Spaces:
Sleeping
Sleeping
| """``/api/certificates`` — issuance, download, verify, progress.""" | |
| from fastapi import APIRouter, Depends | |
| from app.core.auth import get_current_user | |
| from app.types import CertificateRequest | |
| from app.services.certificate_service import ( | |
| handle_certificates, | |
| download_certificate_pdf, | |
| verify_certificate, | |
| cert_progress, | |
| ) | |
| router = APIRouter() | |
| async def post_certificates(req: CertificateRequest, user: dict = Depends(get_current_user)): | |
| # IDOR FIX: Override user_id from JWT | |
| req.user_id = user["user_id"] | |
| return await handle_certificates(req) | |
| async def get_certificate_pdf(cert_id: str, lang: str = "en"): | |
| return await download_certificate_pdf(cert_id, lang) | |
| async def get_verify(verify_code: str): | |
| return await verify_certificate(verify_code) | |
| async def get_progress(user_id: str, category: str, user: dict = Depends(get_current_user)): | |
| # IDOR FIX: Only allow viewing own progress | |
| if user_id != user["user_id"]: | |
| from fastapi import HTTPException | |
| raise HTTPException(status_code=403, detail="Cannot view other users' progress") | |
| return await cert_progress(user_id, category) | |