API Security Audit

Authentication Checks

• Every protected route calls authenticateRequest(request) before processing
• Auth failures return 401 with generic message (no information leakage)
• Token validation happens server-side only
• Session tokens are httpOnly, secure, sameSite=strict

Authorization Checks

• Resource access uses has_agent_access() RPC, not raw ownership queries
• Role checks happen at the API layer, not just the UI
• Forbidden returns 403, not 404 (don't mask authorization as "not found")

Input Validation

• All request bodies validated with Zod before processing
• File uploads: check MIME type, size limit (5MB default), sanitize filename
• URL parameters: validate format, reject path traversal (..)
• Query strings: whitelist allowed parameters