done app by Vladokvl · Pull Request #271 · mate-academy/node_auth-app

Vladokvl · 2026-04-27T15:30:45Z

Implement full-stack auth app (backend + frontend)

Added a complete authentication application split into two separate services under src/:

src/backend/ — Node.js + Express + TypeScript REST API with Prisma ORM
src/frontend/ — React + Vite SPA + TypeScript

Features implemented:

Register with name, email, password + activation email
Login / Logout with JWT (access + refresh tokens)
Password reset via email
Profile page: change name, password, email (notifies old email on change)
Protected and public routes
404 page

Running with Docker Compose (recommended):

cd src
docker compose up --build

The app uses Prisma to connect to PostgreSQL. See src/docker-compose.yaml for the connection string and required environment variables — replace them with your own values before running.

Running separately (without Docker):
You can run the backend and frontend independently by navigating to the corresponding directory:
cd src/backend
npm i
npm run dev

cd src/frontend
npm i
npm run dev

Don't forget to create a .env file in src/backend/ with the required environment variables (see src/docker-compose.yaml for reference).

mateacademy-ai-mentor

Review Summary

This implementation has several critical issues that must be fixed before approval. First, the API calls in src/frontend/src/api/auth.ts are broken - register and logout paths are missing the leading /, which will cause 404 errors (e.g., client.post("register", ...) resolves incorrectly). Second, ActivationPage.tsx redirects to /login but the task explicitly requires 'redirect to Profile after the activation' - this is a direct requirements violation. Third, there's a significant security issue: user.route.ts line 9 has a GET /users endpoint with no authMiddleware, exposing all user data publicly. Fourth, auth.controller.ts line 23 says 'User with this name already exists' when it should reference email - this misleads users. Fifth, the activation handler in auth.controller.ts has no response when the token is invalid, leaving requests hanging. Finally, the backend validation only checks minimum 8 characters but the task requires informing AND checking password rules (uppercase, numbers) - these should be validated server-side as well. Please fix these critical issues and resubmit.

✨ Please rate this review in the Platform's notification center¹. I will be grateful for your feedback! ✨

Important

Fix the issues, commit the changes, and then re-request my review using the Re-request review button² in the Reviewers tab.

Tip

If you have any comments about this review, please leave a message in the Add a comment section below and mention me with the @mateacademy-ai-mentor tag³.
I will read your message during my next review of your pull request. Please do not reply directly to my comments, as that feature is not supported yet.

Caution

Do not close the pull request until the review is complete. Closing it early can lead to unexpected behavior and disrupt the review process.

mateacademy-ai-mentor · 2026-04-27T15:36:50Z

+
+    if (userExists) {
+      return res
+        .status(400)
+        .json({ error: "User with this name already exists" });


Error message says 'User with this name already exists' but this is an email check - should say 'email' not 'name'

mateacademy-ai-mentor · 2026-04-27T15:36:50Z

+const register = async (req: Request, res: Response) => {
+  try {
+    const { email, password, name } = req.body;
+    const expiringTime = new Date(Date.now() + 30 * 60 * 1000);
+    const token = crypto.randomBytes(32).toString("hex");
+    const userExists = await prisma.user.findUnique({
+      where: { email: email },
+    });
+
+    if (userExists) {
+      return res
+        .status(400)
+        .json({ error: "User with this name already exists" });
+    }
+
+    const saltRounds = 10;
+    const passwordHash = await bcrypt.hash(password, saltRounds);
+
+    const newUser = await prisma.user.create({
+      data: {
+        name,
+        email,
+        passwordHash,
+        activationToken: token,
+        activationTokenExpiring: expiringTime,
+      },
+    });
+
+    sendActivationEmail(email, token);
+    res.json({
+      message: "Check your email for verification",
+    });
+  } catch (error) {
+    console.log(error);
+    res.status(500).json({ error: "server error" });
+  }


The task requires informing users about password rules AND checking them. The backend validation (auth.validation.ts) only checks min 8 characters but frontend validates uppercase and numbers. For better security, consider adding password complexity validation to the backend schema (e.g., regex for uppercase and numbers).

