fix(sec): remediate broken access control (BOLA/IDOR) across API + parent model (#59) - #66

Merged

franciszver merged 14 commits into

mainfrom

fix/p-sec-broken-access-control

Jul 25, 2026

Commits on Jul 24, 2026

fix(sec): restrict registration to student + shared object-access helper (#60, #61)

franciszver
and
claude
committed
3f40ae1
fix(sec): require auth + ownership on practice, nudges, jobs routes (#62)

franciszver
and
claude
committed
7760015
fix(sec): enforce object ownership on read IDOR routes (#63)

franciszver
and
claude
committed
63848b9
fix(sec): overrides derive tutor identity from JWT + relationship check (#64)

franciszver
and
claude
committed
d5036fa
chore(sec): PR template requires object-access check on id-taking routes (#65)

franciszver
and
claude
committed
d413ef0
fix(sec): overrides target_id must belong to authorized student (#64)

franciszver
and
claude
committed
d7f762f
refactor(sec): simplify jobs WS auth flow + practice invalid-id 404 (#65)

franciszver
and
claude
committed
55bfed9
fix(sec): secure /practice/assign/async + fail-closed authz helper (#62, #61)

franciszver
and
claude
committed
b082ea2
fix(sec): restrict conversation-history to assigned tutors + WS accept-path test (#63, #62)

franciszver
and
claude
committed
76c2e5f
docs+chore(sec): document JWT-only auth, remove dead X-API-Key/Rails config (#67)

franciszver
and
claude
committed
0c9e8ce
refactor(sec): type handler id params as UUID for 422 validation (#69)

franciszver
and
claude
committed
61b3da7
feat(sec): parent-student relationship model + re-open parent routes to linked parents (#68)

franciszver
and
claude
committed
3407ea1

Commits on Jul 25, 2026

test(ci): add pytest-timeout so a hung test fails fast with a traceback

franciszver
and
claude
committed
f8a7800
fix(sec): jobs WS auth fails closed on any error; hermetic reject test (#62)

franciszver
and
claude
committed
ee1f46f