Merge fix/security-audit: RBAC/API-key-hash/cookie hardening

2026-06-01 09:23:35 +01:00
parent 16199c9280 3f5f813c65
commit 1a5a3ed1b1
8 changed files with 74 additions and 25 deletions
--- a/app/schemas/schemas.py
+++ b/app/schemas/schemas.py
@@ -105,7 +105,9 @@ class CommentBase(BaseModel):

 class CommentCreate(CommentBase):
    task_id: int
-    author_id: int
+    # author_id is NOT accepted from the client — the comment is always
+    # attributed to the authenticated caller (server-side) to prevent
+    # author spoofing.


 class CommentUpdate(BaseModel):