mateacademy-ai-mentor · 2026-04-27T15:36:50Z

+const activate = async (req: Request, res: Response) => {
+  const tokenFromUser = req.query.token;
+  if (typeof tokenFromUser === "string") {
+    const user = await prisma.user.findFirst({
+      where: {
+        activationToken: tokenFromUser, // Пошук за токеном
+        activationTokenExpiring: { gt: new Date() }, // І перевірка часу одним махом
+      },
+    });
+
+    if (user?.isActivated === true) {
+      return res.status(400).json({ error: "user already activated" });
+    }
+    if (!user) {
+      return res.status(404).json({ error: "Invalid token or timed out" });
+    }
+
+    const activatedUser = await prisma.user.update({
+      where: { id: user.id },
+      data: {
+        isActivated: true,
+        activationToken: null,
+        activationTokenExpiring: null,
+      },
+    });
+
+    res.json({ message: "Successful activation" });
+  }


If token is not a string, no response is sent to the client. Consider adding an error response for non-string token values.

mateacademy-ai-mentor · 2026-04-27T15:36:50Z

+
+    res.json({ message: "Successful activation" });


Task requirement states 'redirect to Profile after the activation', but the frontend ActivationPage.tsx redirects to login. Either the backend should return a redirect indicator or the frontend should navigate to /profile instead of /login.

mateacademy-ai-mentor · 2026-04-27T15:36:50Z

+import { NextFunction, Request, Response } from "express";
+


The api.error.ts file is empty. This appears to be a placeholder for custom error classes that could be used throughout the application for consistent error handling.

mateacademy-ai-mentor · 2026-04-27T15:36:50Z

@@ -0,0 +1,8 @@
+import { PrismaClient } from "../generated/prisma/client.js";
+import { PrismaPg } from "@prisma/adapter-pg";


The userService import is imported but never used in this file.

mateacademy-ai-mentor · 2026-04-27T15:36:50Z

+import { PrismaClient } from "../generated/prisma/client.js";
+import { PrismaPg } from "@prisma/adapter-pg";


The api.error.ts file is empty. If this was intended to contain custom API error classes, it should be implemented; otherwise, the file can be removed.

mateacademy-ai-mentor · 2026-04-27T15:36:50Z

+  if (!isPasswordValid) {
+    res.status(401);
+    res.json("Old password are incorrect");


The response format is inconsistent. After setting status(401), calling res.json() with a string instead of an object creates an invalid response. Should use: res.status(401).json({ error: "Old password is incorrect" })

mateacademy-ai-mentor · 2026-04-27T15:36:50Z

+  const isPasswordValid = await bcrypt.compare(oldPassword, user.passwordHash);
+
+  if (!isPasswordValid) {
+    res.status(401);


Typo: 'are incorrect' should be 'is incorrect'

mateacademy-ai-mentor · 2026-04-27T15:36:50Z

+async function getUsers(req: Request, res: Response) {
+  const users = await userService.getPublicUsers();
+
+  res.json(users);


The getUsers endpoint returns all users, which isn't required for the profile page. The profile page should only allow viewing/editing the authenticated user's own data. This endpoint could be removed or secured differently if not needed elsewhere.

mateacademy-ai-mentor · 2026-04-27T15:36:56Z

+import { authController } from "../controllers/auth.controller.js";
+import { validateMiddleware } from "../middlewares/validateMiddleware.js";
+import {
+  activationSchema,
+  confirmPasswordResetSchema,
+  loginSchema,
+  registerSchema,
+  requestPasswordResetSchema,


The errorMiddleware doesn't call next(error) which is the standard Express pattern for error handlers. This means errors aren't passed to subsequent handlers if any exist. Either remove the unused next parameter or call next(error).

mateacademy-ai-mentor · 2026-04-27T15:36:56Z

+
+authRouter.post(
+  "/register",
+  validateMiddleware(registerSchema),
+  catchError(authController.register),
+);
+
+authRouter.get(
+  "/activation",
+  validateMiddleware(activationSchema, "query"),
+  catchError(authController.activate),
+);
+
+authRouter.post(
+  "/login",
+  validateMiddleware(loginSchema),
+  catchError(authController.login),
+);
+
+authRouter.post("/logout", catchError(authController.logout));
+
+authRouter.get("/refresh", catchError(authController.refresh));
+
+authRouter.post(
+  "/password-reset",
+  validateMiddleware(requestPasswordResetSchema),
+  catchError(authController.requestPasswordReset),
+);
+
+authRouter.post(
+  "/password-reset/confirm",
+  validateMiddleware(confirmPasswordResetSchema),
+  catchError(authController.confirmPasswordReset),
+);


