[BUG-PC-001][FR-15][PUT /api/products/:id] Missing, invalid, and non-admin credentials can update products

[AkiraTomori]

Summary

PUT /api/products/:id permits product mutation without valid administrator authorization.

• Severity: High
• Environment: Local Docker eshop-sut-backend-1
• HW06 Pool: Pool C / FR-15
• Failed cases: 16 cases under PC-F-AUTH-001

Preconditions

Disposable product 101 exists with a recorded SQLite baseline. No valid administrator JWT is supplied for the representative case.

Steps to reproduce

1. Record product 101's restricted SQLite baseline.
2. Send PUT /api/products/101 with a valid update body but no Authorization header.
3. Record the response.
4. Inspect only product 101 through the restricted SQLite snapshot.

Expected result

Reject with a 4xx authentication/authorization response and preserve every product. Exact status/body is unspecified.

Actual result

FR15-DOM-008 returned HTTP 200 with {"message":"Product updated"}, and product 101 stored the submitted values. Fifteen token, role, scheme, and duplicate-header variants produced the same unauthorized mutation.

Impact

Anonymous or non-admin callers can change catalog names, prices, images, descriptions, and categories.

Evidence

• 23127379_Homework/HW6/Pool-C_FR15_Update_Product/postman/newman/Pool-C_FR15_report.json
• 23127379_Homework/HW6/Pool-C_FR15_Update_Product/postman/newman/Pool-C_FR15_report.html
• 23127379_Homework/HW6/Pool-C_FR15_Update_Product/evidence/Pool-C_FR15_per-case-state.json
• Screenshot generated from the FR15-DOM-008 failure with MSSV 23127379.

Requirement sources: README FR-12, SEC-02, SEC-03
Suggested labels: bug, security, authorization, authentication, data-integrity, FR-15, api

[AkiraTomori]

HW06 screenshot evidence — MSSV 23127379

Repository source: BUG-PC-001_23127379.png

The screenshot summarizes the redacted Newman/fixture evidence recorded in the HW06 Pool artifacts; it does not expose OTPs, passwords, tokens, or personal email addresses.