3 commits

Author	SHA1	Message	Date
senke	246e3d9630	[BE-SEC-003] security: Fix ownership verification for playlist updates/deletes ... - Added RequireOwnershipOrAdmin middleware to PUT/DELETE /playlists/:id routes - Created playlistOwnerResolver that loads playlist from DB and returns owner user_id - Service already handles ownership checks and collaborator permissions - All existing integration tests pass (TestUpdatePlaylist_AsOwner, TestUpdatePlaylist_NotOwner, TestDeletePlaylist_AsOwner, TestDeletePlaylist_NotOwner) Phase: PHASE-1 Priority: P0 Progress: 3/267 (1.1%)	2025-12-23 01:37:56 +01:00
senke	b76925c493	[BE-SEC-002] security: Fix ownership verification for track updates/deletes ... - Verified RequireOwnershipOrAdmin middleware is correctly applied to PUT/DELETE /tracks/:id - Verified trackOwnerResolver correctly loads track from DB and returns user_id - Added comprehensive integration tests for ownership verification - Test: user cannot update another user's track (403 Forbidden) - Test: user cannot delete another user's track (403 Forbidden) - Test: admin can update any track (200 OK) - Test: admin can delete any track (200 OK) - Test: user can update own track (200 OK) - Test: user can delete own track (200 OK) - All tests pass Phase: PHASE-1 Priority: P0 Progress: 2/267 (0.7%)	2025-12-23 01:37:10 +01:00
senke	b9821db707	[BE-SEC-001] security: Fix ownership verification for user profile updates ... - Verified RequireOwnershipOrAdmin middleware is correctly applied to PUT /users/:id - Added integration tests for ownership verification - Test: user cannot update another user's profile (403 Forbidden) - Test: admin can update any profile (200 OK) - Test: user can update own profile (200 OK) - All tests pass Phase: PHASE-1 Priority: P0 Progress: 1/267 (0.4%)	2025-12-23 01:36:04 +01:00