fix(ai): enforce audit ownership and normalize formatting

Add a ForbiddenException check so users can only chat about their own
audits (fixes an IDOR), apply Prettier formatting, and resolve lint
warnings to satisfy CI (--max-warnings 0).

Author: Emmanuel-Ugochukwu1

apps/api/src/modules/ai/ai.controller.ts

@@ -23,10 +23,7 @@ export class AiController {
 
   @Delete('conversation/:auditId')
   @ApiOperation({ summary: 'Clear conversation history for an audit' })
-  clearConversation(
-    @Param('auditId') auditId: string,
-    @CurrentUser('id') userId: string,
-  ) {
+  clearConversation(@Param('auditId') auditId: string, @CurrentUser('id') userId: string) {
     this.aiService.clearConversation(userId, auditId);
     return { success: true };
   }

apps/api/src/modules/ai/ai.module.ts

@@ -21,17 +21,13 @@ const aiEngineFactory = {
       if (!anthropicKey) {
         logger.warn('ANTHROPIC_API_KEY not set — AI chat will fail');
       }
-      return new AiEngineService(
-        new AnthropicProvider(anthropicKey ?? '', model),
-      );
+      return new AiEngineService(new AnthropicProvider(anthropicKey ?? '', model));
     }
 
     if (!openAiKey) {
       logger.warn('OPENAI_API_KEY not set — AI chat will fail');
     }
-    return new AiEngineService(
-      new OpenAiProvider(openAiKey ?? '', model),
-    );
+    return new AiEngineService(new OpenAiProvider(openAiKey ?? '', model));
   },
 };
 

apps/api/src/modules/ai/ai.service.spec.ts

@@ -1,8 +1,11 @@
-import { InternalServerErrorException, NotFoundException } from '@nestjs/common';
+import {
+  ForbiddenException,
+  InternalServerErrorException,
+  NotFoundException,
+} from '@nestjs/common';
 import { Test, type TestingModule } from '@nestjs/testing';
-
-import type { AiChatMessage } from '@veridion/shared';
 import { AiService as AiEngineService } from '@veridion/ai-engine';
+import type { AiChatMessage } from '@veridion/shared';
 
 import { PrismaService } from '../../common/prisma/prisma.service';
 import { AiService } from './ai.service';
@@ -39,6 +42,7 @@ const mockAudit = {
   id: 'audit-1',
   status: 'COMPLETED',
   securityScore: 75,
+  project: { userId: 'user-1' },
   findings: mockFindings,
 };
 
@@ -90,9 +94,13 @@ describe('AiService', () => {
   it('should throw NotFoundException when audit does not exist', async () => {
     mockPrisma.db.audit.findUnique.mockResolvedValue(null);
 
-    await expect(service.chat('user-1', chatDto)).rejects.toThrow(
-      NotFoundException,
-    );
+    await expect(service.chat('user-1', chatDto)).rejects.toThrow(NotFoundException);
+  });
+
+  it('should throw ForbiddenException when the audit belongs to another user', async () => {
+    mockPrisma.db.audit.findUnique.mockResolvedValue(mockAudit);
+
+    await expect(service.chat('user-2', chatDto)).rejects.toThrow(ForbiddenException);
   });
 
   it('should return AI response with citations', async () => {
@@ -132,7 +140,7 @@ describe('AiService', () => {
     await service.chat('user-1', { ...chatDto, message: 'Tell me more' });
 
     // The second call should include previous messages
-    const secondCallMessages = mockAiEngine.chat.mock.calls[1]![0] as AiChatMessage[];
+    const secondCallMessages = mockAiEngine.chat.mock.calls[1]?.[0] ?? [];
     const userMessages = secondCallMessages.filter((m) => m.role === 'user');
     expect(userMessages).toHaveLength(2);
   });
@@ -149,19 +157,17 @@ describe('AiService', () => {
       context: { findingId: 'finding-1' },
     });
 
-    const messages = mockAiEngine.chat.mock.calls[0]![0] as AiChatMessage[];
-    const userMsg = messages.find((m) => m.role === 'user')!;
-    expect(userMsg.content).toContain('Reentrancy Vulnerability');
-    expect(userMsg.content).toContain('Reentrancy Vulnerability');
+    const messages = mockAiEngine.chat.mock.calls[0]?.[0] ?? [];
+    const userMsg = messages.find((m) => m.role === 'user');
+    expect(userMsg?.content).toContain('Reentrancy Vulnerability');
+    expect(userMsg?.content).toContain('Reentrancy Vulnerability');
   });
 
   it('should throw InternalServerErrorException when AI engine fails', async () => {
     mockPrisma.db.audit.findUnique.mockResolvedValue(mockAudit);
     mockAiEngine.chat.mockRejectedValue(new Error('API rate limit exceeded'));
 
-    await expect(service.chat('user-1', chatDto)).rejects.toThrow(
-      InternalServerErrorException,
-    );
+    await expect(service.chat('user-1', chatDto)).rejects.toThrow(InternalServerErrorException);
   });
 
   it('should clear conversation', async () => {
@@ -177,7 +183,7 @@ describe('AiService', () => {
     // Next message should start fresh
     await service.chat('user-1', { ...chatDto, message: 'New question' });
 
