Review creation does not verify profile ownership

[PEliet]

Problem

The POST /reviews endpoint passes the authenticated user's ID to create_review(), but core/services/review_service.py ignores that argument when creating a review.

The service creates a Review from the supplied profile_id without checking that the profile belongs to the current user. This is inconsistent with get_review() and list_reviews(), which already scope review reads through Profile.user_id.

Impact

An authenticated user who knows another user's profile UUID may be able to create a review for that profile by sending:

POST /reviews
{"profile_id": "<another-users-profile-id>"}

[PEliet]

@ascherj hope u can consider this

[AdetayoKalejaiye]

I'd like to work on this

[AdetayoKalejaiye]

I'd like to work on this

[arollaramreddy]

I'd like to work on this

[GGirishya]

Looks like something i would like to work on

[ONESO-goat]

I'd like to work on this

[saimantmg01]

I'd like to work on this

[JacobKwiat1]

I'd like to work on this

[mikemaeda]

I’m working on this issue

[ashokpaudelapril]

I would like to work on this

[kwaso2x]

id like to work on this

[ascherj]

Thanks for the report, @PEliet — confirmed. create_review() in core/services/review_service.py accepts the authenticated user_id but never checks that the target profile belongs to that user, unlike get_review() / list_reviews() which already scope reads through Profile.user_id.

Adding a tier-2 label and formal repro steps so this issue matches the curated format:

Steps to Reproduce

1. Register two users:
   • POST /auth/register as User A → save token A
   • POST /auth/register as User B → save token B
2. As User B, create a profile: POST /profiles (with token B) → note the returned profile_id
3. As User A, request a review against B's profile:

   POST /reviews
   Authorization: Bearer <token A>
   {"profile_id": "<User B's profile_id>"}
   

Expected: the request is rejected (403 or 404) because the profile does not belong to User A.

Actual: the request succeeds — a review is created (status pending) and background processing runs against User B's profile.

A fix should verify profile ownership in create_review() before creating the review, consistent with the ownership scoping already used by the read paths in the same service. Include a test covering the cross-user case.

This issue is fully valid to work on — anyone who has claimed it can continue.