fix(tradein): scope GET /history to caller, close cross-pilot data leak (#656) #670

Merged

bot-reviewer merged 1 commit from fix/tradein-656-history-scope into main

2026-05-29 15:59:04 +00:00

Author	SHA1	Message	Date
lekss361	e3f928b24d	fix(tradein): scope GET /history to caller, close cross-pilot data leak (#656 ) GET /history SELECTed latest estimates of ALL users -> cross-pilot leak. Adds trade_in_estimates.created_by (migration 083), populated from X-Authenticated-User on estimate creation. /history now: non-admin forced to own rows (legacy NULL rows excluded); admin sees all or ?account=<user>; 401 if header missing, 403 if user not in roles.yaml. _empty_estimate rows also tagged. tests/test_history_scope.py (5 cases) + estimator regression green. Closes #656	2026-05-29 18:41:54 +03:00

Author

SHA1

Message

Date

lekss361

e3f928b24d

fix(tradein): scope GET /history to caller, close cross-pilot data leak (#656 )

GET /history SELECTed latest estimates of ALL users -> cross-pilot leak.
Adds trade_in_estimates.created_by (migration 083), populated from
X-Authenticated-User on estimate creation. /history now: non-admin forced
to own rows (legacy NULL rows excluded); admin sees all or ?account=<user>;
401 if header missing, 403 if user not in roles.yaml. _empty_estimate rows
also tagged. tests/test_history_scope.py (5 cases) + estimator regression green.

Closes #656

2026-05-29 18:41:54 +03:00