Fix: secure settings update endpoint with Firebase authentication, ro…

[omnipotentchaos]

What type of PR is this?

• 🐛 Bug fix
• ✨ New feature
• 📚 Documentation
• 🎨 UI/UX improvement
• ⚡ Performance improvement
• 🔒 Security fix

Description

Secures the /api/settings PATCH update endpoint to mitigate IDOR (Insecure Direct Object Reference) vulnerabilities.

Previously, unauthenticated clients or regular users could overwrite arbitrary user settings by supplying a target userId. This change introduces strict authentication, checks settings ownership, implements role-based privilege checks for administrators, and outputs detailed audit trails for every successful modification.

Related Issues

Closes #172

Changes Made

• Authentication Enforcement: Enforced Firebase ID Token authentication in app/api/settings/route.js using verifyFirebaseToken. Rejected unauthenticated requests early with 401 Unauthorized.
• IDOR ownership & Role checks: Enforced that users can only modify their own settings. If the body contains a userId that differs from the authenticated user's uid, the operator's Firestore profile is fetched via getUserProfile to verify if they have an "admin" role. If not, the request returns a 403 Forbidden response.
• Audit Logging: Added clear console-based audit logs for tracking settings updates, detailing the modified target user ID, operator user ID, and privilege role (admin vs. owner).
• Unit Testing: Created a comprehensive test suite in components/_tests_/settingsRoute.test.js validating authentication checks, valid self-settings updates, non-admin cross-user rejections (403), admin settings updates, and correct audit log emission.

Testing

How did you test these changes?

• Tested locally
• Tested on mobile
• Tested different user roles
• All roles tested

All Jest unit tests (including the 6 new settings security tests) pass successfully:

PASS  components/_tests_/settingsRoute.test.js
Test Suites: 7 passed, 7 total
Tests:       58 passed, 58 total

[vercel]

@omnipotentchaos is attempting to deploy a commit to the Prem Shaw's projects Team on Vercel.

A member of the Team first needs to authorize it.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Premshaw23]

done👍