[Badri-Rajendran]

Problem

An independent QA pass (extensive live API testing against the running local backend) found orders.py conflating "no session" with "wrong role" on all four routes:

if not current_user.is_authenticated or current_user.role != "customer":
    raise ForbiddenError("Only a customer may place an order")

GET /api/v1/orders with no cookie at all returned 403 {"code":"forbidden"} instead of 401. Every other blueprint gets this right — portfolios.py's _authorize_customer_id is the reference pattern already used correctly elsewhere in the codebase. A frontend that keys "session expired → re-login" off 401 would never trigger re-auth on any orders screen.

Two smaller gaps surfaced by the same pass, unrelated but cheap to fix alongside:

• POST /auth/logout carried no rate limit, unlike every sibling auth route.
• RateLimitedError's bare code="rate_limited" is never what a flask-limiter throttle actually puts on the wire (that path goes through the generic HTTPException handler and emits too_many_requests instead) — misleading to a future reader, though the class itself is genuinely used elsewhere (chat.py's daily query cap, always with its own code= override).

Also: two frontend comments and one README bullet claimed the /lots, /admin/customers*, /admin/kyc-overrides/<id>, and /statements/<period>/export backend routes "don't exist yet" — false, all four are live, registered, and covered by the 799 backend tests. The frontend genuinely hasn't been wired to them yet (still on mockClient, honestly labelled "Simulated" in the UI per docs/requirements/real-vs-simulated-rules.md — that disclosure is correct and unchanged), but the routes exist.

Implementation

• Split each of the four orders.py checks into two: UnauthenticatedError (401) when there's no session, ForbiddenError (403) only once a session exists but the role is wrong.
• POST /auth/logout gets @limiter.limit("60 per minute"), matching /session's own limit.
• Added a comment on RateLimitedError explaining the two 429 paths, rather than removing anything (deleting the class would break chat.py's real usage).
• Corrected the three stale "doesn't exist yet" claims (two frontend comments, one README bullet) to reflect that the backend routes exist and are tested.

Validation

• uv run pytest tests/api/test_orders.py -q → 18/18 passed, including an updated assertion (test_list_orders_with_no_session_is_rejected previously asserted the wrong 403) and a new test (test_get_order_with_no_session_is_rejected, untested for this exact case before).
• Full backend suite run twice — 799 passed, 7 skipped, 2 xpassed both times, no flakes.
• ruff check and mypy --strict clean on every touched file (2 pre-existing, unrelated mypy errors remain elsewhere — confirmed present before this change).
• Live-verified against the running local backend: GET /api/v1/orders with no cookie now returns 401 {"code":"unauthenticated"}.
• Frontend: comment-only changes, npm run lint and npm run build clean.

Security / DB / API impact

• Security: none negative — this narrows the response to the correct status code for an existing, already-enforced check; no new access is granted or denied that wasn't already.
• DB: none.
• API: the four order routes now return 401 instead of 403 for a fully unauthenticated request. Any client correctly distinguishing 401 (re-authenticate) from 403 (forbidden) benefits; nothing currently in this codebase relied on the wrong code.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.