[CRITICAL] No authentication or authorization on any API endpoint

[aatmmr]

Summary

None of the API endpoints in the application require authentication or authorization, leaving all operations — including data mutation and deletion — fully open to anonymous access.

Description

Both src/Endpoints/v1/Gods.cs and src/Endpoints/v1/Mythologies.cs register endpoints without any .RequireAuthorization() calls. The src/Program.cs file does not configure any authentication scheme (e.g., JWT Bearer, API Key) or authorization policies.

This means:

• POST /api/v1/gods — anyone can create or modify god records.
• DELETE /api/v1/gods — anyone can delete all records.
• All GET endpoints expose data without access control.

The project security policy requires: "Validate and authenticate all incoming requests" and "Limit permissions and access to only what is necessary."

Implementation

1. Choose an authentication scheme (JWT Bearer is recommended for APIs).
2. Add builder.Services.AddAuthentication() and builder.Services.AddAuthorization() in src/Program.cs.
3. Add app.UseAuthentication() and app.UseAuthorization() to the middleware pipeline.
4. Define authorization policies (e.g., AdminOnly, ReadOnly) as appropriate.
5. Apply .RequireAuthorization() to all mutating endpoints (POST, DELETE) in src/Endpoints/v1/Gods.cs.
6. Consider applying read-level authorization to GET endpoints or leaving them public based on requirements.
7. Update integration tests to account for authentication requirements.

References

• src/Endpoints/v1/Gods.cs — all endpoint registrations
• src/Endpoints/v1/Mythologies.cs — all endpoint registrations
• src/Program.cs — missing authentication/authorization middleware
• ASP.NET Core authentication docs: https://learn.microsoft.com/en-us/aspnet/core/security/authentication/