fix(security): require auth + ownership on profile update (IDOR)

server/__test__/account.test.ts

@@ -654,4 +654,118 @@ describe("Account", () => {
     expect(removeMock).toHaveBeenCalledTimes(1);
     expect(res.sendStatus).toHaveBeenCalledWith(200);
   });
+
+  it("lets a user update their own profile", async () => {
+    const res = mockResponse();
+    const req = mockRequest({
+      params: { userid: "123" },
+      user: { id: 123, email: "user@test.com", sub: "data_entry" },
+      body: {
+        firstName: "New",
+        lastName: "Name",
+        email: "user@test.com",
+        tenantId: "1",
+      },
+    });
+    const next = mockNext();
+    const updateUserProfileMock =
+      accountService.updateUserProfile as jest.MockedFunction<
+        typeof accountService.updateUserProfile
+      >;
+    updateUserProfileMock.mockResolvedValueOnce({
+      isSuccess: true,
+      code: "UPDATE_SUCCESS",
+      message: "User profile successfully updated",
+    } as any);
+
+    await accountController.updateUserProfile(req, res, next);
+    expect(updateUserProfileMock).toHaveBeenCalledWith(
+      "123",
+      "New",
+      "Name",
+      "user@test.com",
+      "1"
+    );
+    expect(res.status).toHaveBeenCalledWith(200);
+  });
+
+  it("blocks a user from updating another user's profile (IDOR)", async () => {
+    const res = mockResponse();
+    const req = mockRequest({
+      params: { userid: "999" },
+      user: { id: 123, email: "user@test.com", sub: "data_entry" },
+      body: {
+        firstName: "Attacker",
+        lastName: "Controlled",
+        email: "victim-new@test.com",
+        tenantId: "1",
+      },
+    });
+    const next = mockNext();
+    const updateUserProfileMock =
+      accountService.updateUserProfile as jest.MockedFunction<
+        typeof accountService.updateUserProfile
+      >;
+
+    await accountController.updateUserProfile(req, res, next);
+    expect(updateUserProfileMock).not.toHaveBeenCalled();
+    expect(res.status).toHaveBeenCalledWith(403);
+  });
+
+  it("lets a global_admin update another user's profile", async () => {
+    const res = mockResponse();
+    const req = mockRequest({
+      params: { userid: "999" },
+      user: { id: 123, email: "admin@test.com", sub: "global_admin" },
+      body: {
+        firstName: "New",
+        lastName: "Name",
+        email: "someone@test.com",
+        tenantId: "1",
+      },
+    });
+    const next = mockNext();
+    const updateUserProfileMock =
+      accountService.updateUserProfile as jest.MockedFunction<
+        typeof accountService.updateUserProfile
+      >;
+    updateUserProfileMock.mockResolvedValueOnce({
+      isSuccess: true,
+      code: "UPDATE_SUCCESS",
+      message: "User profile successfully updated",
+    } as any);
+
+    await accountController.updateUserProfile(req, res, next);
+    expect(updateUserProfileMock).toHaveBeenCalledTimes(1);
+    expect(res.status).toHaveBeenCalledWith(200);
+  });
+
+  it("blocks a per-tenant admin from updating another user's profile (cross-tenant escalation)", async () => {
+    const res = mockResponse();
+    const req = mockRequest({
+      params: { userid: "999" },
+      // admin/security_admin are per-tenant roles; the JWT does not encode which
+      // tenant they apply to, so they must NOT grant a cross-user override.
+      user: {
+        id: 123,
+        email: "tenantadmin@test.com",
+        sub: "admin,security_admin",
+      },
+      body: {
+        firstName: "Attacker",
+        lastName: "Controlled",
+        email: "victim-new@test.com",
+        tenantId: "1",
+      },
+    });
+    const next = mockNext();
+    const updateUserProfileMock =
+      accountService.updateUserProfile as jest.MockedFunction<
+        typeof accountService.updateUserProfile
+      >;
+
+    await accountController.updateUserProfile(req, res, next);
+    expect(updateUserProfileMock).not.toHaveBeenCalled();
+    expect(res.status).toHaveBeenCalledWith(403);
+  });
 });

server/app/controllers/account-controller.ts

@@ -8,6 +8,7 @@ import {
   User,
   Role,
 } from "../../types/account-types";
+import { getUserRoles } from "../helpers/stakeholder-access";
 
 const getAll: RequestHandler<
   never,
@@ -270,6 +271,28 @@ const updateUserProfile: RequestHandler<
   never
 > = async (req, res) => {
   const userid = req.params.userid;
+
+  // Authorization: a user may only update their own profile, unless they are a
+  // global_admin. Prevents the IDOR where any authenticated (or, previously,
+  // unauthenticated) caller could overwrite any user's profile -- including the
+  // email tied to their login (security audit finding #2).
+  //
+  // Only global_admin is allowed to override, NOT admin/security_admin: those
+  // are per-tenant roles (from the login_tenant join) but the JWT does not
+  // encode which tenant they were granted for, so honoring them here would let
+  // an admin of one tenant edit users in another tenant (cross-tenant privilege
+  // escalation). global_admin is a login-level, non-tenant-scoped flag, so it is
+  // safe to trust from the JWT.
+  const roles = getUserRoles(req.user);
+  const isGlobalAdmin = roles.has("global_admin");
+  if (String(req.user?.id) !== String(userid) && !isGlobalAdmin) {
+    return res.status(403).json({
+      isSuccess: false,
+      code: "FORBIDDEN",
+      message: "You are not authorized to update this profile.",
+    });
+  }
+
   const { firstName, lastName, email, tenantId } = req.body;
   const response = await accountService.updateUserProfile(
     userid,

server/app/helpers/stakeholder-access.ts

@@ -18,7 +18,7 @@ type StakeholderAccessRequest = {
   };
 };
 
-const getUserRoles = (user?: StakeholderAccessUser) =>
+export const getUserRoles = (user?: StakeholderAccessUser) =>
   new Set((user?.sub || user?.role || "").split(",").filter(Boolean));
 
 const isRestrictedDataEntryUser = (user?: StakeholderAccessUser) => {

server/app/routes/account-router.ts

@@ -45,7 +45,11 @@ router.get("/logout", (req, res) => {
   res.sendStatus(200);
 });
 
-router.put("/:userid", accountController.updateUserProfile);
+router.put(
+  "/:userid",
+  jwtSession.validateUser,
+  accountController.updateUserProfile
+);
 
 router.get("/:email", accountController.getByEmail);