Backend routes like /register, /login, /password-reset are accessible to both authenticated and non-authenticated users. The authentication guards (PublicRoute/ProtectedRoute) only exist on the frontend. For proper security, consider adding middleware to these routes on the backend to prevent authenticated users from accessing them.

mateacademy-ai-mentor · 2026-04-27T15:36:57Z

+    res.sendStatus(401);
+    return;
+  }
+


The logout endpoint should be protected by authMiddleware according to the requirements ('Logout (only authenticated)'). Currently anyone can call logout even without being authenticated.

mateacademy-ai-mentor · 2026-04-27T15:36:57Z

+  }
+
+  req.user = userData as PublicUser;
+  next();


The refresh endpoint should also be protected or have additional validation. While token refresh typically doesn't require prior auth, it should verify the refresh token is valid.

mateacademy-ai-mentor · 2026-04-27T15:36:57Z

+export const errorMiddleware = (
+  error: Error,
+  req: Request,
+  res: Response,


The next parameter is unused in the error middleware. While this is valid for Express error handlers, you could remove it or add error logging for debugging purposes.

mateacademy-ai-mentor · 2026-04-27T15:36:57Z

+import cookieParser from "cookie-parser";
+import { errorMiddleware } from "./middlewares/errorMiddleware.js";
+
+


The GET /users endpoint has no authMiddleware, meaning any unauthenticated user can access all user data. This is a security issue. Either add authMiddleware or remove this endpoint if not needed.

mateacademy-ai-mentor · 2026-04-27T15:36:57Z

+const port = process.env.PORT || 3002;
+const corsOptions = {
+  origin: 'http://localhost:5173', 


Missing semicolons at the end of these lines, making the code inconsistent with the rest of the file.

mateacademy-ai-mentor · 2026-04-27T15:36:57Z

+import "dotenv/config";
+import cors from "cors";
+import { authRouter } from "./routes/auth.route.js";
+import { userRouter } from "./routes/user.route.js";


Typos: 'Pasword' should be 'Password' and 'lenth' should be 'length'

mateacademy-ai-mentor · 2026-04-27T15:36:57Z

+const port = process.env.PORT || 3002;
+const corsOptions = {
+  origin: 'http://localhost:5173', 
+  credentials: true,


The Ukrainian comment should be in English for consistency in a codebase.

mateacademy-ai-mentor · 2026-04-27T15:36:57Z

+
+app.listen(port, () => {
+  console.log(`server running on localhost:${port}`);
+});


The task requires '404 for all the other pages'. The server.ts doesn't have a catch-all route handler for undefined paths that returns 404. Consider adding: app.use((req, res) => res.status(404).json({ message: 'Not Found' }));

mateacademy-ai-mentor · 2026-04-27T15:37:01Z

+
+app.use(authRouter);
+app.use('/users', userRouter);
+app.use(errorMiddleware);


Typo: 'Acount activation' should be 'Account activation'

mateacademy-ai-mentor · 2026-04-27T15:37:01Z

+const corsOptions = {
+  origin: 'http://localhost:5173', 
+  credentials: true,
+};


Typo: 'Activate acount' should be 'Activate account'

mateacademy-ai-mentor · 2026-04-27T15:37:01Z

+// Create a transporter using SMTP
+const transporter = nodemailer.createTransport({


Typo in error message: 'Pasword minimum lenth is 8' should be 'Password minimum length is 8'

mateacademy-ai-mentor · 2026-04-27T15:37:01Z

+  try {
+    const info = await transporter.sendMail({
+      from: '"Zhovtany Vladyslav fullstack App" <>', // sender address
+      to: email, // list of recipients


Typo in email: 'Acount activation' should be 'Account activation'

mateacademy-ai-mentor · 2026-04-27T15:37:02Z

+
+export async function sendActivationEmail(email: string, token: string) {
+  const href = `http://${process.env.CLIENT_HOST}:${process.env.CLIENT_PORT}/activation?token=${token}`;
+  const html = `


