From dd068e31d02a56ecfad520d750ecb6a22004507b Mon Sep 17 00:00:00 2001
From: jelveh <nj@puter.com>
Date: Wed, 12 Aug 2026 09:13:11 -0700
Subject: [PATCH] Require verified users for app feedback API

Add `requireVerified: true` to both app feedback routes (`GET /target` and `POST /`) in `AppFeedbackController`. This tightens access control so only verified user accounts can fetch feedback targets or submit app feedback.
---
 src/backend/controllers/feedback/AppFeedbackController.ts | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/backend/controllers/feedback/AppFeedbackController.ts b/src/backend/controllers/feedback/AppFeedbackController.ts
index 2e972ef68..c1fbd590f 100644
--- a/src/backend/controllers/feedback/AppFeedbackController.ts
+++ b/src/backend/controllers/feedback/AppFeedbackController.ts
@@ -62,6 +62,7 @@ export class AppFeedbackController extends PuterController {
     @Get('/target', {
         subdomain: 'api',
         requireUserActor: true,
+        requireVerified: true,
         rateLimit: {
             scope: 'app-feedback-target',
             limit: 60,
@@ -93,6 +94,7 @@ export class AppFeedbackController extends PuterController {
     @Post('/', {
         subdomain: 'api',
         requireUserActor: true,
+        requireVerified: true,
         // Submissions only ever originate from our own GUI pages (desktop
         // dialog / popup). Cross-origin browser pages get stopped here even
         // if they somehow hold a user token; non-browser clients still pass