dpriskorn / dpriskorn/entitybase-backend
Add authentication
Open
enhancement
- Dominant language
- Python
- Stars
- 2
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Description
1. No Authentication/Authorization (CRITICAL)
Status: The codebase explicitly states "We intentionally don't have auth" (src/models/data/rest_api/v1/entitybase/response/user.py:10)
Impact: All 123 endpoints are completely unauthenticated
Evidence:
No auth middleware in main.py
User endpoints (/users/{user_id}/*) take user_id directly from URL path without verification
Edit operations require X-User-ID header but it's not validated - any client can claim to be any user
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.