Typo in email HTML: 'Activate acount' should be 'Activate account'

mateacademy-ai-mentor · 2026-04-27T15:37:02Z

+  service: "gmail",
+  auth: {
+    user: process.env.SMTP_USER,
+    pass: process.env.SMTP_PASS,


The GET /users/ endpoint returns all users, which isn't needed for the profile page. Users should only be able to view/edit their own profile data. Consider removing this endpoint or restricting it if not required.

mateacademy-ai-mentor · 2026-04-27T15:37:02Z

+    name: z.string().min(3).optional(),
+})
+
+export const loginSchema = z.object({


The GET "/" endpoint returns all users. This isn't needed for the profile page which should only show/edit the authenticated user's own data. Consider removing this or making it an admin-only endpoint.

mateacademy-ai-mentor · 2026-04-27T15:37:02Z

+import z from "zod"
+
+export const registerSchema = z.object({
+    email: z.string().email("Invalid Email"),


Typo in validation message: 'Pasword minimum lenth is 8' should be 'Password minimum length is 8'

mateacademy-ai-mentor · 2026-04-27T15:37:02Z

+})
+
+export const loginSchema = z.object({
+    email: z.string().email("Invalid Email"),


Typo in validation message: 'Password are required' should be 'Password is required'

mateacademy-ai-mentor · 2026-04-27T15:37:02Z

+import z from "zod"
+
+export const registerSchema = z.object({
+    email: z.string().email("Invalid Email"),


The task requires informing users about password rules AND checking them. The backend only validates min 8 characters, but frontend also validates uppercase letters and numbers. For better security, consider adding password complexity validation to the backend (regex for uppercase and numbers).

mateacademy-ai-mentor · 2026-04-27T15:37:06Z

+
+export const updateEmailSchema = z.object({
+  newEmail: z.string().email("Invalid email"),
+  password: z.string().min(1, "Password is required"),
+});
+


The requirements state '404 for all the other pages' but the server doesn't have a catch-all route handler for undefined paths. Add app.use((req, res) => res.status(404).json({ error: 'Not found' })) at the end before errorMiddleware.

mateacademy-ai-mentor · 2026-04-27T15:37:06Z

+  newName: z.string().min(3, "Name must be at least 3 characters"),
+});
+
+export const updateEmailSchema = z.object({


Typo in email subject: 'Acount activation' should be 'Account activation'

mateacademy-ai-mentor · 2026-04-27T15:37:07Z

+})
+
+export const activationSchema = z.object({
+    token: z.string().min(64, "Invalid token format"), // 32 байти у hex мають довжину 64 символи


Typo in email content: 'Activate acount' should be 'Activate account'

mateacademy-ai-mentor · 2026-04-27T15:37:07Z

+import { catchError } from "../lib/catchError.js";
+import { validateMiddleware } from "../middlewares/validateMiddleware.js";


Typo in error message: 'Pasword' should be 'Password' and 'lenth' should be 'length'.

mateacademy-ai-mentor · 2026-04-27T15:37:07Z

+import { Prisma, User } from "../generated/prisma/client.js";
+import { prisma } from "../lib/db.js";
+
+const publicUserSelect = {


The token.service.ts file is empty and the token operations (refresh token creation, deletion) are handled directly in the auth controller. Either implement this service or remove the unused file.

mateacademy-ai-mentor · 2026-04-27T15:37:07Z

+{
+  "compilerOptions": {
+    "target": "ES2022",


The token.service.ts file contains only an import statement with no actual functionality. This appears to be a placeholder that was never implemented. Either implement it or remove it if not needed.

mateacademy-ai-mentor · 2026-04-27T15:37:07Z

+import jwt from "jsonwebtoken";
+import "dotenv/config";
+import { PublicUser } from "./user.service.js";


The token.service.ts file is essentially empty - it imports prisma but has no exported functions or constants. This appears to be a placeholder that was never implemented. If not needed, it should be removed to avoid confusion.

mateacademy-ai-mentor · 2026-04-27T15:37:07Z

+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U vladok -d mainTestDB"]


The Dockerfile references nginx.conf but this file is not provided in the project files. Without it, nginx won't have proper configuration and the frontend won't serve correctly.

