Skip to content

Implement cross-user access denial tests - #245

Closed
mspandey wants to merge 1 commit into
Him-an-shi:mainfrom
mspandey:patch-20
Closed

Implement cross-user access denial tests#245
mspandey wants to merge 1 commit into
Him-an-shi:mainfrom
mspandey:patch-20

Conversation

@mspandey

@mspandey mspandey commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

Added tests to verify cross-user access denial for updating and deleting cycles and symptoms. ### Description
This pull request expands the unit test suite in backend/tests/test_crud.py to cover Insecure Direct Object Reference (IDOR) vulnerabilities and cross-user authorization enforcement for both cycle and symptom modification/deletion endpoints.

Details:

  • Cycle IDOR Testing: Added test_update_cycle_cross_user_denied and test_delete_cycle_cross_user_denied to ensure that User B cannot modify or delete cycles belonging to User A, and verified that the original data remains intact.
  • Symptom IDOR Testing: Added test_update_symptom_cross_user_denied and test_delete_symptom_cross_user_denied to ensure that unauthorized cross-user access attempts on symptom records are properly rejected with 403 Forbidden or 404 Not Found.
  • Data Integrity: Asserts that unauthorized mutations do not alter or delete the underlying resource state in the database/mock storage.

Closes #171

Added tests to verify cross-user access denial for updating and deleting cycles and symptoms.
### Description
This pull request expands the unit test suite in `backend/tests/test_crud.py` to cover Insecure Direct Object Reference (IDOR) vulnerabilities and cross-user authorization enforcement for both cycle and symptom modification/deletion endpoints.

#### Details:
* **Cycle IDOR Testing:** Added `test_update_cycle_cross_user_denied` and `test_delete_cycle_cross_user_denied` to ensure that User B cannot modify or delete cycles belonging to User A, and verified that the original data remains intact.
* **Symptom IDOR Testing:** Added `test_update_symptom_cross_user_denied` and `test_delete_symptom_cross_user_denied` to ensure that unauthorized cross-user access attempts on symptom records are properly rejected with 403 Forbidden or 404 Not Found.
* **Data Integrity:** Asserts that unauthorized mutations do not alter or delete the underlying resource state in the database/mock storage.

Closes #171
Copilot AI lite review requested due to automatic review settings August 4, 2026 18:41
@vercel

vercel Bot commented Aug 4, 2026

Copy link
Copy Markdown

@mspandey is attempting to deploy a commit to the himanshipathak-240263-3015's projects Team on Vercel.

A member of the Team first needs to authorize it.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@mspandey mspandey closed this by deleting the head repository Aug 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

test(crud): missing cross-user authorization (IDOR) coverage for PUT/DELETE endpoints

2 participants