-    const messages = mockAiEngine.chat.mock.calls[1]![0] as AiChatMessage[];
+    const messages = mockAiEngine.chat.mock.calls[1]?.[0] ?? [];
     const userMessages = messages.filter((m) => m.role === 'user');
     expect(userMessages).toHaveLength(1);
   });

apps/api/src/modules/ai/ai.service.ts

@@ -1,7 +1,12 @@
-import { Injectable, InternalServerErrorException, NotFoundException } from '@nestjs/common';
-import type { AiChatMessage } from '@veridion/shared';
+import {
+  ForbiddenException,
+  Injectable,
+  InternalServerErrorException,
+  NotFoundException,
+} from '@nestjs/common';
 import { AiService as AiEngineService } from '@veridion/ai-engine';
 import { logger } from '@veridion/logger';
+import type { AiChatMessage } from '@veridion/shared';
 
 import { PrismaService } from '../../common/prisma/prisma.service';
 import type { AiChatDto } from './dto/ai.dto';
@@ -57,13 +62,21 @@ export class AiService {
         findings: {
           orderBy: { severity: 'asc' },
         },
+        project: {
+          select: { userId: true },
+        },
       },
     });
 
     if (!audit) {
       throw new NotFoundException(`Audit with ID ${dto.auditId} not found`);
     }
 
+    // Ensure the audit belongs to the authenticated user.
+    if (audit.project.userId !== userId) {
+      throw new ForbiddenException('Access denied');
+    }
+
     const conversationKey = `${userId}:${dto.auditId}`;
     const history = this.getOrCreateHistory(conversationKey);
 
@@ -76,7 +89,8 @@ export class AiService {
     // Add the user message with optional context
     let userContent = dto.message;
     if (dto.context?.findingId) {
-      const finding = audit.findings.find((f) => f.id === dto.context!.findingId);
+      const { findingId } = dto.context;
+      const finding = audit.findings.find((f) => f.id === findingId);
       if (finding) {
         userContent = `[Context: User is asking about finding "${finding.title}" (${finding.severity}) in ${finding.filePath}:${finding.lineStart}-${finding.lineEnd}]\n\n${dto.message}`;
       }
@@ -89,16 +103,12 @@ export class AiService {
     history.push({ role: 'user', content: userContent });
 
     // Trim history if too long, keeping system message and recent messages
-    const recentHistory = history.length > MAX_HISTORY_LENGTH
-      ? history.slice(-MAX_HISTORY_LENGTH)
-      : history;
+    const recentHistory =
+      history.length > MAX_HISTORY_LENGTH ? history.slice(-MAX_HISTORY_LENGTH) : history;
 
     const messages: AiChatMessage[] = [systemMessage, ...recentHistory];
 
-    logger.info(
-      { auditId: dto.auditId, userId, messageCount: messages.length },
-      'AI chat request',
-    );
+    logger.info({ auditId: dto.auditId, userId, messageCount: messages.length }, 'AI chat request');
 
     try {
       const response = await this.aiEngine.chat(messages);
@@ -121,10 +131,7 @@ export class AiService {
         citations,
       };
     } catch (error) {
-      logger.error(
-        { error, auditId: dto.auditId, userId },
-        'AI chat request failed',
-      );
+      logger.error({ error, auditId: dto.auditId, userId }, 'AI chat request failed');
       throw new InternalServerErrorException(
         'AI service is temporarily unavailable. Please try again later.',
       );
@@ -178,9 +185,10 @@ export class AiService {
       {} as Record<string, number>,
     );
 
-    const scoreLine = audit.securityScore !== null
-      ? `Security Score: ${audit.securityScore}/100`
-      : 'Security Score: Not yet scored';
+    const scoreLine =
+      audit.securityScore !== null
+        ? `Security Score: ${audit.securityScore}/100`
+        : 'Security Score: Not yet scored';
 
     let prompt = `You are Veridion, an expert smart contract security assistant. You help developers understand and fix vulnerabilities in their smart contracts.
 
@@ -239,7 +247,7 @@ ${finding.codeSnippet ? `- Code:\n\`\`\`solidity\n${finding.codeSnippet}\n\`\`\`
     let match: RegExpExecArray | null;
 
     while ((match = citationRegex.exec(content)) !== null) {
-      const ref = match[1]!.trim();
+      const ref = (match[1] ?? '').trim();
 
       // Try to match by UUID first
       const findingById = findingMap.get(ref);
@@ -255,9 +263,7 @@ ${finding.codeSnippet ? `- Code:\n\`\`\`solidity\n${finding.codeSnippet}\n\`\`\`
       }
 
       // Try to match by title
-      const findingByTitle = findings.find(
-        (f) => f.title.toLowerCase() === ref.toLowerCase(),
-      );
+      const findingByTitle = findings.find((f) => f.title.toLowerCase() === ref.toLowerCase());
       if (findingByTitle) {
         if (!citations.some((c) => c.findingId === findingByTitle.id)) {
           citations.push({