Josh Creek 3aa716b941 fix(#55): implement user data isolation to prevent cross-user data access ...

- Add server-side authentication validation for all protected API endpoints
- Create auth utility with requireAuth() function for session validation
- Update CombinedDataRepository to filter data by authenticated user ID
- Add findByUserId() method to CatchRecordRepository for user-specific queries
- Replace client-side userId parameters with server-side session extraction
- Use MongoDB aggregation with $lookup and $expr for secure user filtering
- Return 401 errors for unauthenticated requests
- Fix critical security vulnerability where users could see others' catch records

Fixes: User data isolation bug where one user's catch records were used for everyone
Security: Prevents unauthorized access to other users' Pokemon tracking data

2025-07-26 16:34:19 +01:00

..

CatchRecordRepository.ts

fix(#55): implement user data isolation to prevent cross-user data access

2025-07-26 16:34:19 +01:00

CombinedDataRepository.ts

fix(#55): implement user data isolation to prevent cross-user data access

2025-07-26 16:34:19 +01:00

PokedexEntryRepository.ts

feat(#5): Add ability to seed pokedex entry data

2024-04-08 20:08:53 +01:00

RegionGameMappingRepository.ts

feat(*): Add region-game mappings

2024-07-14 19:45:06 +01:00