fix: IDOR vulnerability on purchases endpoints (#294)

[PrishaNagpal]

What Changed

Added authentication and ownership checks to the purchases endpoints in backend/main.py:

• GET /api/purchases/{user_id} — validates Bearer token (401) and checks JWT identity matches requested user_id (403)
• POST /api/purchases — validates Bearer token (401) and checks JWT identity matches body.user_id (403)
• Added 22 tests in tests/test_idor_purchases.py covering auth, IDOR, input validation, boundary values, and happy path

Note: Two pre-existing bugs in backend/main.py were worked around in the test file without modifying the backend:

• return result indentation bug inside _clear_response_cache() — mocked out in tests
• status name shadowed by def status() endpoint — patched via backend.main.status in tests

Why

The purchases endpoints trusted the user_id supplied in the request without verifying it against the authenticated user's token. An attacker logged in as user-99 could:

• Send GET /api/purchases/user-42 with their own valid token and read another user's full purchase history
• Send POST /api/purchases with user_id: user-42 in the body and write purchase records into any user's account

CVSS score: High

How to Test

pip install -r requirements.txt
pytest tests/test_idor_purchases.py -v

Expected result: 22 passed, 4 warnings

Screenshots

N/A — No UI changes.

Checklist

• I have read the CONTRIBUTING.md
• My code follows PEP8 style (flake8 .)
• I have tested my changes locally
• I have added/updated tests where applicable
• I can explain every line of code I've written
• I have NOT used AI-generated code without understanding and attributing it

Related Issue

Closes #294

AI Assistance Disclosure

• I did not use AI assistance for this PR
• I used AI assistance for:
  • Debugging test file import errors (status shadowing, _clear_response_cache workaround)
  • Structuring the test suite
  • Security fix logic and backend changes were written and understood independently

[github-actions]

🎉 Welcome to Hybrid Recommender, @PrishaNagpal! This is your first contribution here!

Labels added: gssoc:approved | mentor:leonagoel | status:review-needed

PR Description Checklist:

NO - What changed section
NO - Why section
NO - How to test section
YES - Related issue linked

⚠️ Some required sections are missing. Please update your PR description.

What happens next:

1. @leonagoel will review your changes
2. CI checks must pass
3. Once approved, this PR will be auto-merged

⏱️ Please respond to review comments within 48 hours.

[github-actions]

🎉 Welcome to Hybrid Recommender, @PrishaNagpal!

Thank you for your first pull request! Here's what happens next:

Step	What	Who
1	CI runs lint + smoke test	🤖 Automated
2	Code review	👤 @leonagoel
3	mentor:leonagoel label added	👤 Mentor
4	gssoc:approved label added	👤 Mentor
5	Auto-merge triggered	🤖 Automated
6	Points on leaderboard at 4 AM IST	🏆 GSSoC

⏱️ Please respond to any review comments within 48 hours.

📖 Resources:

• CONTRIBUTING.md
• GSSoC Leaderboard

Happy contributing! 🚀

[PrishaNagpal]

CI failures in celery_app.py and hybrid_model.py are pre-existing indentation bugs unrelated to this PR. My changes only affect backend/main.py purchases endpoints and tests/test_idor_purchases.py.

[github-actions]

⚠️ Main branch was just updated!

PR #1633 ("fix: Duplicate results-processing loop removed from search_items(#1631)") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1640 ("fix: resolve hybrid_model merge conflicts and add explanation string") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1641 ("Fix/svd memory leak") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1642 ("Feature/evaluation dashboard") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1643 ("Feature/streamlit tfidf config") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1644 ("Fix/strict csrf origin validation") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1645 ("Feature/svd online updating") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1647 ("fix: add title query param endpoint to resolve HTTP 422 (#1075)") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1648 ("fix(federated): prevent regularization decay in aggregate_updates") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1650 ("fix: remove duplicate code block in hybrid_model.py causing Indentati…") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1653 ("fix: remove duplicate /api/recommend route") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1654 ("build: add faiss dependency for two-tower retrieval") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1655 ("fix: enforce stronger signup password validation") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1660 ("security: reject unissued csrf tokens") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1661 ("feat: add KNN-based user collaborative filtering (Issue #51)") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1665 ("fix: add missing faiss-cpu dependency to requirements.txt ") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1515 ("feat: harden realtime recommendation WebSocket flow") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1668 ("fix(ci): resolve syntax and indentation errors breaking upstream main") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