🐐 Several security fixes

backend/routers/notifications.py

@@ -1,13 +1,12 @@
 import uuid
 from datetime import datetime
 
-from fastapi import APIRouter, Depends, HTTPException, WebSocket, WebSocketDisconnect
+from fastapi import APIRouter, Depends, HTTPException, Request, WebSocket, WebSocketDisconnect
 from sqlalchemy.orm import Session
 
 from services import notification_manager
-from core.auth import decode_access_token
 from core.database import get_db
-from core.dependencies import get_current_user
+from core.dependencies import accept_and_authenticate_ws, get_current_user, limiter, parse_uuid
 from core.models import Notification as NotificationModel
 from core.models import User as UserModel
 
@@ -27,12 +26,8 @@ def _serialize_notification(n: NotificationModel) -> dict:
 
 @router.websocket("/ws/notifications")
 async def notifications_endpoint(websocket: WebSocket, db: Session = Depends(get_db)):
-  await websocket.accept()
-
-  token = await websocket.receive_text()
-  user_id = decode_access_token(token)
+  user_id = await accept_and_authenticate_ws(websocket)
   if not user_id:
-    await websocket.close(code=1008)
     return
 
   user = db.query(UserModel).filter(UserModel.id == uuid.UUID(user_id)).first()
@@ -82,13 +77,15 @@ def get_notifications(user: UserModel = Depends(get_current_user), db: Session =
 
 
 @router.post("/notifications/{notification_id}/read")
+@limiter.limit("120/minute")
 def mark_notification_read(
+  request: Request,
   notification_id: str,
   user: UserModel = Depends(get_current_user),
   db: Session = Depends(get_db),
 ):
   n = db.query(NotificationModel).filter(
-    NotificationModel.id == uuid.UUID(notification_id),
+    NotificationModel.id == parse_uuid(notification_id, "notification_id"),
     NotificationModel.user_id == user.id,
   ).first()
   if not n:
@@ -99,13 +96,15 @@ def mark_notification_read(
 
 
 @router.delete("/notifications/{notification_id}")
+@limiter.limit("120/minute")
 def delete_notification(
+  request: Request,
   notification_id: str,
   user: UserModel = Depends(get_current_user),
   db: Session = Depends(get_db),
 ):
   n = db.query(NotificationModel).filter(
-    NotificationModel.id == uuid.UUID(notification_id),
+    NotificationModel.id == parse_uuid(notification_id, "notification_id"),
     NotificationModel.user_id == user.id,
   ).first()
   if not n: