fix(security): prevent privilege escalation during public user registration

- Ignore user-supplied role in req.body on POST /api/v1/auth/register to enforce default user role
- Add unit test verifying that self-assigned roles during public registration are ignored

Co-authored-by: SOURAV-ROY <8663561+SOURAV-ROY@users.noreply.github.com>

Author: google-labs-jules[bot]

controllers/authController.js

@@ -8,14 +8,14 @@ const config = require("../config/config.json");
 // @route           POST /api/v1/auth/register
 // @access          Public
 exports.register = asyncHandler(async (req, res, next) => {
-  const { name, email, password, role } = req.body;
+  const { name, email, password } = req.body;
 
   // Create user ************************************************
+  // Public registration strictly defaults role to "user" to prevent privilege escalation
   const user = await User.create({
     name,
     email,
     password,
-    role,
   });
 
   // Create token ***********************************************

tests/auth.test.js

@@ -26,12 +26,34 @@ describe("Auth Routes", () => {
     await connectDB();
   });
 
+  const publisherEmail = `testpublisher_${Date.now()}@example.com`;
+
   afterAll(async () => {
     // Cleanup
     await User.deleteOne({ email: testUser.email });
+    await User.deleteOne({ email: publisherEmail });
     await mongoose.connection.close();
   });
 
+  it("should ignore requested role on public registration and default to 'user'", async () => {
+    await getCsrfToken();
+    const res = await request(app)
+      .post("/api/v1/auth/register")
+      .set("x-csrf-token", csrfToken)
+      .set("Cookie", cookies)
+      .send({
+        name: "Test Publisher",
+        email: publisherEmail,
+        password: "password123",
+        role: "publisher",
+      });
+    expect(res.statusCode).toEqual(200);
+
+    const createdUser = await User.findOne({ email: publisherEmail });
+    expect(createdUser).not.toBeNull();
+    expect(createdUser.role).toEqual("user");
+  });
+
   it("should register a new user", async () => {
     await getCsrfToken();
     const res = await request(app)