title: How to launch a command on the server from a web page ( nodejs )
body: <p>I think that what i'm trying to do is simple, but I just don't know the proper wording to make my search efficient.</p>
  <p>I have a webapp, in node js with the express.js framework.
  The web pages are templated with EJS and I have a database that contains my data ( MySQL ).</p>
  <p>When I load a page, I get a list of all the items passed in an object and I have a foreach statement to generate a table.</p>
  <p>The JS function :</p>
  <pre><code>listParts: (req, res) =&gt; {
      
      let query = `SELECT parts.*, l.product_vehicleId as InstalledOn, v.name as VehicleName FROM parts
                  LEFT JOIN current_loadout as l ON idpart=l.parts_idparts
                  LEFT JOIN dataRef.product as v ON v.idvehicle=l.product_vehicleId
                  WHERE idpart&gt;0;`
      db.query(query, (err, qResult) =&gt;{
          if ( err == null )
          {
              res.render('listParts.ejs', { 
                  title: 'RPA parts list',
                  partList: qResult,
                  url: req.originalUrl
              })
          }
      });
  }
  </code></pre>
  <p>The EJS part :</p>
  <pre><code>     &lt;tbody align=&quot;center&quot;&gt;
                      &lt;% partList.forEach((part, idx) =&gt; {%&gt;
                          &lt;tr&gt;
                              &lt;td&gt;&lt;%=part.name%&gt;&lt;/td&gt;
                              &lt;td&gt;&lt;%=part.serial%&gt;&lt;/td&gt;
                              &lt;td&gt;&lt;%=Math.floor(part.ttsn/60).toFixed()%&gt;:&lt;%=Math.floor(Math.abs(part.ttsn%60)).toFixed(0).padStart(2,'0')%&gt;&lt;/td&gt;
                              &lt;td&gt;&lt;%=part.maxTTSN%&gt;&lt;/td&gt;
                              &lt;td&gt;&lt;%=part.maxCalendarDate%&gt;&lt;/td&gt;
                              &lt;td&gt;&lt;%=part.VehicleName%&gt;&lt;/td&gt;
                              &lt;td&gt;&lt;%if (part.serviceable) {%&gt;
                                  &lt;a class=&quot;badge badge-success&quot;&gt;Serviceable&lt;/a&gt;
                                  &lt;%}else{%&gt;
                                      &lt;a class=&quot;badge badge-danger&quot;&gt;Unserviceable&lt;/a&gt;
                                  &lt;%}%&gt;
                              &lt;/td&gt;
                              &lt;td&gt;&lt;%if (part.serviceable) {%&gt;
                                      &lt;a href=&quot;11&quot;&gt;  Make serviceable&lt;/a&gt;
                                  &lt;%}else{%&gt;
                                      &lt;a href=&quot;11&quot;&gt;  Make serviceable&lt;/a&gt;
                                  &lt;%}%&gt;
                              &lt;/td&gt;
                          &lt;/tr&gt;
                      &lt;%})%&gt;
                  &lt;/tbody&gt;
  </code></pre>
  <p>I would like to make a call on the server to query the DB to make a status change on my part object when the user click the button.</p>
  <p>Usualy I use the href to my a REST API endpoint to call a delete object.</p>
  <p>My struggle is : How to make it hidden from the user so people would not be able to call the REST endpoint with a script and change the status of all my parts ??</p>
  <p>My background is C and C++ Python ... I am very new to javascript and all the Node module and especially, I am a total noob with frontend stuff.</p>
  <p>Could somebody point me to a good direction É</p>