[PR #426] Harden user-data endpoints to use authenticated user IDs and remove single-user defaults #728

New issue

Open

opened 2026-03-13 21:06:09 +03:00 by kerem · 0 comments

kerem commented

2026-03-13 21:06:09 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/AJaySi/ALwrity/pull/426
Author: @AJaySi
Created: 3/12/2026
Status: 🔄 Open

Base: main ← Head: codex/update-user-data-endpoints-with-current-user-b20ga8

📝 Commits (1)

8ba8c5e Harden user-data endpoints for authenticated user IDs

📊 Changes

2 files changed (+42 additions, -15 deletions)

View changed files

📝 backend/api/user_data.py (+37 -10)
📝 backend/services/user_data_service.py (+5 -5)

📄 Description

Motivation

Ensure user-data endpoints operate on the authenticated user's ID rather than relying on implicit single-user fallbacks.
Surface a stable website_url when website analysis (onboarding step 2) exists so clients get a consistent field.
Avoid returning ambiguous empty success payloads and turn absent onboarding into a defensive 404 instead of allowing unexpected 500s.

Description

Added current_user: dict = Depends(get_current_user) to /, /website-url, and /onboarding endpoints and extract user_id = str(current_user.get("id")) for all service calls.
Replaced implicit/default user behavior by passing user_id explicitly into UserDataService.get_user_onboarding_data(user_id) and get_user_website_url(user_id).
Changed UserDataService.get_user_website_url signature to require user_id: str and removed the default user_id=1 assumption, and updated the integration call to use the explicit ID.
Added defensive handling that raises HTTPException(status_code=404) when onboarding data is absent, re-raises HTTPException cleanly, ensures db_session is closed, and injects a top-level website_url into responses when a website_analysis exists.

Testing

Ran Python compilation check with python -m py_compile backend/api/user_data.py backend/services/user_data_service.py which completed successfully.

Codex Task

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/AJaySi/ALwrity/pull/426 **Author:** [@AJaySi](https://github.com/AJaySi) **Created:** 3/12/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `codex/update-user-data-endpoints-with-current-user-b20ga8` --- ### 📝 Commits (1) - [`8ba8c5e`](https://github.com/AJaySi/ALwrity/commit/8ba8c5ecb26802f4c557ca0dd5bd4017043d4ea4) Harden user-data endpoints for authenticated user IDs ### 📊 Changes **2 files changed** (+42 additions, -15 deletions) <details> <summary>View changed files</summary> 📝 `backend/api/user_data.py` (+37 -10) 📝 `backend/services/user_data_service.py` (+5 -5) </details> ### 📄 Description ### Motivation - Ensure user-data endpoints operate on the authenticated user's ID rather than relying on implicit single-user fallbacks. - Surface a stable `website_url` when website analysis (onboarding step 2) exists so clients get a consistent field. - Avoid returning ambiguous empty success payloads and turn absent onboarding into a defensive `404` instead of allowing unexpected 500s. ### Description - Added `current_user: dict = Depends(get_current_user)` to `/`, `/website-url`, and `/onboarding` endpoints and extract `user_id = str(current_user.get("id"))` for all service calls. - Replaced implicit/default user behavior by passing `user_id` explicitly into `UserDataService.get_user_onboarding_data(user_id)` and `get_user_website_url(user_id)`. - Changed `UserDataService.get_user_website_url` signature to require `user_id: str` and removed the default `user_id=1` assumption, and updated the integration call to use the explicit ID. - Added defensive handling that raises `HTTPException(status_code=404)` when onboarding data is absent, re-raises `HTTPException` cleanly, ensures `db_session` is closed, and injects a top-level `website_url` into responses when a `website_analysis` exists. ### Testing - Ran Python compilation check with `python -m py_compile backend/api/user_data.py backend/services/user_data_service.py` which completed successfully. ------ [Codex Task](https://chatgpt.com/codex/tasks/task_e_69b26c1047308328a7204b57bf3db774) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

kerem added the

pull-request

label

2026-03-13 21:06:09 +03:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/ALwrity#728

No description provided.

Rows
Columns