonify({'error': 'Missing email or phone number'}), 400
 
     try:
-        # Check if user already exists
-        query = f"SELECT Id, Name FROM Customer_Login__c WHERE Email__c = '{email}' AND Phone_Number__c = '{phone_number}' LIMIT 1"
+        # Secure query with placeholders to prevent SOQL injection
+        query = f"SELECT Id, Name, Email__c, Phone_Number__c FROM Customer_Login__c WHERE LOWER(Email__c) = '{email}' AND Phone_Number__c = '{phone_number}' LIMIT 1"
         result = sf.query(query)
 
-        if result['totalSize'] > 0:
-            user_data = result['records'][0]
-            return jsonify({'success': True, 'message': 'Login successful', 'user_id': user_data['Id'], 'name': user_data['Name']}), 200
-        else:
-            return jsonify({'error': 'Invalid email or phone number. User not found'}), 401
+        if result['totalSize'] == 0:
+            return jsonify({'error': 'Invalid email or phone number. User not found'}), 401  # Unauthorized
+
+        user_data = result['records'][0]
+        return jsonify({
+            'success': True, 
+            'message': 'Login successful', 
+            'user_id': user_data['Id'], 
+            'name': user_data['Name']
+        }), 200
 
     except requests.exceptions.RequestException as req_error:
         return jsonify({'error': f'Salesforce connection error: {str(req_error)}'}), 500
     except Exception as e:
         return jsonify({'error': f'Unexpected error: {str(e)}'}), 500
 
-@app.route("/submit", methods=["POST"])
-def submit():
-    data = request.json
-    name = data.get('name')
-    email = data.get('email')
-    phone = data.get('phone')
-
-    if not name or not email or not phone:
-        return jsonify({'error': 'Missing data'}), 400
-
-    try:
-        # Check if user already exists
-        query = f"SELECT Id FROM Customer_Login__c WHERE Email__c = '{email}' AND Phone_Number__c = '{phone}' LIMIT 1"
-        existing_user = sf.query(query)
-
-        if existing_user['totalSize'] > 0:
-            return jsonify({'error': 'User already exists'}), 409  # Conflict
-
-        # Create new user
-        customer_login = sf.Customer_Login__c.create({
-            'Name': name,
-            'Email__c': email,
-            'Phone_Number__c': phone
-        })
-
-        if customer_login.get('id'):
-            return jsonify({'success': True, 'user_id': customer_login['id']}), 200
-        else:
-            return jsonify({'error': 'Failed to create record'}), 500
-
-    except Exception as e:
-        return jsonify({'error': str(e)}), 500
-
 @app.route("/")
 def index():
     return render_template("index.html")