Security advisory 2 addressed

backend/app/api/auth.py

@@ -3,9 +3,10 @@
 
 from uuid import uuid4
 
-from fastapi import APIRouter, HTTPException
+from fastapi import APIRouter, Depends, HTTPException
 from pydantic import BaseModel
 
+from backend.app.api.dependencies import get_current_user
 from backend.app.database import get_connection, init_db
 from backend.app.core.config import settings
 from backend.app.services.auth_service import authenticate_user, find_user
@@ -96,14 +97,7 @@ def logout(payload: dict):
 
 
 @router.get('/me')
-def current_user(token: str):
-    info = validate_token(token)
-    if info is None:
-        raise HTTPException(status_code=401, detail='Token expired or invalid')
-    with get_connection() as conn:
-        user = conn.execute('SELECT * FROM users WHERE id = ?', (info['user_id'],)).fetchone()
-    if user is None:
-        raise HTTPException(status_code=404, detail='User not found')
+def current_user(user: dict = Depends(get_current_user)):
     return {
         'id': user['id'],
         'username': user['username'],

backend/app/database.py

@@ -213,7 +213,7 @@ CREATE TABLE IF NOT EXISTS email_address_verification_tokens (
 CREATE INDEX IF NOT EXISTS idx_user_email_addresses_user_id ON user_email_addresses(user_id);
 CREATE INDEX IF NOT EXISTS idx_email_address_verification_tokens_address_id ON email_address_verification_tokens(email_address_id);
 '''),
-     (13, '''
+    (13, '''
 CREATE TABLE IF NOT EXISTS pending_primary_email_changes (
      id TEXT PRIMARY KEY,
      user_id TEXT NOT NULL UNIQUE,
@@ -223,6 +223,9 @@ CREATE TABLE IF NOT EXISTS pending_primary_email_changes (
      created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
      FOREIGN KEY(user_id) REFERENCES users(id) ON DELETE CASCADE
 );
+'''),
+    (14, '''
+DROP TABLE IF EXISTS pending_primary_email_changes;
 ''')
 ]
 

backend/tests/test_api.py

@@ -39,7 +39,7 @@ def test_login_returns_token():
     assert 'access_token' in payload
     assert payload['token_type'] == 'bearer'
 
-    admin_session = client.get('/api/auth/me', params={'token': payload['access_token']})
+    admin_session = client.get('/api/auth/me', headers={'Authorization': f"Bearer {payload['access_token']}"})
     assert admin_session.status_code == 200
     assert admin_session.json()['is_admin'] is True
 
@@ -47,9 +47,10 @@ def test_login_returns_token():
            'email': 'bob@example.com',
         'password': 'secret123',
     }).json()['access_token']
-    user_session = client.get('/api/auth/me', params={'token': user_token})
+    user_session = client.get('/api/auth/me', headers={'Authorization': f"Bearer {user_token}"})
     assert user_session.status_code == 200
     assert user_session.json()['is_admin'] is False
+    assert client.get('/api/auth/me', params={'token': payload['access_token']}).status_code == 401
 
 
 def test_password_hashes_are_salted_and_legacy_hashes_upgrade_on_login():

backend/tests/test_database.py

@@ -10,7 +10,7 @@ def test_database_migrations_are_versioned_and_idempotent():
     connection = sqlite3.connect(':memory:')
 
     apply_migrations(connection)
-    assert get_schema_version(connection) == 13
+    assert get_schema_version(connection) == 14
     tables = {
         row[0]
         for row in connection.execute(
@@ -27,6 +27,6 @@ def test_database_migrations_are_versioned_and_idempotent():
     assert set(DEFAULT_TAGS) <= seeded_tags
 
     apply_migrations(connection)
-    assert get_schema_version(connection) == 13
+    assert get_schema_version(connection) == 14
 
     connection.close()