fix: merging dev to main

[Priyanka2-Microsoft]

Purpose

• ...
  This pull request introduces a robust authorization layer to the backend API, ensuring that users can only access or modify processes they own. It does this by centralizing process ownership verification and applying it consistently across all process-related endpoints. The update also includes dependency upgrades and improved error handling. Additionally, new tests have been added to validate the ownership checks.

Authorization and Security Enhancements:

• Added a new verify_process_ownership function in authorization.py that checks both the existence of a process and that the requesting user is its owner, returning a 404 if either check fails to prevent information leaks.
• Refactored all process-related endpoints in router_process.py and router_files.py to call verify_process_ownership before performing any action, ensuring only process owners can access or modify their resources. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12]
• Updated error handling in endpoints to ensure HTTPException is re-raised and not masked by generic 500 errors, preserving correct response codes for authorization failures. [1] [2] [3] [4]

Testing Improvements:

• Added and updated tests to verify that a 404 is returned when a process does not exist or is not owned by the caller, and that no unauthorized actions are performed in these cases (test_router_files.py). [1] [2]
• Updated test fixtures to include user_id on process records to support ownership checks (test_router_process.py).

Dependency Upgrades:

• Upgraded several backend dependencies for improved security and compatibility, including python-multipart, aiohttp, and cryptography in pyproject.toml. [1] [2]

DevOps Improvements:

• Added a preprovision hook in azure.yaml to display a helpful message with troubleshooting instructions and a link to the issue tracker if deployment fails.

Does this introduce a breaking change?

• Yes
• No

Golden Path Validation

• I have tested the primary workflows (the "golden path") to ensure they function correctly without errors.

Deployment Validation

• I have validated the deployment process successfully and all services are running as expected with this change.

What to Check

Verify that the following are valid

• ...

Other Information

[github-actions]

Coverage Report •

File	Stmts	Miss	Cover	Missing
src/backend-api/src/app/libs/services
authorization.py	15	2	86%	31, 34
src/backend-api/src/app/routers
router_files.py	60	2	96%	59, 66
router_process.py	346	38	89%	60, 70–71, 139, 143, 150, 160, 239, 243, 250, 298–300, 324, 331, 385, 392, 457, 498–500, 527, 587, 619–621, 648, 721–723, 748, 784, 787, 803–804, 810–812
TOTAL	3137	205	93%

Tests	Skipped	Failures	Errors	Time
602	0 💤	0 ❌	0 🔥	28.346s ⏱️

[github-actions]

Processor Coverage Report •

File	Stmts	Miss	Cover	Missing
TOTAL	6009	840	86%

report-only-changed-files is enabled. No files were changed during this commit :)

Tests	Skipped	Failures	Errors	Time
834	0 💤	0 ❌	0 🔥	19.316s ⏱️

[Copilot]

Pull request overview

This pull request adds centralized process-ownership authorization enforcement to the backend API so that only the owning user can access or mutate a process (returning 404 for both “missing” and “not owner” to reduce information leakage). It also updates dependency pins across backend/processor/frontend and adds an azd preprovision hook message to aid deployment troubleshooting.

Changes:

• Introduces verify_process_ownership and applies it across process- and file-related API routes.
• Adds/updates router tests to validate 404 behavior for missing/unowned processes and to ensure unauthorized calls do not perform side effects.
• Bumps multiple Python and Node dependencies and adds an azure.yaml preprovision informational hook.

Reviewed changes

Copilot reviewed 10 out of 14 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/backend-api/src/app/libs/services/authorization.py	Adds centralized helper to verify process existence + ownership with 404 on failure.
src/backend-api/src/app/routers/router_process.py	Enforces ownership checks across process endpoints; preserves HTTPException handling.
src/backend-api/src/app/routers/router_files.py	Enforces ownership check for file upload to a process.
src/backend-api/src/tests/routers/test_router_process.py	Adds ownership enforcement tests across process endpoints.
src/backend-api/src/tests/routers/test_router_files.py	Adds ownership enforcement tests for file upload and missing process.
src/backend-api/pyproject.toml	Updates backend dependency pins (e.g., aiohttp/cryptography/python-multipart).
src/backend-api/uv.lock	Updates locked dependency resolution consistent with new pins.
src/processor/pyproject.toml	Updates processor dependency pins and transitive overrides.
src/processor/package-lock.json	Updates processor JS dependency lockfile (e.g., dompurify).
src/frontend/requirements.txt	Updates python-multipart pin for frontend service.
src/frontend/package.json	Updates npm overrides (e.g., form-data).
src/frontend/package-lock.json	Updates frontend JS dependency lockfile (multiple packages).
azure.yaml	Adds preprovision hook to print troubleshooting/issue link guidance.

Files not reviewed (2)

• src/frontend/package-lock.json: Generated file
• src/processor/package-lock.json: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.