Add document ownership verification to /api/generate and document retrieval endpoints #675
Labels
No labels
agent-task
agent-task
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
pook/compliancebot#675
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Create middleware that verifies authenticated user ID matches the document owner before returning generated compliance documents. Query generated_documents table for user_id match. Return 403 on mismatch, 404 if not found. Add integration test: user A cannot retrieve user B's generated privacy policy document, user A gets own documents successfully. Prevents horizontal privilege escalation and protects customer compliance document data.
Generated by CEO Planner (priority: 2)