fix: add authentication to /tickets and /ai/log_correction (#786, #785)

backend/main.py

@@ -475,8 +475,8 @@ async def analyze_bug(request: BugReportAnalysisRequest):
 CORRECTIONS_LOG_PATH = Path(__file__).parent / "data" / "corrections_log.json"
 
 @app.post("/ai/log_correction")
-async def log_correction(raw_request: Request):
-    """Log an admin correction when the AI prediction differs from the human decision."""
+async def log_correction(raw_request: Request, user: dict = Depends(get_current_user)):
+    """Log an admin correction when the AI prediction differs from the human decision. Requires authentication."""
     try:
         body = await raw_request.json()
     except Exception as e:
@@ -536,15 +536,42 @@ async def log_correction(raw_request: Request):
 # Ticket operations (Now via Supabase)
 # ---------------------------------------------------------------------------
 @app.get("/tickets")
-async def get_tickets(company_id: str | None = None):
-    """Fetch persistent tickets from Supabase."""
+async def get_tickets(
+    company_id: str | None = None,
+    user: dict = Depends(get_current_user),
+):
+    """Fetch persistent tickets from Supabase. Requires authentication."""
     if not supabase:
         raise HTTPException(status_code=500, detail="Database connection not initialized")
-
-    query = supabase.table("tickets").select("*").order("created_at", desc=True)
-    if company_id:
-        query = query.eq("company_id", company_id)
-
+
+    # SECURITY: Always resolve company_id from authenticated user profile.
+    # Ignore any client-provided company_id to prevent cross-tenant data leaks.
+    user_id = user.get("id")
+    if not user_id:
+        raise HTTPException(status_code=403, detail="User ID not found in token")
+
+    try:
+        profile_res = (
+            supabase.table("profiles")
+            .select("company_id")
+            .eq("id", user_id)
+            .single()
+            .execute()
+        )
+        profile = profile_res.data or {}
+        company_id = profile.get("company_id")
+    except Exception:
+        raise HTTPException(status_code=403, detail="Unable to resolve tenant for this user")
+
+    if not company_id:
+        raise HTTPException(status_code=403, detail="No company assigned to this user")
+
+    query = (
+        supabase.table("tickets")
+        .select("*")
+        .eq("company_id", company_id)
+        .order("created_at", desc=True)
+    )
     res = query.execute()
     return res.data