Fix: require token authentication, limit payload fields, and rate lim…

[omnipotentchaos]

What type of PR is this?

• 🐛 Bug fix
• ✨ New feature
• 📚 Documentation
• 🎨 UI/UX improvement
• ⚡ Performance improvement
• 🔒 Security fix

Description

Secures the /api/labels endpoint by requiring Firebase ID token authentication, enforcing data projections to prevent PII exposure, and adding rate limiting to block user enumeration attacks.

Related Issues

Closes #171

Changes Made

• Authentication Check: Added Firebase token decoding on the /api/labels GET route to verify authenticated users. Returns 401 Unauthorized on failure.
• PII Exposure Protection: Restricted output fields by applying a projection { _id: 0, name: 1, email: 1, image: 1 }, ensuring internal database IDs or metadata are never returned.
• Enumeration Protection: Implemented client IP rate limiting (10 attempts per minute per IP), responding with 429 Too Many Requests when exceeded.
• Client hook/component update: Updated useLabels hook to expect the logged-in user and include the Bearer token header in request fetching.
• New Unit Tests: Created components/_tests_/labelsRoute.test.js checking missing headers, token errors, projection correctness, and rate limit triggers.

Testing

How did you test these changes?

• Tested locally (Ran npm test - all 48 unit tests passed successfully)
• Verified local production build compiles successfully via npm run build

Test Suite Output

PASS components/_tests_/labelsRoute.test.js
PASS components/_tests_/AuthForm.test.js
PASS components/_tests_/registerRoute.test.js
PASS components/_tests_/authUtils.test.js
PASS components/_tests_/formValidation.test.js

Test Suites: 5 passed, 5 total

[vercel]

@omnipotentchaos is attempting to deploy a commit to the Prem Shaw's projects Team on Vercel.

A member of the Team first needs to authorize it.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Premshaw23]

done👍