mateacademy-ai-mentor · 2026-04-27T15:37:07Z

+      PORT: 3001
+      HOST: localhost
+      CLIENT_HOST: localhost
+      CLIENT_PORT: 5173


The DATABASE_URL includes ?schema=sample which is unusual. PostgreSQL schemas are typically 'public' by default, not 'sample'. This might cause issues if the migrations don't target this schema.

mateacademy-ai-mentor · 2026-04-27T15:37:07Z

+    <meta charset="UTF-8" />
+    <link rel="icon" type="image/svg+xml" href="/favicon.svg" />


The register path is missing the leading / - should be /register instead of register. Without the slash, axios will append to baseURL incorrectly (e.g., http://localhost:3001register instead of http://localhost:3001/register).

mateacademy-ai-mentor · 2026-04-27T15:37:11Z

+  <body>
+    <div id="root"></div>


The logout path is missing the leading / - should be /logout instead of logout. Same issue as register.

mateacademy-ai-mentor · 2026-04-27T15:37:11Z

+  register: (data: { email: string; password: string; name?: string }) =>
+    client.post("register", data),
+
+  login: (data: { email: string; password: string }) =>


Inconsistent path formatting: 'register' on line 4 doesn't have a leading slash, but '/login' on line 7 does. While axios handles both, this inconsistency could cause issues or confusion. Consider standardizing to use leading slashes for all paths.

mateacademy-ai-mentor · 2026-04-27T15:37:11Z

+import { LoginPage } from "./pages/LoginPage";
+import { RegisterPage } from "./pages/RegisterPage";
+import { ActivationPage } from "./pages/ActivationPage";
+import { PasswordResetPage } from "./pages/PasswordResetPage";


Inconsistent API paths - register doesn't have a leading slash while login, logout, and other endpoints do. While axios handles both formats, for consistency consider using the same format for all paths.

mateacademy-ai-mentor · 2026-04-27T15:37:11Z

+import { useState, useEffect, type ReactNode } from "react";
+import { AuthContext } from "./authContext";


The CSS imports @heroui/styles but this package doesn't appear to be referenced in the project files. This import could cause build errors if the package isn't installed. Consider checking if this dependency is needed.

mateacademy-ai-mentor · 2026-04-27T15:37:11Z

@@ -0,0 +1,114 @@
+@import "tailwindcss";
+@import "@heroui/styles"; 


The @heroui/styles import on line 2 doesn't appear to be used anywhere in the CSS file. Consider removing it to avoid unnecessary dependencies or unused imports.

mateacademy-ai-mentor · 2026-04-27T15:37:11Z

+    } catch (err: any) {
+      setError(err.response?.data?.error || "Something went wrong");
+    }
+  };


The task requirement states 'redirect to Profile after the activation', but this page redirects to /login after successful activation. Consider changing the redirect to navigate('/profile') instead.

mateacademy-ai-mentor · 2026-04-27T15:37:11Z

+      navigate("/profile");
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any


The eslint-disable comment is valid in this case since we're handling axios error responses, but consider typing the error properly with AxiosError from axios instead.

mateacademy-ai-mentor · 2026-04-27T15:37:11Z

+
+    authApi.activate(token)
+      .then(() => {
+        setStatus("success");


According to the requirements, after activation the user should be redirected to Profile. Currently the page redirects to login on line 22. Change navigate("/login") to navigate("/profile") to match the task requirements.

mateacademy-ai-mentor · 2026-04-27T15:37:11Z

+
+  const handleLogout = async () => {
+    await logout();
+    navigate("/login");


The password validation on this page only checks minimum length (8 characters), but the task requires informing users about AND checking password rules (uppercase letter, number). Consider adding validation for uppercase letters and numbers like the RegisterPage does.

mateacademy-ai-mentor · 2026-04-27T15:37:11Z

+    e.preventDefault();
+    setPasswordError("");
+    setPasswordSuccess("");
+    if (newPassword !== confirmPassword) return setPasswordError("Passwords do not match");


The password validation on the profile page only checks minimum length, but the RegisterPage validates for uppercase and numbers. For consistency, consider adding the same password complexity validation here.

