fix: Restrict CORS, add rate limiting, password validation, and IDOR check

- Narrow CORS regex to only match studyquest Vercel deployments
- Add rate limiting to login (10/min) and signup (5/min) endpoints
- Enforce password strength via Field constraints and existing validator
- Add user ownership check on quiz result endpoint to prevent IDOR

Author: mohi-devhub

backend/main.py

@@ -41,7 +41,7 @@
 app.add_middleware(
     CORSMiddleware,
     allow_origins=ALLOWED_ORIGINS,
-    allow_origin_regex=r"https://.*\.vercel\.app",  # Allow all Vercel preview deployments
+    allow_origin_regex=r"https://study-?quest.*\.vercel\.app",  # Allow only StudyQuest preview deployments
     allow_credentials=True,
     allow_methods=["GET", "POST", "PUT", "DELETE", "OPTIONS"],
     allow_headers=["*"],

backend/routes/auth.py

@@ -1,7 +1,13 @@
-from fastapi import APIRouter, HTTPException, status, Depends
-from pydantic import BaseModel, EmailStr
+from fastapi import APIRouter, HTTPException, status, Depends, Request
+from pydantic import BaseModel, EmailStr, Field
 from config.supabase_client import get_supabase
 from utils.auth import verify_user
+from utils.validation import validate_password_strength
+from slowapi import Limiter
+from slowapi.util import get_remote_address
+
+# Initialize rate limiter
+limiter = Limiter(key_func=get_remote_address)
 
 router = APIRouter(
     prefix="/auth",
@@ -11,8 +17,8 @@
 
 class SignUpRequest(BaseModel):
     email: EmailStr
-    password: str
-    
+    password: str = Field(..., min_length=8, max_length=128)
+
     class Config:
         json_schema_extra = {
             "example": {
@@ -48,16 +54,25 @@ class UserResponse(BaseModel):
 
 
 @router.post("/signup", response_model=AuthResponse, status_code=status.HTTP_201_CREATED)
-async def signup(request: SignUpRequest):
+@limiter.limit("5/minute")
+async def signup(request: SignUpRequest, req: Request):
     """
     Register a new user with email and password.
     
     Creates a new user account in Supabase Auth and automatically creates
     a corresponding record in the users table via database trigger.
     """
     try:
+        # Validate password strength
+        is_valid, message = validate_password_strength(request.password)
+        if not is_valid:
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail=message
+            )
+
         supabase = get_supabase()
-        
+
         # Sign up user with Supabase Auth
         response = supabase.auth.sign_up({
             "email": request.email,
@@ -80,6 +95,8 @@ async def signup(request: SignUpRequest):
             }
         }
 
+    except HTTPException:
+        raise
     except Exception as e:
         # Handle specific Supabase errors
         error_message = str(e)
@@ -95,7 +112,8 @@ async def signup(request: SignUpRequest):
 
 
 @router.post("/login", response_model=AuthResponse)
-async def login(request: LoginRequest):
+@limiter.limit("10/minute")
+async def login(request: LoginRequest, req: Request):
     """
     Authenticate user with email and password.
     

backend/routes/study.py

@@ -928,13 +928,20 @@ async def get_quiz_result_by_id(
         supabase = get_supabase_client()
 
         result = await get_quiz_result(supabase, quiz_id)
-        
+
         if not result:
             raise HTTPException(
                 status_code=404,
                 detail="Quiz result not found"
             )
-        
+
+        # Verify the quiz result belongs to the requesting user
+        if result.get("user_id") != current_user:
+            raise HTTPException(
+                status_code=403,
+                detail="You do not have permission to view this quiz result"
+            )
+
         return result
 
     except HTTPException: