Fix BOLA/IDOR: enforce process ownership on process and file APIs

Add verify_process_ownership helper and apply it to all /api/process/* endpoints and the /api/file/upload endpoint so authenticated callers can only access processes they own. Returns 404 (not 403) for missing or non-owned processes to avoid confirming existence. status/render_status previously had no auth at all; both now authenticate and check ownership. Adds ownership-enforcement tests.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: ShreyasW-Microsoft

src/backend-api/src/app/libs/services/authorization.py

@@ -0,0 +1,45 @@
+from fastapi import HTTPException
+
+from libs.base.typed_fastapi import TypedFastAPI
+from libs.models.entities import Process
+from libs.repositories.process_repository import ProcessRepository
+
+
+async def verify_process_ownership(
+    app: TypedFastAPI, process_id: str, user_id: str
+) -> Process:
+    """Ensure the authenticated caller owns the requested process.
+
+    Fetches the Process entity and compares its stored ``user_id`` against the
+    authenticated caller. A missing process and a process owned by a different
+    user are treated identically and both raise a 404, so callers cannot probe
+    for the existence of other users' processes.
+
+    Args:
+        app: The FastAPI application carrying the dependency-injection context.
+        process_id: The identifier of the process being accessed.
+        user_id: The authenticated caller's user principal id.
+
+    Returns:
+        The owned Process entity.
+
+    Raises:
+        HTTPException: 404 if the process does not exist or is not owned by the
+            authenticated caller.
+    """
+    if not process_id:
+        raise HTTPException(status_code=400, detail="Process ID is required")
+
+    if not user_id:
+        raise HTTPException(status_code=401, detail="User not authenticated")
+
+    async with app.app_context.create_scope() as scope:
+        process_repository = scope.get_service(ProcessRepository)
+        process = await process_repository.get_async(process_id)
+
+    if not process or process.user_id != user_id:
+        # Return 404 (not 403) so the response does not confirm the existence of
+        # processes belonging to other users.
+        raise HTTPException(status_code=404, detail="Process not found")
+
+    return process

src/backend-api/src/app/routers/router_files.py

@@ -71,6 +71,12 @@ async def upload_file(
 
             process_record = await processRepository.get_async(process_id)
 
+            # Verify the caller owns this process before uploading into it.
+            # Return 404 (not 403) so the response does not confirm the
+            # existence of processes belonging to other users.
+            if not process_record or process_record.user_id != user_id:
+                raise HTTPException(status_code=404, detail="Process not found")
+
             file_id = str(uuid4())
             file_name = re.sub(r"[^\w.-]", "_", file.filename)
             blob_path = f"{process_id}/source/{file_name}"

src/backend-api/src/app/routers/router_process.py

@@ -11,6 +11,7 @@
 from libs.models.entities import Process
 from libs.repositories.process_repository import ProcessRepository
 from libs.services.auth import get_authenticated_user
+from libs.services.authorization import verify_process_ownership
 from libs.services.interfaces import ILoggerService
 from libs.services.process_services import ProcessService
 from routers.models.files import FileInfo
@@ -83,6 +84,11 @@ async def status(process_id: str, request: Request):
         f"Process router status endpoint called for process_id: {process_id}"
     )
 
+    # Authenticate the caller and verify they own this process
+    authenticated_user = get_authenticated_user(request)
+    user_id = authenticated_user.user_principal_id
+    await verify_process_ownership(app, process_id, user_id)
+
     # loading business component for process
     processService = app.app_context.get_service(ProcessService)
 
@@ -99,6 +105,11 @@ async def render_status(process_id: str, request: Request):
         f"Process router render status endpoint called for process_id: {process_id}"
     )
 
+    # Authenticate the caller and verify they own this process
+    authenticated_user = get_authenticated_user(request)
+    user_id = authenticated_user.user_principal_id
+    await verify_process_ownership(app, process_id, user_id)
+
     # loading business component for process
     processService = app.app_context.get_service(ProcessService)
 
@@ -138,6 +149,9 @@ async def upload_files(
         if not user_id:
             raise HTTPException(status_code=401, detail="User not authenticated")
 
+        # Verify the caller owns this process before touching its blob storage
+        await verify_process_ownership(app, process_id, user_id)
+
         # Make uploaded files list
         uploaded_files: list[FileInfo] = []
 
@@ -195,6 +209,8 @@ async def upload_files(
             response.headers["Location"] = f"/process/{process_id}/"
 
         return result_response
+    except HTTPException:
+        raise
     except Exception as e:
         logger_service.log_error(f"Error in upload_files: {str(e)}")
         raise HTTPException(status_code=500, detail=f"Error uploading files: {str(e)}")
@@ -233,6 +249,9 @@ async def delete_file(
         if not user_id:
             raise HTTPException(status_code=401, detail="User not authenticated")
 
+        # Verify the caller owns this process before deleting any file
+        await verify_process_ownership(app, process_id, user_id)
+
         # Get process service
         processService = app.app_context.get_service(ProcessService)
 
@@ -274,6 +293,8 @@ async def delete_file(
             status_code=404,
             detail=f"File '{file_name}' not found for process '{process_id}'",
         )
+    except HTTPException:
+        raise
     except Exception as e:
         logger_service.log_error(f"Error in delete_file: {str(e)}")
         raise HTTPException(status_code=500, detail=f"Error deleting file: {str(e)}")
@@ -309,6 +330,9 @@ async def delete_process(
         if not user_id:
             raise HTTPException(status_code=401, detail="User not authenticated")
 
