Guarzo 5349b5088c fix: authorize client-supplied IDs in LiveView handlers (IDOR audit) ...

LiveView event handlers were trusting client-supplied record IDs without
verifying they belong to the user's current map/user scope. A logged-in
user could push another map's record UUID over the LV socket and act on
it. Affected handlers:

- cancel-subscription / edit-subscription / update_subscription
  (cancel or upgrade any map's paid subscription by ID)
- characters_live.ex "delete"
  (soft-delete any user's character and null their user_id)
- cancel_ping
  (cross-map rally-ping cancellation broadcast)
- deleteSystemComment
  (cross-map comment deletion)
- update_passage_mass
  (cross-map wormhole passage mass corruption)
- updateCharacterTracking
  (untrack another user's character on a shared map)

Also fixes a related numeric-trust bug in subscribe/update_subscription
where `period`, `characters_limit`, and `hubs_limit` were parsed without
bounds, allowing `period: "-1"` to produce a back-dated subscription
with a negative price.

Adds WandererAppWeb.HandlerAuth with focused helpers each handler now
routes through, plus 26 regression tests covering both the IDOR auth
checks and the bounded-int parsers.

2026-06-10 14:31:56 +00:00

..

api_router

…

controllers

…

handler_auth_test.exs

fix: authorize client-supplied IDs in LiveView handlers (IDOR audit)

2026-06-10 14:31:56 +00:00