fix: enforce dashboard_public check for unauthenticated API access (GHSA-9mjc-6fp2-hm9v)

[Copilot]

Summary

Fixes the missing dashboard_public check security vulnerability (GHSA-9mjc-6fp2-hm9v).

Root cause

The user_authenticated_or_public_dashboard dependency in auth.py only verified that the tournament existed in the database, but never checked whether dashboard_public = True. This allowed unauthenticated users to access sensitive tournament data on the following endpoints even when the tournament was not publicly shared:

• GET /tournaments/{tournament_id} (partially protected by an explicit post-dependency check)
• GET /tournaments/{tournament_id}/courts
• GET /tournaments/{tournament_id}/teams
• GET /tournaments/{tournament_id}/rankings
• GET /tournaments/{tournament_id}/stages

Changes

• backend/bracket/routes/auth.py: Added not tournaments_fetched[0].dashboard_public to the check in user_authenticated_or_public_dashboard. Unauthenticated requests to a tournament with dashboard_public=False now receive a 401 response.
• backend/bracket/routes/tournaments.py: Removed the now-redundant explicit dashboard_public check in get_tournament (the dependency handles it now).
• backend/tests/integration_tests/api/tournaments_test.py: Added test_non_public_tournament_endpoints_blocked_for_unauthenticated_users to assert that all affected endpoints return 401 for unauthenticated requests when dashboard_public=False.

Note: user_authenticated_or_public_dashboard_by_endpoint_name (used for the GET /tournaments?endpoint_name= route) was not affected — it delegates to sql_get_tournament_by_endpoint_name which already includes AND dashboard_public IS TRUE in its SQL query.

[cloudflare-workers-and-pages]

Deploying bracket-docs with    Cloudflare Pages

Latest commit:	d2c7eeb
Status:	✅  Deploy successful!
Preview URL:	https://073fc285.bracket-docs.pages.dev
Branch Preview URL:	https://copilot-fix-missing-dashboar.bracket-docs.pages.dev

View logs

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.80%. Comparing base (10db82f) to head (d2c7eeb).
⚠️ Report is 4 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1660      +/-   ##
==========================================
+ Coverage   94.75%   94.80%   +0.05%     
==========================================
  Files         120      120              
  Lines        4381     4387       +6     
==========================================
+ Hits         4151     4159       +8     
+ Misses        230      228       -2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.