- Chat and ticket-creation endpoints now scope lookups/attribution to
the authenticated JWT identity instead of trusting a client-supplied
user_id in the request body (IDOR)
- Add per-user in-memory rate limiter on AI-generation endpoints to
guard against unbounded LLM-cost abuse
- Bind confirm_action to the authenticated user for audit logging
- Bump vulnerable transitive dependencies via cargo update
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
jsonwebtoken v10's default features are just use_pem - neither of its
crypto backend features (rust_crypto/aws_lc_rs) is enabled by default,
so decode::<Claims>() panicked on every real bearer token (not caught
by earlier testing, which only exercised the no-token 401 path).
backend-rust's own crates already enable rust_crypto for the same
crate; matches that here.
- Add src/auth.rs with require_auth middleware extracting user_id from Bearer token
- Wire auth middleware onto all /api/* routes
- Replace CorsLayer::permissive() with env-driven FRONTEND_URL/ADMIN_URL origins
- Pass real auth_user.user_id to confirm_action instead of conversation_id
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
