fix(security): close IDOR in getCurrentUserProfile

[chriskehayias]

Summary

Closes an IDOR in getCurrentUserProfile, plus the two cleanups that fell out of it.

getCurrentUserProfile(id) accepted a caller-supplied MP User_GUID behind only a "a session exists" check. A server action is a callable POST endpoint whose payload the caller shapes, so the parameter was reachable regardless of what the one legitimate call site passed. Any authenticated MP user could read any other user's name, email, mobile phone, photo GUID, and full role and user-group list.

This is the F1 pattern from the downstream hardening playbook — "a session proves only that some MP user signed in" — surviving inside the one file CLAUDE.md rule 12 blesses as a carve-out. The carve-out is justified as "the user's own profile"; nothing enforced own.

Approach

The parameter is removed, not validated. A value that must equal a server-derived one has no reason to cross the wire, and deleting it makes the carve-out enforceable by the type signature rather than by reviewer vigilance.

The guard also moves from session?.user?.id to a non-empty userGuid check — user.id is Better Auth's internal ID and doesn't prove an MP identity exists, while userGuid is required: true in auth.ts, so keying on it fails closed.

Commits

Commit	What
0e135f6	The IDOR fix + adversarial tests
9322bae	Gate generateSampleTemplate; delete dead getUserIdByGuid / getCurrentUserIdFromSession
64d9db7	Sync ~25 reference sites; repair pre-existing citation drift

generateSampleTemplate was an ungated 'use server' action — an undocumented fifth carve-out where rule 12 allows four. It reads no MP data, so it leaked nothing; it takes the address-label tool's gate rather than a written exemption, keeping the list at four.

getCurrentUserIdFromSession was dead code worth removing on its own terms: an exported endpoint taking a session object as a parameter, whose docstring claimed to be "the canonical way for server actions to obtain $userId" — contradicting rule 13 and authorizationService.ts, which state it comes only from the gate's return value.

Verification

• Negative control (the one that matters): restoring the vulnerable body fails 4 of 6 cases, the IDOR case reporting expected [SESSION_GUID], received ["attacker-supplied-guid"]. The tests are protective, not merely passing.
• 805 tests pass (809 less the 4 deleted), eslint . clean, npm run build green.
• Class sweep: all 14 non-test 'use server' files checked — no other action accepts caller-supplied identity.

Reviewer notes

• The regression test calls the action through a cast that forges an argument, testing the adversarial shape rather than the type signature.
• The docs commit repairs pre-existing drift: an error-catalog row for a throw that no longer exists anywhere in src/, an Error('Unauthorized') row citing eight sites when seven no longer throw it, and a stale auth-wrapper.tsx implementation block that omitted its /session-error redirect.

Known gap (follow-up)

~20 reference mentions of UserService.getUserIdByGuid survive, several instructing readers to resolve $userId through it. That method no longer exists after this PR, and the instruction contradicted rule 13 even before deletion. Scoped to a follow-up sweep rather than widened here.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!