fix: address IDOR vulnerability in chat Supabase Edge Function

- Conducted a backend security audit and implemented a fix for an Insecure Direct Object Reference (IDOR) vulnerability in the chat function.
- Added UUID format validation for `conversation_id` and ownership checks to ensure users can only modify their own conversations.
- Verified changes with `deno check`, `npm run lint`, `npm run format`, and `npm run type-check`, all passing without errors.

Author: Raoof128

AGENT.md

@@ -9,6 +9,15 @@ These rules govern the development of the Aion project.
 
 ## Change Log
 
+### 2026-05-21 (Australia/Sydney)
+**Raouf:**
+- **Scope:** Backend IDOR Security Fix
+- **Summary:** Performed a backend security audit and fixed an Insecure Direct Object Reference (IDOR) vulnerability in the chat Supabase Edge Function (`supabase/functions/chat/index.ts`). The function now validates the UUID format of incoming `conversation_id` and verifies that the authenticated user owns the conversation before updating it or inserting new messages, preventing users from altering others' conversations.
+- **Files Changed:**
+  - [supabase/functions/chat/index.ts](file:///Users/raoof.r12/Desktop/Raouf/Aion/supabase/functions/chat/index.ts) - Added UUID format validation and ownership checks before conversation database updates and message inserts.
+- **Verification:** Ran `deno check supabase/functions/chat/index.ts`, `npm run lint`, `npm run format`, and `npm run type-check`, all completing with 0 errors.
+- **Follow-ups:** None.
+
 ### 2026-05-21 (Australia/Sydney)
 **Raouf:**
 - **Scope:** Syntax Fix & Supabase Resilience

CHANGELOG.md

@@ -6,6 +6,15 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## Change Log
 
+### 2026-05-21 (Australia/Sydney)
+**Raouf:**
+- **Scope:** Backend IDOR Security Fix
+- **Summary:** Performed a backend security audit and fixed an Insecure Direct Object Reference (IDOR) vulnerability in the chat Supabase Edge Function (`supabase/functions/chat/index.ts`). The function now validates the UUID format of incoming `conversation_id` and verifies that the authenticated user owns the conversation before updating it or inserting new messages, preventing users from altering others' conversations.
+- **Files Changed:**
+  - [supabase/functions/chat/index.ts](file:///Users/raoof.r12/Desktop/Raouf/Aion/supabase/functions/chat/index.ts) - Added UUID format validation and ownership checks before conversation database updates and message inserts.
+- **Verification:** Ran `deno check supabase/functions/chat/index.ts`, `npm run lint`, `npm run format`, and `npm run type-check`, all completing with 0 errors.
+- **Follow-ups:** None.
+
 ### 2026-05-21 (Australia/Sydney)
 **Raouf:**
 - **Scope:** Syntax Fix & Supabase Resilience

deno.lock

@@ -10,6 +10,7 @@ const supabase = createClient(SUPABASE_URL, SUPABASE_SERVICE_ROLE_KEY);
 
 // --- Constants ---
 const MAX_MESSAGE_LENGTH = 500;
+const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 
 // --- IP Extraction ---
 function getClientIp(req: Request): string {
@@ -239,6 +240,28 @@ async function persistMessages(
     if (error) throw new Error(`Create conversation error: ${error.message}`);
     convId = data.id;
   } else {
+    // Validate UUID format to prevent DB type mismatch errors
+    if (!UUID_REGEX.test(convId)) {
+      throw new Error("Invalid conversation ID format");
+    }
+
+    // Verify ownership to prevent IDOR (Insecure Direct Object Reference)
+    const { data: conv, error: convError } = await supabase
+      .from("conversations")
+      .select("user_id")
+      .eq("id", convId)
+      .maybeSingle();
+
+    if (convError) {
+      throw new Error(`Database error verifying conversation: ${convError.message}`);
+    }
+    if (!conv) {
+      throw new Error("Conversation not found");
+    }
+    if (conv.user_id !== userId) {
+      throw new Error("Unauthorized: Conversation does not belong to this user");
+    }
+
     await supabase
       .from("conversations")
       .update({ updated_at: new Date().toISOString() })