Unauthenticated conversation reads

Problem

Unauthenticated requests can read conversation records.

Observed behavior:

• Unauthenticated GET /conversations/{id} requests returned 200 for production conversation IDs.
• Responses included full conversation JSON, including message bodies.

Risk

Conversation contents may be exposed to unauthenticated callers.

Expected behavior

Conversation reads should require authentication, and the backend should only return a conversation when the authenticated user owns or is explicitly allowed to access it.

Acceptance criteria

• GET /conversations/{id} rejects unauthenticated requests.
• Authenticated requests are scoped to conversations owned by the authenticated user or explicitly shared with that user.
• Failed auth/ownership checks return 401 or 403 without conversation bodies.
• Regression tests cover unauthenticated reads, wrong-user reads, and valid owner reads.

Start at the GET /conversations/{id} endpoint and trace its authentication and ownership checks before reviewing the existing test structure. Add regression coverage for unauthenticated, wrong-user, and valid-owner reads, ensuring rejected responses contain no conversation body. Done means unauthenticated requests are rejected and authenticated access is limited to owned or explicitly shared conversations.