feat: enforce user ownership verification for material access across all API routes

materials/routes.py

@@ -57,6 +57,8 @@ def get_material_by_id(
     mat = get_material(material_id)
     if not mat:
         raise HTTPException(404, "Material not found")
+    if mat.get("user_id") != user_id:
+        raise HTTPException(403, "Access denied")
     return mat
 
 async def _process_pdf_background(material_id: str, file_content: bytes):

quiz_generator/routes.py

@@ -62,6 +62,8 @@ async def generate_quiz(
             if not topic_title and body.material_id:
                 mat = get_material(body.material_id)
                 if mat:
+                    if mat.get("user_id") != user_id:
+                        raise HTTPException(403, "Access denied")
                     topic_title = mat.get("title")
             
             if not topic_title:
@@ -82,6 +84,8 @@ async def generate_quiz(
             mat = get_material(body.material_id) if body.material_id else None
             if not mat:
                 raise HTTPException(400, f"No {body.source_type} material found")
+            if mat.get("user_id") != user_id:
+                raise HTTPException(403, "Access denied")
 
             chunks_list = get_chunks(body.material_id)
             chunks_texts = [c["content"] for c in chunks_list] if chunks_list else []

rag/routes.py

@@ -42,6 +42,7 @@ class TutorResponse(BaseModel):
 @router.post("/ask", response_model=TutorResponse)
 async def ask_tutor(
     body: TutorQuery,
+    user_id: str = Depends(get_current_user_id),
     current_user=Depends(get_current_user),
 ):
     if not body.query.strip():
@@ -73,6 +74,8 @@ async def ask_tutor(
             mat = get_material(body.material_id) if body.material_id else None
             if not mat:
                 raise HTTPException(400, f"No {body.source_type} material found. Upload one first.")
+            if mat.get("user_id") != user_id:
+                raise HTTPException(403, "Access denied")
 
             material_id = body.material_id
             

summary_generator/routes.py

@@ -36,6 +36,8 @@ async def generate_summary(
     mat = get_material(body.material_id)
     if not mat:
         raise HTTPException(404, "Material not found")
+    if mat.get("user_id") != user_id:
+        raise HTTPException(403, "Access denied")
 
     try:
         start = time.time()
@@ -74,6 +76,10 @@ async def get_material_summary(
     user_id: str = Depends(get_current_user_id),
     current_user=Depends(get_current_user),
 ):
+    mat = get_material(material_id)
+    if not mat or mat.get("user_id") != user_id:
+        raise HTTPException(403, "Access denied")
+
     summary = get_stored_summary(material_id)
     if not summary:
         logger.info("no summary found")