🐐 Several security fixes

backend/routers/friends.py

@@ -5,7 +5,7 @@ from sqlalchemy.orm import Session, joinedload
 
 from services import notification_manager
 from core.database import get_db
-from core.dependencies import get_current_user, get_user_id_from_request, limiter
+from core.dependencies import get_current_user, limiter, parse_uuid
 from core.models import Friendship as FriendshipModel
 from core.models import Notification as NotificationModel
 from core.models import User as UserModel
@@ -15,7 +15,7 @@ router = APIRouter()
 
 
 @router.post("/users/{username}/friend-request")
-@limiter.limit("10/minute", key_func=get_user_id_from_request)
+@limiter.limit("10/minute")
 async def send_friend_request(request: Request, username: str, user: UserModel = Depends(get_current_user), db: Session = Depends(get_db)):
   addressee = db.query(UserModel).filter(UserModel.username == username).first()
   if not addressee:
@@ -52,8 +52,9 @@ async def send_friend_request(request: Request, username: str, user: UserModel =
 
 
 @router.post("/friendships/{friendship_id}/accept")
-def accept_friend_request(friendship_id: str, user: UserModel = Depends(get_current_user), db: Session = Depends(get_db)):
-  friendship = db.query(FriendshipModel).filter(FriendshipModel.id == uuid.UUID(friendship_id)).first()
+@limiter.limit("30/minute")
+def accept_friend_request(request: Request, friendship_id: str, user: UserModel = Depends(get_current_user), db: Session = Depends(get_db)):
+  friendship = db.query(FriendshipModel).filter(FriendshipModel.id == parse_uuid(friendship_id, "friendship_id")).first()
   if not friendship:
     raise HTTPException(status_code=404, detail="Friendship not found")
   if friendship.addressee_id != user.id:
@@ -66,8 +67,9 @@ def accept_friend_request(friendship_id: str, user: UserModel = Depends(get_curr
 
 
 @router.post("/friendships/{friendship_id}/decline")
-def decline_friend_request(friendship_id: str, user: UserModel = Depends(get_current_user), db: Session = Depends(get_db)):
-  friendship = db.query(FriendshipModel).filter(FriendshipModel.id == uuid.UUID(friendship_id)).first()
+@limiter.limit("30/minute")
+def decline_friend_request(request: Request, friendship_id: str, user: UserModel = Depends(get_current_user), db: Session = Depends(get_db)):
+  friendship = db.query(FriendshipModel).filter(FriendshipModel.id == parse_uuid(friendship_id, "friendship_id")).first()
   if not friendship:
     raise HTTPException(status_code=404, detail="Friendship not found")
   if friendship.addressee_id != user.id:
@@ -124,7 +126,7 @@ def get_friendship_status(username: str, user: UserModel = Depends(get_current_u
 
 @router.delete("/friendships/{friendship_id}")
 def remove_friend(friendship_id: str, user: UserModel = Depends(get_current_user), db: Session = Depends(get_db)):
-  friendship = db.query(FriendshipModel).filter(FriendshipModel.id == uuid.UUID(friendship_id)).first()
+  friendship = db.query(FriendshipModel).filter(FriendshipModel.id == parse_uuid(friendship_id, "friendship_id")).first()
   if not friendship:
     raise HTTPException(status_code=404, detail="Friendship not found")
   if friendship.requester_id != user.id and friendship.addressee_id != user.id: