fix: add authentication to /tickets and /ai/log_correction (#786, #785)

[zeroknowledge0x]

Summary

Fixes #786 and #785 — Adds authentication to two unprotected endpoints that expose sensitive data.

Changes

GET /tickets (#786)

• Added Depends(get_current_user) requirement
• Auto-resolves company_id from user profile when not explicitly provided
• Prevents unauthenticated enumeration of all tickets across tenants

POST /ai/log_correction (#785)

• Added Depends(get_current_user) requirement
• Prevents fabricated correction data from polluting the training dataset

Security Impact

• Before: Anyone could enumerate all tickets via GET /tickets and submit fake corrections via POST /ai/log_correction
• After: Both endpoints require valid session cookies (Supabase auth)

Testing

• Unauthenticated requests to GET /tickets now return 401
• Unauthenticated requests to POST /ai/log_correction now return 401
• Authenticated requests continue to work as before
• Company-scoped ticket filtering works automatically from user profile

Fixes #786
Fixes #785

Summary by CodeRabbit

• Bug Fixes
  • API endpoints for AI corrections and ticket retrieval now require authentication
  • Ticket retrieval results are filtered by user's company for improved data isolation

[vercel]

@rkhandrianto is attempting to deploy a commit to the ritesh Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

Warning

Review limit reached

@zeroknowledge0x, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 2 minutes and 52 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 27534d58-3c37-4929-9e5b-9b46a96ddd2d

📥 Commits

Reviewing files that changed from the base of the PR and between 838667b and 131a6c9.

📒 Files selected for processing (1)

• backend/main.py

📝 Walkthrough

Walkthrough

Two API endpoints in backend/main.py are updated to require authentication and enforce tenant security. The POST /ai/log_correction endpoint now accepts an authenticated user dependency. The GET /tickets endpoint adds user authentication and applies company-based filtering when the user's profile contains a resolvable company_id.

Changes

Endpoint Authentication and Tenant Security

Layer / File(s)	Summary
Correction logging endpoint authentication backend/main.py	POST /ai/log_correction handler signature is updated to require an authenticated user via Depends(get_current_user).
Tickets listing authentication and tenant scoping backend/main.py	GET /tickets adds authentication dependency, resolves company_id from the authenticated user's profiles record when not explicitly provided, and applies a company_id filter to the Supabase query when available.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related issues

• #786: Implements the unauthenticated GET /tickets security fix by adding Depends(get_current_user) requirement and tenant-scoped filtering.
• #785: Implements the unauthenticated POST /ai/log_correction security fix by adding Depends(get_current_user) requirement.

Possibly related PRs

• ritesh-1918/HELPDESK.AI#630: Also updates POST /ai/log_correction authentication in backend/main.py, with additional ownership validation logic.

Suggested labels

gssoc:approved, level:critical, type:bug

Poem

A rabbit guards the ticket door,
No sneaking in to peek and pour,
Auth and scope make data tight—
Tenants separated, each in sight. 🐰🔐

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The PR title clearly and concisely summarizes the main change: adding authentication to two previously unprotected endpoints, with direct references to the addressed issues.
Linked Issues check	✅ Passed	The PR successfully addresses both linked issues by adding authentication requirements to POST /ai/log_correction and GET /tickets endpoints, with tenant scoping for /tickets.
Out of Scope Changes check	✅ Passed	All changes are directly related to the authentication requirements specified in issues #786 and #785; no unrelated modifications detected.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@backend/main.py`:
- Line 478: The current code references get_current_user in function signatures
for log_correction and get_tickets before get_current_user is defined, causing a
NameError on import; move the async def get_current_user definition above any
endpoints that Depend on it (or convert the Depends to a forward reference form)
so the symbol exists at module import. Also enforce tenant isolation in the
/tickets handler: when a caller supplies company_id, validate it matches the
authenticated user’s company (from get_current_user) and reject (401/403)
mismatches; when company_id is omitted, derive the company_id from the
authenticated user and if that lookup/profile fails, return an auth error
instead of running an unfiltered tickets query; update get_tickets and any
ticket-query helper to always use the resolved company_id from the authenticated
user.
- Around line 547-567: The current logic in the ticket listing path (the
company_id resolution and query-building around variables company_id, user, and
supabase.table("profiles")) allows unscoped reads; update it to first resolve
the authenticated user's tenant by fetching
profiles.select("company_id").eq("id", user_id).single(), and if that lookup
fails or returns no company_id return a 403; if the caller provided a company_id
ensure it matches the resolved tenant and return 403 on mismatch; only after
successful resolution/match build the tickets query with query.eq("company_id",
resolved_company_id) and never fall back to an unfiltered select("*") or accept
arbitrary provided company_id.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 2dce8927-293e-42cb-8c4e-c23fe9bb93b3

📥 Commits

Reviewing files that changed from the base of the PR and between da8faf2 and 838667b.

📒 Files selected for processing (1)

• backend/main.py

[ritesh-1918]

Hi @zeroknowledge0x! Thanks for the contribution. I have triaged your PR and set it to merge into the gssoc branch.

⚠️ MANDATORY GSSOC ONBOARDING STEPS:
Before your PR points are finalized on the leaderboard, you MUST complete these required steps:

1. ⭐ Star this repository: https://github.com/ritesh-1918/HELPDESK.AI (Mandatory)
2. 👤 Follow the Project Admin: https://github.com/ritesh-1918 (Mandatory)
3. 💼 Connect on LinkedIn: https://www.linkedin.com/in/ritesh1908/ (Mandatory)

Welcome to the HELPDESK.AI developer family! 🚀💻

[ritesh-1918]

Hi @zeroknowledge0x! 🙌

Thank you so much for your excellent contribution: "fix: add authentication to /tickets and /ai/log_correction (#786, #785)"! We really appreciate the high-quality code and effort you have put into the platform.

Just a quick, friendly heads-up as we prepare our manual merging and verification queues—please make sure to complete all the mandatory community steps listed below.

Once those manual steps are verified, we'll get your PR officially merged into the gssoc branch (or keep it neatly cataloged if closed as integrated) and assign it the highest possible GSSoC S-Tier labels to maximize your leaderboard points!

Let's build something amazing together! 🚀🔥

---

🌟 Community Support & Network Steps (Take 10 Seconds!)

As we prepare our manual verification and merging queues, please make sure you have taken a moment to complete these required steps to finalize your points:

1. ⭐ Star this repository: https://github.com/ritesh-1918/HELPDESK.AI (Mandatory)
2. 🍴 Fork this repository: https://github.com/ritesh-1918/HELPDESK.AI/fork (Mandatory)
3. 👤 Follow @ritesh-1918 on GitHub: https://github.com/ritesh-1918 (Mandatory - manual step)
4. 💼 Connect on LinkedIn: https://www.linkedin.com/in/ritesh1908/ (Mandatory)

Note: Having these steps completed manually is required before your PR points are officially cleared.