Spaces:
Sleeping
Sleeping
File size: 1,328 Bytes
80a4a65 3c7b4e4 80a4a65 3c7b4e4 80a4a65 3c7b4e4 80a4a65 3c7b4e4 80a4a65 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 | """``/api/certificates`` — issuance, download, verify, progress."""
from fastapi import APIRouter, Depends
from app.core.auth import get_current_user
from app.types import CertificateRequest
from app.services.certificate_service import (
handle_certificates,
download_certificate_pdf,
verify_certificate,
cert_progress,
)
router = APIRouter()
@router.post("/api/certificates")
async def post_certificates(req: CertificateRequest, user: dict = Depends(get_current_user)):
# IDOR FIX: Override user_id from JWT
req.user_id = user["user_id"]
return await handle_certificates(req)
@router.get("/api/certificates/{cert_id}/pdf")
async def get_certificate_pdf(cert_id: str, lang: str = "en"):
return await download_certificate_pdf(cert_id, lang)
@router.get("/api/certificates/verify/{verify_code}")
async def get_verify(verify_code: str):
return await verify_certificate(verify_code)
@router.get("/api/certificates/progress")
async def get_progress(user_id: str, category: str, user: dict = Depends(get_current_user)):
# IDOR FIX: Only allow viewing own progress
if user_id != user["user_id"]:
from fastapi import HTTPException
raise HTTPException(status_code=403, detail="Cannot view other users' progress")
return await cert_progress(user_id, category)
|