[PR #435] Harden AI generation endpoints to use token-derived user identity #741

New issue

Open

opened 2026-03-13 21:06:36 +03:00 by kerem · 0 comments

kerem commented

2026-03-13 21:06:36 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/AJaySi/ALwrity/pull/435
Author: @AJaySi
Created: 3/12/2026
Status: 🔄 Open

Base: main ← Head: codex/refactor-user-id-handling-in-api-routes-v4hrgc

📝 Commits (1)

3bffa8c Harden AI generation endpoints to use authenticated user claims

📊 Changes

2 files changed (+94 additions, -7 deletions)

View changed files

📝 backend/api/content_planning/api/content_strategy/endpoints/ai_generation_endpoints.py (+37 -7)
➕ backend/security_test_ai_generation_endpoints_auth.py (+57 -0)

📄 Description

Motivation

Prevent clients from supplying authoritative user_id values to public AI generation and retrieval routes.
Ensure all user identity is derived from verified token claims (id / clerk_user_id) and surface an authentication error when missing.
Restrict task/strategy reads and optimizations so only the creating (authenticated) user can access them.

Description

Added current_user: Dict[str, Any] = Depends(get_current_user) to public AI endpoints and removed client-provided user_id parameters from routes such as generate_comprehensive_strategy, generate_strategy_component, get_strategy_generation_status, generate_comprehensive_strategy_polling, get_strategy_generation_status_by_task, and get_latest_generated_strategy.
Introduced _get_authenticated_user_id(current_user) helper to consistently extract the authenticated user id (string) from token claims and raise HTTPException(status_code=401) when missing.
Eliminated fallback/default user_id behavior (e.g. request.get("user_id", 1) and query default user IDs) and ensured downstream calls use the authenticated user_id string; removed an unused Query import.
Added owner authorization checks for task-status and strategy-optimization flows (returning 403 when the authenticated user does not own the requested task/strategy), and added current_user checks to optimize_existing_strategy.
Added focused static/source-level tests backend/security_test_ai_generation_endpoints_auth.py that verify route signatures, enforcement of token-derived user_id, task-owner authorization, and the 401 on missing authenticated id.

Testing

Ran pytest -q backend/security_test_ai_generation_endpoints_auth.py, which executed the new auth-hardening assertions and all tests passed (4 passed).
Ran python -m compileall backend/api/content_planning/api/content_strategy/endpoints/ai_generation_endpoints.py backend/security_test_ai_generation_endpoints_auth.py to validate modules compile successfully (succeeded).

Codex Task

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/AJaySi/ALwrity/pull/435 **Author:** [@AJaySi](https://github.com/AJaySi) **Created:** 3/12/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `codex/refactor-user-id-handling-in-api-routes-v4hrgc` --- ### 📝 Commits (1) - [`3bffa8c`](https://github.com/AJaySi/ALwrity/commit/3bffa8c918b2f8ddcaf39e58f0762c8d21912bf8) Harden AI generation endpoints to use authenticated user claims ### 📊 Changes **2 files changed** (+94 additions, -7 deletions) <details> <summary>View changed files</summary> 📝 `backend/api/content_planning/api/content_strategy/endpoints/ai_generation_endpoints.py` (+37 -7) ➕ `backend/security_test_ai_generation_endpoints_auth.py` (+57 -0) </details> ### 📄 Description ### Motivation - Prevent clients from supplying authoritative `user_id` values to public AI generation and retrieval routes. - Ensure all user identity is derived from verified token claims (`id` / `clerk_user_id`) and surface an authentication error when missing. - Restrict task/strategy reads and optimizations so only the creating (authenticated) user can access them. ### Description - Added `current_user: Dict[str, Any] = Depends(get_current_user)` to public AI endpoints and removed client-provided `user_id` parameters from routes such as `generate_comprehensive_strategy`, `generate_strategy_component`, `get_strategy_generation_status`, `generate_comprehensive_strategy_polling`, `get_strategy_generation_status_by_task`, and `get_latest_generated_strategy`. - Introduced `_get_authenticated_user_id(current_user)` helper to consistently extract the authenticated user id (string) from token claims and raise `HTTPException(status_code=401)` when missing. - Eliminated fallback/default `user_id` behavior (e.g. `request.get("user_id", 1)` and query default user IDs) and ensured downstream calls use the authenticated `user_id` string; removed an unused `Query` import. - Added owner authorization checks for task-status and strategy-optimization flows (returning `403` when the authenticated user does not own the requested task/strategy), and added `current_user` checks to `optimize_existing_strategy`. - Added focused static/source-level tests `backend/security_test_ai_generation_endpoints_auth.py` that verify route signatures, enforcement of token-derived `user_id`, task-owner authorization, and the `401` on missing authenticated id. ### Testing - Ran `pytest -q backend/security_test_ai_generation_endpoints_auth.py`, which executed the new auth-hardening assertions and all tests passed (`4 passed`). - Ran `python -m compileall backend/api/content_planning/api/content_strategy/endpoints/ai_generation_endpoints.py backend/security_test_ai_generation_endpoints_auth.py` to validate modules compile successfully (succeeded). ------ [Codex Task](https://chatgpt.com/codex/tasks/task_e_69b28803f20083289de4a7aa7244e931) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

kerem added the

pull-request

label

2026-03-13 21:06:36 +03:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/ALwrity#741

No description provided.

Rows
Columns