Fix: enforce token authentication, email matching authorization, and …

[omnipotentchaos]

What type of PR is this?

• 🐛 Bug fix
• ✨ New feature
• 📚 Documentation
• 🎨 UI/UX improvement
• ⚡ Performance improvement
• 🔒 Security fix

Description

This PR resolves critical security vulnerabilities in the registration endpoint (/api/register). Previously, anyone could call the endpoint to register arbitrary users and upload face images without authorization, posing a high risk for spam accounts, bot abuse, and unauthorized biometric data collection.

This change introduces token-based authorization via Firebase, email match validation, sliding-window rate limiting, and Vercel Blob rollback protection on database failures.

Related Issues

Closes #170

Changes Made

• Token Authentication & Verification: Added validation using the Firebase Admin SDK inside app/api/register/route.js. Requests with missing or invalid tokens are rejected with 401 Unauthorized.
• Email Authorization Match: Ensures that the email sent in the registration form strictly matches the verified email field inside the Firebase ID token. Mismatches are rejected with 403 Forbidden.
• IP-Based Rate Limiting: Added sliding-window rate-limiting of 5 registration attempts per 1-minute window per IP, protecting the endpoint from automated spam/bot registrations. Exceeded limits yield 429 Too Many Requests.
• Transactional Rollback: Wrapped database insertion in a try-catch block; if the MongoDB write fails, the uploaded image is automatically deleted (del()) from Vercel Blob storage, preventing orphaned files.
• Frontend Header injection: Updated components/register.js to dynamically retrieve the authenticated user's ID token (getIdToken()) and supply it in the standard Authorization header.
• Registration Security Documentation: Added formal documentation of the rate limiting thresholds, token validation, and cleanup procedures in SECURITY.md.
• Exhaustive Testing: Implemented 7 new security test cases in components/_tests_/registerRoute.test.js covering token presence/absence, token validity, email ownership, rate limits, and DB rollback.

Testing

How did you test these changes?

• Tested locally
• Tested on mobile
• Tested different user roles
• All roles tested

Local Test Execution Results:

All 57 unit tests (including the newly integrated security test suite) passed successfully:

PASS components/_tests_/AuthForm.test.js
PASS components/_tests_/conversationsRoute.test.js
PASS components/_tests_/registerRoute.test.js
PASS components/_tests_/authUtils.test.js
PASS components/_tests_/groqRoute.test.js
PASS components/_tests_/formValidation.test.js

Test Suites: 6 passed, 6 total
Tests:       57 passed, 57 total
Snapshots:   0 total
Time:        1.983 s

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[vercel]

@omnipotentchaos is attempting to deploy a commit to the Prem Shaw's projects Team on Vercel.

A member of the Team first needs to authorize it.

[Premshaw23]

done👍

[omnipotentchaos]

hey, @Premshaw23 .
Just wanted to ask why have you removed the labels from the PRs.
Due to that my GSSOC points have significantly reduced.

[Premshaw23]

hey, @Premshaw23 . Just wanted to ask why have you removed the labels from the PRs. Due to that my GSSOC points have significantly reduced.

sorry for this , i didn't see that I deleted some label globally and my mistake it deleted by your pr also, but dont worry i will fix today and you can see correct updated point tomorrow , if any issue let me know @omnipotentchaos