Challenge 3: Find the Bug in a Context Function — Possible Solution
====================================================================

THE BUGGY CODE
----------------
const userLoader = createUserLoader(pool); // created ONCE, at module load time

const app = express();
// ...
app.use(
  "/graphql",
  express.json(),
  expressMiddleware(server, {
    async context({ req }) {
      return { userLoader }; // reusing the SAME loader instance every request
    },
  })
);

WHY THIS IS A BUG
-------------------
createUserLoader(pool) is called exactly ONCE, when this file is first
loaded as the server starts up — NOT once per incoming request. Every
single request that comes in afterward reuses that exact same
DataLoader instance and, critically, its exact same internal cache.
This is precisely the shared-global-instance mistake Chapter 5's tip box
warned about, just reintroduced here through a slightly different route:
instead of writing new DataLoader(...) directly at the top of the file,
the developer wrote a HELPER function (createUserLoader) that DOES
create a fresh instance correctly when called — but then only ever
called it once, at startup, and handed that single resulting instance to
every request's context via closure.

THE CONCRETE CONSEQUENCE
---------------------------
If Request 1 causes userLoader.load(42) to run and cache user 42's data,
Request 2 (from a completely different user, moments or even hours
later) calling userLoader.load(42) receives that SAME cached result
rather than a fresh lookup — exactly the cross-request cache leak
described in Chapter 5's Challenge 3, now shown as it would actually
appear in real server-setup code rather than as an isolated snippet.
Whether this manifests as a security problem (stale/wrong data being
served to the wrong user) or just a staleness problem (an update never
being reflected because a much older cached value is still being
returned) depends on the specific schema, but the root cause is
identical either way: one loader instance, incorrectly shared across
every request instead of created fresh for each one.

THE FIX
--------
Move the createUserLoader(pool) call INSIDE the context callback itself,
so a brand-new instance (and brand-new, empty cache) is constructed for
every single request, exactly as Chapter 6's own working example does:

  async context({ req }) {
    return { userLoader: createUserLoader(pool) }; // called HERE, per request
  }

The helper function itself doesn't need to change at all — the fix is
entirely about WHERE it gets called from, not how it's written.