[BUG] Saved-views auth bypass merged in #2025 — backend-unit failing on main since 2026-07-22

[Subramaniyajothi6]

Summary

main is currently broken: the saved-views API-key auth check merged in PR #2025 ("fix-saved-views-1743", merged 2026-07-22) does not actually enforce authentication, and backend-unit has been failing on every push/PR run since that merge.

Why this matters

This is a security regression, not just a flaky test: the saved-views endpoints are supposed to reject unauthenticated requests and requests with a wrong API key, but they currently return 200 instead of 401. It also blocks CI for every open PR, since backend-unit is a required check and fails on a clean rebase of any branch onto current main — unrelated to whatever the PR itself changes.

Reproduction steps

1. Check out main at or after commit ef4efd30 (merge of PR Fix: add auth and owner isolation to saved views API (closes #1743) #2025, 2026-07-22).
2. Run pytest testing/backend/unit/test_saved_views.py -q.
3. Observe two failures.

Expected behavior

• test_unauthenticated_request_rejected and test_wrong_api_key_rejected should pass — the saved-views router should return 401 for requests with no API key or an invalid one.
• backend-unit should be green on main.

Actual behavior

FAILED testing/backend/unit/test_saved_views.py::test_unauthenticated_request_rejected - assert 200 == 401
FAILED testing/backend/unit/test_saved_views.py::test_wrong_api_key_rejected - assert 200 == 401
2 failed, 2348 passed, 19 warnings

Confirmed present on:

• The backend-unit run immediately after PR Fix: add auth and owner isolation to saved views API (closes #1743) #2025 merged into main (2026-07-22): https://github.com/utksh1/SecuScan/actions/runs/29893353875
• The latest main CI run as of 2026-07-24 (after PR test(plugins): add parser unit tests for scapy_recon plugin (#1431) #1710 merged): https://github.com/utksh1/SecuScan/actions/runs/30083451247
• Two unrelated open PRs (fix(parser-sandbox): drop PYTHONPATH/HOME and run parser child unprivileged #2019, fix(amass): replace hardcoded /tmp/amass with a private per-task scratch dir #2020) after rebasing onto current main — neither touches saved_views.py or its router/auth wiring, confirming the break lives in main itself, not in either PR's diff.

Scope

• Suggested files or directories: backend/secuscan/saved_views.py (router/auth wiring), testing/backend/unit/test_saved_views.py
• Related route: the saved-views router registered alongside routes.py (see saved_views.py's router registration in main.py)

Evidence

See linked Action runs above for full logs. Relevant recent history on backend/secuscan/saved_views.py:

a0c75d00  2026-07-20  Merge branch 'main' into fix-saved-views-1743
b91001d0  2026-07-17  fix(security): enforce API key auth on saved views router (#2035)
5c5f8fa9  2026-07-14  Fix: add auth and owner isolation to saved views API (closes #1743)
7dfc170c  2026-06-01  feat: add saved views backend API

PR #2025 merged fix-saved-views-1743 into main on 2026-07-22 and appears to have reintroduced or never actually applied the auth enforcement from #2035/5c5f8fa9 in the merged result.

Environment

• Python Version: 3.11.15 (GitHub Actions ubuntu-latest runner)
• Observed via GitHub Actions CI, not local

Definition of done

• Bug is reproducible from the issue description
• Root cause of the auth bypass on the saved-views router is fixed
• test_saved_views.py::test_unauthenticated_request_rejected and test_wrong_api_key_rejected pass
• backend-unit is green on main
• Regression test added/adjusted if the existing tests didn't already cover the exact bypass path

Additional context

This currently blocks every open PR's backend-unit required check regardless of what the PR changes, since it's a break in main itself rather than anything PR-specific.

[Subramaniyajothi6]

@utksh1 please assign this issue , the pr is ready

[taneesha-reyyi]

Hi @Subramaniyajothi6,

I'd like to work on this issue as part of GSSoC 2026 if it's available.

Solution Approach:

• Reproduce the failing backend-unit tests for test_saved_views.py to confirm the authentication bypass.
• Investigate the saved-views router and require_api_key dependency wiring to identify why unauthenticated and invalid API key requests return 200 instead of 401.
• Ensure the authentication dependency is correctly enforced on all saved-views endpoints without affecting authenticated requests.
• Update or add regression tests to verify that requests without an API key and with an invalid API key consistently return 401 Unauthorized.
• Run the complete backend-unit test suite to ensure the fix resolves the regression and introduces no new failures.

If the issue is unassigned, could you please assign it to me? Thank you!