+        # Verify the caller owns this process before deleting its files
+        await verify_process_ownership(app, process_id, user_id)
+
         # Get process service
         processService = app.app_context.get_service(ProcessService)
 
@@ -333,6 +357,8 @@ async def delete_process(
 
         return result_response
 
+    except HTTPException:
+        raise
     except Exception as e:
         logger_service.log_error(f"Error in delete_process: {str(e)}")
         raise HTTPException(status_code=500, detail=f"Error deleting process: {str(e)}")
@@ -365,6 +391,9 @@ async def start_processing(
         if not user_id:
             raise HTTPException(status_code=401, detail="User not authenticated")
 
+        # Verify the caller owns this process before queueing it for processing
+        await verify_process_ownership(app, process_id, user_id)
+
         # Get process service
         processService = app.app_context.get_service(ProcessService)
 
@@ -394,6 +423,8 @@ async def start_processing(
             "user_id": str(user_id),
             "status": "queued",
         }
+    except HTTPException:
+        raise
     except Exception as e:
         logger_service.log_error(f"Error in start_processing: {str(e)}")
         raise HTTPException(
@@ -425,6 +456,9 @@ async def download_process_files(
         if not user_id:
             raise HTTPException(status_code=401, detail="User not authenticated")
 
+        # Verify the caller owns this process before returning its files
+        await verify_process_ownership(app, process_id, user_id)
+
         # Get process service
         processService = app.app_context.get_service(ProcessService)
 
@@ -492,6 +526,9 @@ async def get_process_summary(
         if not user_id:
             raise HTTPException(status_code=401, detail="User not authenticated")
 
+        # Verify the caller owns this process before returning its summary
+        await verify_process_ownership(app, process_id, user_id)
+
         # Get process service
         processService = app.app_context.get_service(ProcessService)
 
@@ -549,6 +586,9 @@ async def get_file_content(
         if not user_id:
             raise HTTPException(status_code=401, detail="User not authenticated")
 
+        # Verify the caller owns this process before returning file content
+        await verify_process_ownership(app, process_id, user_id)
+
         # Get process service
         processService = app.app_context.get_service(ProcessService)
 
@@ -607,6 +647,9 @@ async def cancel_process(
         if not user_id:
             raise HTTPException(status_code=401, detail="User not authenticated")
 
+        # Verify the caller owns this process before forwarding the kill request
+        await verify_process_ownership(app, process_id, user_id)
+
         # Get processor control URL from configuration
         config = app.app_context.configuration
         processor_url = config.processor_control_url or "http://processor:8080"
@@ -704,6 +747,9 @@ async def get_cancel_status(
         if not user_id:
             raise HTTPException(status_code=401, detail="User not authenticated")
 
+        # Verify the caller owns this process before reading its cancel status
+        await verify_process_ownership(app, process_id, user_id)
+
         # Get processor control URL from configuration
         config = app.app_context.configuration
         processor_url = config.processor_control_url or "http://processor:8080"

src/backend-api/src/tests/routers/test_router_files.py

@@ -24,7 +24,12 @@ def _make_app(*, process_record=None, file_count=1, blob_helper=None):
     process_repo = MagicMock()
     process_repo.get_async = AsyncMock(
         return_value=process_record
-        or SimpleNamespace(id="p-1", source_file_count=0, status="initialized")
+        or SimpleNamespace(
+            id="p-1",
+            user_id="user-1",
+            source_file_count=0,
+            status="initialized",
+        )
     )
     process_repo.update_async = AsyncMock(return_value=None)
 
@@ -159,3 +164,38 @@ def test_returns_500_when_blob_upload_fails(self):
             headers=AUTH_HEADERS,
         )
         assert res.status_code == 500
+
+    def test_returns_404_when_caller_does_not_own_process(self):
+        # Process exists but is owned by a different user than the caller.
+        app, mocks = _make_app(
+            process_record=SimpleNamespace(
+                id="p-1",
+                user_id="someone-else",
+                source_file_count=0,
+                status="initialized",
+            )
+        )
+        client = TestClient(app)
+        res = client.post(
+            "/api/file/upload",
+            files={"file": ("a.txt", b"x", "text/plain")},
+            data={"process_id": VALID_PROCESS_ID},
+            headers=AUTH_HEADERS,
+        )
+        assert res.status_code == 404
+        mocks["blob_helper"].upload_blob.assert_not_awaited()
+        mocks["process_repo"].update_async.assert_not_awaited()
+
+    def test_returns_404_when_process_missing(self):
+        app, mocks = _make_app(process_record=False)
+        # Force get_async to return None (no such process).
+        mocks["process_repo"].get_async = AsyncMock(return_value=None)
+        client = TestClient(app)
+        res = client.post(
+            "/api/file/upload",
+            files={"file": ("a.txt", b"x", "text/plain")},
+            data={"process_id": VALID_PROCESS_ID},
+            headers=AUTH_HEADERS,
+        )
+        assert res.status_code == 404
+        mocks["blob_helper"].upload_blob.assert_not_awaited()