fix(security): Add Firebase token verification to Gemini API routes

[Madhavi1108]

What does this PR do?

This PR strengthens the application's security by introducing a global authentication and authorization layer for all state-mutating API endpoints. Instead of protecting individual routes independently, write operations are now secured centrally through middleware that enforces authentication and RBAC permissions before requests reach business logic.

The implementation also preserves existing ownership-based authorization, avoids redundant JWT verification, and ensures all API write operations are protected by default.

---

Related Issue

Fixes #133

---

Type

• Security
• Enhancement
• Backend
• Testing

---

Changes Implemented

Global Authentication Middleware

• Created a centralized middleware (middleware/globalWriteAuth.js) that automatically protects every POST, PUT, PATCH, and DELETE request.
• Implemented global authentication enforcement for all write operations.
• Added centralized RBAC permission checks.
• Designed the middleware with a secure-by-default approach.
• Added a whitelist for public endpoints such as:
  • /api/auth/login
  • /api/auth/register
  • /api/upload/chunk
• All remaining write endpoints now require authentication.

---

Permission Mapping

Mapped CRUD operations to RBAC permissions:

HTTP Method	Required Permission
POST	create:*
PUT	edit:*
PATCH	edit:*
DELETE	delete:*

Custom state-mutating endpoints now require authentication by default.

---

Authentication Improvements

Updated middleware/auth.js.

Improvements

• Prevented redundant JWT verification.
• Reused req.user if authentication had already been performed by the global middleware.
• Reduced duplicate authentication work on protected routes.

---

Express Integration

Integrated the middleware globally inside server.js.

This ensures:

• Authentication occurs before business logic.
• Authorization occurs before controller execution.
• Future write endpoints are automatically protected.
• Eliminates duplicated middleware across multiple route files.

---

Files Added / Modified

New

• middleware/globalWriteAuth.js
• test_auth_edge_cases.js

Modified

• middleware/auth.js
• server.js

---

Testing

Global Authentication Edge Cases

✅ GET Requests

Scenario

Verify GET endpoints bypass global authentication.

Result

• Successfully bypassed authentication.
• Returned 200 OK.

---

✅ Public Authentication Endpoint

Scenario

POST /api/auth/login without a token.

Result

• Successfully bypassed global middleware.
• Authentication handled by the login controller.
• Returned expected authentication response.

---

✅ Generic State-Mutating Endpoint

Scenario

POST /api/events without authentication.

Result

• Correctly blocked.
• Returned 401 Unauthorized.

---

✅ Protected Item Creation (No Token)

Scenario

POST /api/items without authentication.

Result

• Correctly blocked by the global middleware.
• Returned 401 Unauthorized.

---

✅ Visitor Permission Enforcement

Scenario

Visitor attempts to create an item.

Result

• Correctly rejected.
• Returned 403 Forbidden.
• Missing create:items permission enforced successfully.

---

✅ Contributor Permission Validation

Scenario

Contributor creates a new item.

Result

• Request successfully authorized.
• Returned 201 Created.

---

✅ Ownership Verification (Critical Edge Case)

Issue Found

Initially, Contributors were incorrectly blocked from editing or deleting their own resources because the middleware enforced only:

• edit:items
• delete:items

Fix Applied

Added support for fallback permissions:

• edit:own_items
• delete:own_items

The request now correctly proceeds to the existing verifyOwnership middleware.

Validation

• Contributors can edit/delete their own resources.
• Contributors remain blocked from modifying resources owned by others.
• Ownership validation continues to function correctly.

---

RBAC Regression Testing

Executed the complete RBAC test suite after integrating the global middleware.

Authentication

• ✅ CSRF token fetched successfully.
• ✅ Administrator login successful.
• ✅ Visitor login successful.
• ✅ Invalid password correctly rejected (401 Unauthorized).

---

Protected Routes

• ✅ Unauthenticated requests blocked (401 Unauthorized).
• ✅ Visitor blocked from Admin-only endpoint (403 Forbidden).
• ✅ Administrator successfully accessed /users.

---

User Management

• ✅ Administrator successfully created a new user.
• ✅ Newly created Curator successfully authenticated.

---

Resource Operations

• ✅ Curator successfully created a cultural item.
• ✅ Contributor blocked from deleting another user's resource (403 Forbidden).
• ✅ Curator successfully deleted their own resource.

---

Session Management

• ✅ Refresh token exchange completed successfully.
• ✅ Logout completed successfully.
• ✅ Revoked refresh token correctly rejected (403 Forbidden).

---

Automated Test Summary

Global Authentication Tests

• ✅ GET requests bypass authentication correctly.
• ✅ Public authentication endpoints remain accessible.
• ✅ Generic write endpoints require authentication.
• ✅ Unauthorized requests return 401.
• ✅ Visitors without permissions receive 403.
• ✅ Contributors with valid permissions can create resources.
• ✅ Ownership validation correctly handles edit:own_items and delete:own_items.

---

RBAC Tests

• ✅ CSRF token validation
• ✅ Administrator login
• ✅ Visitor login
• ✅ Invalid credential rejection
• ✅ Protected route enforcement
• ✅ Admin-only route validation
• ✅ User creation
• ✅ Curator authentication
• ✅ Item creation
• ✅ Ownership protection
• ✅ Refresh token flow
• ✅ Logout and token revocation

---

Overall Verification

• ✅ Global write authentication implemented successfully.
• ✅ RBAC enforcement verified.
• ✅ Ownership validation preserved.
• ✅ Public endpoint whitelist verified.
• ✅ Authentication optimization verified.
• ✅ Global middleware integration verified.
• ✅ All authentication edge cases passed.
• ✅ Complete RBAC regression suite passed.
• ✅ No security regressions observed.
• ✅ Local testing completed successfully.

---

Checklist

• Global authentication middleware implemented
• RBAC enforcement added
• Ownership validation preserved
• Public endpoint whitelist implemented
• Authentication optimized
• Edge cases tested
• RBAC regression tests passed
• Code tested locally
• No security regressions observed
• Documentation updated (if applicable)

[vercel]

@Madhavi1108 is attempting to deploy a commit to the Smrithi P's projects Team on Vercel.

A member of the Team first needs to authorize it.

[Madhavi1108]

Hi @smrithipiedy ,
Thank you for assigning the issue to me
I have implemented the backend changes
A detailed summary of the same is present in the pr
Kindly let me know if any changes are needed from my side