fix(security): require auth + ownership on profile update (IDOR)

PUT /api/accounts/:userid had no auth middleware, so anyone could
overwrite any user's profile (firstName, lastName, email, tenantId) by
id -- including the email tied to a victim's login, which combined with
the password-reset flow could be chained toward account takeover
(security audit finding #2, Critical).

Fix:
- Add jwtSession.validateUser to the route so the endpoint requires a
  valid session (401 otherwise).
- Enforce ownership in the controller: a user may only update their own
  profile (req.user.id === :userid), unless they hold an account-
  management admin role (admin / security_admin / global_admin); returns
  403 otherwise.

The only client caller (Profile.tsx self-edit) is unaffected: it edits
the logged-in user's own id and the same-origin jwt cookie is sent
automatically.

Adds controller tests for owner-allowed, non-owner-blocked (IDOR), and
admin-allowed cases.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: hanapotski

server/__test__/account.test.ts

@@ -654,4 +654,89 @@ describe("Account", () => {
     expect(removeMock).toHaveBeenCalledTimes(1);
     expect(res.sendStatus).toHaveBeenCalledWith(200);
   });
+
+  it("lets a user update their own profile", async () => {
+    const res = mockResponse();
+    const req = mockRequest({
+      params: { userid: "123" },
+      user: { id: 123, email: "user@test.com", sub: "data_entry" },
+      body: {
+        firstName: "New",
+        lastName: "Name",
+        email: "user@test.com",
+        tenantId: "1",
+      },
+    });
+    const next = mockNext();
+    const updateUserProfileMock =
+      accountService.updateUserProfile as jest.MockedFunction<
+        typeof accountService.updateUserProfile
+      >;
+    updateUserProfileMock.mockResolvedValueOnce({
+      isSuccess: true,
+      code: "UPDATE_SUCCESS",
+      message: "User profile successfully updated",
+    } as any);
+
+    await accountController.updateUserProfile(req, res, next);
+    expect(updateUserProfileMock).toHaveBeenCalledWith(
+      "123",
+      "New",
+      "Name",
+      "user@test.com",
+      "1"
+    );
+    expect(res.status).toHaveBeenCalledWith(200);
+  });
+
+  it("blocks a user from updating another user's profile (IDOR)", async () => {
+    const res = mockResponse();
+    const req = mockRequest({
+      params: { userid: "999" },
+      user: { id: 123, email: "user@test.com", sub: "data_entry" },
+      body: {
+        firstName: "Attacker",
+        lastName: "Controlled",
+        email: "victim-new@test.com",
+        tenantId: "1",
+      },
+    });
+    const next = mockNext();
+    const updateUserProfileMock =
+      accountService.updateUserProfile as jest.MockedFunction<
+        typeof accountService.updateUserProfile
+      >;
+
+    await accountController.updateUserProfile(req, res, next);
+    expect(updateUserProfileMock).not.toHaveBeenCalled();
+    expect(res.status).toHaveBeenCalledWith(403);
+  });
+
+  it("lets an admin update another user's profile", async () => {
+    const res = mockResponse();
+    const req = mockRequest({
+      params: { userid: "999" },
+      user: { id: 123, email: "admin@test.com", sub: "admin,global_admin" },
+      body: {
+        firstName: "New",
+        lastName: "Name",
+        email: "someone@test.com",
+        tenantId: "1",
+      },
+    });
+    const next = mockNext();
+    const updateUserProfileMock =
+      accountService.updateUserProfile as jest.MockedFunction<
+        typeof accountService.updateUserProfile
+      >;
+    updateUserProfileMock.mockResolvedValueOnce({
+      isSuccess: true,
+      code: "UPDATE_SUCCESS",
+      message: "User profile successfully updated",
+    } as any);
+
+    await accountController.updateUserProfile(req, res, next);
+    expect(updateUserProfileMock).toHaveBeenCalledTimes(1);
+    expect(res.status).toHaveBeenCalledWith(200);
+  });
 });

server/app/controllers/account-controller.ts

@@ -270,6 +270,26 @@ const updateUserProfile: RequestHandler<
   never
 > = async (req, res) => {
   const userid = req.params.userid;
+
+  // Authorization: a user may only update their own profile, unless they hold
+  // an account-management admin role. Prevents the IDOR where any authenticated
+  // (or, previously, unauthenticated) caller could overwrite any user's profile
+  // -- including the email tied to their login (security audit finding #2).
+  const roles = new Set(
+    (req.user?.sub || req.user?.role || "").split(",").filter(Boolean)
+  );
+  const isAccountAdmin =
+    roles.has("admin") ||
+    roles.has("security_admin") ||
+    roles.has("global_admin");
+  if (String(req.user?.id) !== String(userid) && !isAccountAdmin) {
+    return res.status(403).json({
+      isSuccess: false,
+      code: "FORBIDDEN",
+      message: "You are not authorized to update this profile.",
+    });
+  }
+
   const { firstName, lastName, email, tenantId } = req.body;
   const response = await accountService.updateUserProfile(
     userid,

server/app/routes/account-router.ts

@@ -45,7 +45,11 @@ router.get("/logout", (req, res) => {
   res.sendStatus(200);
 });
 
-router.put("/:userid", accountController.updateUserProfile);
+router.put(
+  "/:userid",
+  jwtSession.validateUser,
+  accountController.updateUserProfile
+);
 
 router.get("/:email", accountController.getByEmail);