usage routes #678

New issue

Closed

opened 2026-03-13 21:03:27 +03:00 by kerem · 0 comments

kerem commented

2026-03-13 21:03:27 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/AJaySi/ALwrity/pull/372
Author: @AJaySi
Created: 3/4/2026
Status: ✅ Merged
Merged: 3/5/2026
Merged by: @AJaySi

Base: main ← Head: codex/update-user-access-verification-for-routes

📝 Commits (1)

261c224 Harden user-scoped subscription route access checks

📊 Changes

4 files changed (+108 additions, -7 deletions)

View changed files

📝 backend/api/subscription/routes/alerts.py (+15 -4)
📝 backend/api/subscription/routes/dashboard.py (+6 -1)
➕ backend/api/subscription/routes/route_access_audit.py (+82 -0)
📝 backend/api/subscription/routes/usage.py (+5 -2)

📄 Description

Motivation

Ensure all subscription API endpoints that return user-scoped data verify the authenticated user and prevent unauthorized access or mutations.
Prevent alert tampering by enforcing ownership checks on mutating endpoints.

Description

Added Depends(get_current_user) and a call to verify_user_access(user_id, current_user) to GET /dashboard/{user_id} in backend/api/subscription/routes/dashboard.py to enforce user-scoped access before queries.
Added Depends(get_current_user) and verify_user_access(...) to GET /alerts/{user_id} in backend/api/subscription/routes/alerts.py so alert listings require authentication and authorization.
Hardened POST /alerts/{alert_id}/mark-read in backend/api/subscription/routes/alerts.py to check alert.user_id against current_user.id and return 403 on ownership mismatch while preserving existing HTTPException behavior.
Added Depends(get_current_user) and verify_user_access(...) to GET /usage/{user_id}/trends in backend/api/subscription/routes/usage.py (the main /usage/{user_id} route already verified access).
Added a route-level audit script backend/api/subscription/routes/route_access_audit.py that scans route handlers for "{user_id}" in paths and flags handlers missing get_current_user or a verify_user_access call.

Testing

Ran the audit script with python backend/api/subscription/routes/route_access_audit.py and it returned PASS: all user-scoped routes include get_current_user and verify_user_access.
Verified syntax by compiling the modified modules with python -m py_compile backend/api/subscription/routes/dashboard.py backend/api/subscription/routes/alerts.py backend/api/subscription/routes/usage.py backend/api/subscription/routes/route_access_audit.py, which completed without errors.

Codex Task

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/AJaySi/ALwrity/pull/372 **Author:** [@AJaySi](https://github.com/AJaySi) **Created:** 3/4/2026 **Status:** ✅ Merged **Merged:** 3/5/2026 **Merged by:** [@AJaySi](https://github.com/AJaySi) **Base:** `main` ← **Head:** `codex/update-user-access-verification-for-routes` --- ### 📝 Commits (1) - [`261c224`](https://github.com/AJaySi/ALwrity/commit/261c224dca846e93c5adf4b94ff08c63109bcb24) Harden user-scoped subscription route access checks ### 📊 Changes **4 files changed** (+108 additions, -7 deletions) <details> <summary>View changed files</summary> 📝 `backend/api/subscription/routes/alerts.py` (+15 -4) 📝 `backend/api/subscription/routes/dashboard.py` (+6 -1) ➕ `backend/api/subscription/routes/route_access_audit.py` (+82 -0) 📝 `backend/api/subscription/routes/usage.py` (+5 -2) </details> ### 📄 Description ### Motivation - Ensure all subscription API endpoints that return user-scoped data verify the authenticated user and prevent unauthorized access or mutations. - Prevent alert tampering by enforcing ownership checks on mutating endpoints. ### Description - Added `Depends(get_current_user)` and a call to `verify_user_access(user_id, current_user)` to `GET /dashboard/{user_id}` in `backend/api/subscription/routes/dashboard.py` to enforce user-scoped access before queries. - Added `Depends(get_current_user)` and `verify_user_access(...)` to `GET /alerts/{user_id}` in `backend/api/subscription/routes/alerts.py` so alert listings require authentication and authorization. - Hardened `POST /alerts/{alert_id}/mark-read` in `backend/api/subscription/routes/alerts.py` to check `alert.user_id` against `current_user.id` and return `403` on ownership mismatch while preserving existing `HTTPException` behavior. - Added `Depends(get_current_user)` and `verify_user_access(...)` to `GET /usage/{user_id}/trends` in `backend/api/subscription/routes/usage.py` (the main `/usage/{user_id}` route already verified access). - Added a route-level audit script `backend/api/subscription/routes/route_access_audit.py` that scans route handlers for `"{user_id}"` in paths and flags handlers missing `get_current_user` or a `verify_user_access` call. ### Testing - Ran the audit script with `python backend/api/subscription/routes/route_access_audit.py` and it returned `PASS: all user-scoped routes include get_current_user and verify_user_access`. - Verified syntax by compiling the modified modules with `python -m py_compile backend/api/subscription/routes/dashboard.py backend/api/subscription/routes/alerts.py backend/api/subscription/routes/usage.py backend/api/subscription/routes/route_access_audit.py`, which completed without errors. ------ [Codex Task](https://chatgpt.com/codex/tasks/task_e_69a8468242348328adcf4ae1a50bb4e0) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

kerem

2026-03-13 21:03:27 +03:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/ALwrity#678

No description provided.

Rows
Columns