Bug #4
open[SEC-03] Add proper role-based auth to every mutating route in product.py first (DELETE /, DELETE /redis/clear, POST /, PUT & DELETE /{product_id}, POST /bulk_product_status_change), then do the same authorization audit across every other router — some...
0%
Description
Module: Security / Whole App
Current State:
The ENTIRE /products router — create, update, delete, delete-ALL, Redis flushall, bulk status change — has ZERO authentication on any route. Verified by reading every single route in product.py. Right now, anyone who knows the URL can run DELETE /api/products/ and wipe the entire product catalog, or flush Redis, with no login at all.
Task:
Add proper role-based auth to every mutating route in product.py first (DELETE /, DELETE /redis/clear, POST /, PUT & DELETE /{product_id}, POST /bulk_product_status_change), then do the same authorization audit across every other router — some are already correctly protected (this needs confirming, not assuming).
Why It Matters:
This is a live, active security exposure on production right now, not a future risk. Highest-return work in this entire sprint.
Target Week: Week 1
Excel Owner: Prabhakar + Sharique
Excel Priority: P0 - Critical
Excel Status: In Progress
Sprint Plan ID: SEC-03
No data to display