mateacademy-ai-mentor · 2026-04-27T15:37:16Z

+      <div className="min-h-screen bg-zinc-900 flex items-center justify-center">
+        <div className="bg-zinc-800 border border-zinc-700 p-8 rounded-xl shadow-xl w-full max-w-md text-center flex flex-col gap-4">
+          <h1 className="text-2xl font-bold text-white">Check your email</h1>
+          <p className="text-zinc-300">If <strong className="text-white">{email}</strong> exists, you will receive a reset link.</p>


The PasswordResetConfirmPage only validates password length (min 8), but RegisterPage validates for uppercase and numbers as well. For consistency, consider adding the same password complexity validation to ensure users create strong passwords when resetting.

mateacademy-ai-mentor

Review Summary

Your implementation is complete and meets all task requirements. All critical issues from the previous review have been successfully fixed: the API paths in auth.ts now have proper leading /, the activation page redirects to /profile as required, the /users endpoint has authentication middleware protection, error messages correctly reference 'email', and server-side password validation includes uppercase letter and number checks. The codebase correctly implements registration with password validation, email activation flow, login/logout, password reset with confirmation, and all profile management features.

✨ Please rate this review in the Platform's notification center¹. I will be grateful for your feedback! ✨

Rate AI review example ↩

mateacademy-ai-mentor · 2026-04-27T15:50:53Z

+    try {
+      await action(req, res, next);
+    } catch (error) {
+      next(error);
+    }


The getUsers function retrieves all users without any authorization check in the controller. The previous review flagged this as a HIGH security issue at the route level. Verify that authMiddleware is properly applied to this endpoint in user.route.ts.

mateacademy-ai-mentor · 2026-04-27T15:50:53Z

+services:
+  postgres:


The token.service.ts file only contains an import statement with no exported functions or logic. This file appears incomplete. Either add token-related service functions here, or remove the file if token management is handled elsewhere (e.g., directly in auth.controller.ts).

mateacademy-ai-mentor · 2026-04-27T15:50:53Z

+import { Prisma, User } from '../generated/prisma/client.js';
+import { prisma } from '../lib/db.js';


This file imports prisma but exports nothing. If it's not being used, consider removing it to avoid confusion. The auth.controller.ts directly uses prisma.refreshTokens without this service.

mateacademy-ai-mentor · 2026-04-27T15:50:54Z

+{
+  "compilerOptions": {


This file contains only an import statement with no exports or implementation. If this service is not needed, consider removing the file. If it was intended to implement token-related operations, the implementation is missing.

done app

60f33bf

mateacademy-ai-mentor suggested changes Apr 27, 2026

View reviewed changes

mateacademy-ai-mentor reviewed Apr 27, 2026

View reviewed changes

fixed AImenthor rules

66d9030

Vladokvl requested a review from mateacademy-ai-mentor April 27, 2026 15:45

mateacademy-ai-mentor approved these changes Apr 27, 2026

View reviewed changes

		@@ -0,0 +1,8 @@
		import { PrismaClient } from "../generated/prisma/client.js";
		import { PrismaPg } from "@prisma/adapter-pg";

		import cookieParser from "cookie-parser";
		import { errorMiddleware } from "./middlewares/errorMiddleware.js";

		// Create a transporter using SMTP
		const transporter = nodemailer.createTransport({

		import { catchError } from "../lib/catchError.js";
		import { validateMiddleware } from "../middlewares/validateMiddleware.js";

		healthcheck:
		test: ["CMD-SHELL", "pg_isready -U vladok -d mainTestDB"]

		<meta charset="UTF-8" />
		<link rel="icon" type="image/svg+xml" href="/favicon.svg" />

		import { useState, useEffect, type ReactNode } from "react";
		import { AuthContext } from "./authContext";

		@@ -0,0 +1,114 @@
		@import "tailwindcss";
		@import "@heroui/styles";

		navigate("/profile");
		// eslint-disable-next-line @typescript-eslint/no-explicit-any

		import { Prisma, User } from '../generated/prisma/client.js';
		import { prisma } from '../lib/db.js';

Conversation

Vladokvl commented Apr 27, 2026

Uh oh!

mateacademy-ai-mentor left a comment

Choose a reason for hiding this comment

Review Summary

Footnotes

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!