fix: remove scan() fallback in demo listTodos to prevent multi-tenant…

.changeset/fix-list-todos-tenant-leak.md

@@ -0,0 +1,5 @@
+---
+"@aws-blocks/create-blocks-app": patch
+---
+
+Fix multi-tenant data leak in demo template: `listTodos()` no longer falls back to `scan()` when no `sortBy` is provided. All paths now use `query()` with a `userId` filter, ensuring users only see their own todos.

packages/create-blocks-app/templates/demo/aws-blocks/index.ts

@@ -59,7 +59,7 @@
 });
 
 // Simple hello world API for testing CDK deployment
 export const hello = new ApiNamespace(scope, 'hello', (context) => ({
   async greet(name: string) {
     return { message: `Hello, ${name}!`, timestamp: Date.now() };
   }
@@ -117,17 +117,18 @@
 
   async listTodos(sortBy?: 'priority' | 'title' | 'createdAt'): Promise<Todo[]> {
     const user = await auth.requireAuth(context);
-    
-    const indexMap = { 
-      priority: 'byPriority', 
-      title: 'byTitle', 
-      createdAt: 'byCreatedAt' 
+
+    const indexMap = {
+      priority: 'byPriority',
+      title: 'byTitle',
+      createdAt: 'byCreatedAt'
     } as const;
-
-    const iterator = sortBy 
-      ? todos.query(indexMap[sortBy], { userId: { equals: user.username } })
-      : todos.scan();
-
+
+    const iterator = todos.query({
+      index: sortBy ? indexMap[sortBy] : 'byCreatedAt',
+      where: { userId: { equals: user.username } }
+    });
+
     return await Array.fromAsync(iterator);
   },