So I did a bit of testing (you may want to clean up your db ).
First, you can vote as many times as you want. Not good.
Second, you have
isLogged middleware, but you aren’t using it to protect the routes. I made a couple (of hundreds) surveys by sending automated requests. Also not good.
Third, you are missing few user stories.
Back to drawing board