From 032bf93316cdab79d4c75f0dc35fa08c19e13761 Mon Sep 17 00:00:00 2001
From: Toby Moreno <chris.moreno.ctr@km.spaceforce.mil>
Date: Sat, 8 Aug 2026 22:55:37 -0700
Subject: [PATCH] Fix VAmPI book object authorization

Scope book lookups to the authenticated owner so users cannot read another user's secret content by title. Add focused regression coverage.

Signed-off-by: Toby Moreno <chris.moreno.ctr@km.spaceforce.mil>
---
 api_views/books.py       | 33 ++++++++++-----------------------
 tests/test_books_auth.py |  8 ++++++++
 2 files changed, 18 insertions(+), 23 deletions(-)
 create mode 100644 tests/test_books_auth.py

diff --git a/api_views/books.py b/api_views/books.py
index f153b1c..0f7c6b3 100644
--- a/api_views/books.py
+++ b/api_views/books.py
@@ -47,26 +47,13 @@ def get_by_title(book_title):
     if "error" in resp:
         return Response(error_message_helper(resp), 401, mimetype="application/json")
     else:
-        if vuln:  # Broken Object Level Authorization
-            book = Book.query.filter_by(book_title=str(book_title)).first()
-            if book:
-                responseObject = {
-                    'book_title': book.book_title,
-                    'secret': book.secret_content,
-                    'owner': book.user.username
-                }
-                return Response(json.dumps(responseObject), 200, mimetype="application/json")
-            else:
-                return Response(error_message_helper("Book not found!"), 404, mimetype="application/json")
-        else:
-            user = User.query.filter_by(username=resp['sub']).first()
-            book = Book.query.filter_by(user=user, book_title=str(book_title)).first()
-            if book:
-                responseObject = {
-                    'book_title': book.book_title,
-                    'secret': book.secret_content,
-                    'owner': book.user.username
-                }
-                return Response(json.dumps(responseObject), 200, mimetype="application/json")
-            else:
-                return Response(error_message_helper("Book not found!"), 404, mimetype="application/json")
\ No newline at end of file
+        user = User.query.filter_by(username=resp['sub']).first()
+        book = Book.query.filter_by(user=user, book_title=str(book_title)).first()
+        if book:
+            responseObject = {
+                'book_title': book.book_title,
+                'secret': book.secret_content,
+                'owner': book.user.username
+            }
+            return Response(json.dumps(responseObject), 200, mimetype="application/json")
+        return Response(error_message_helper("Book not found!"), 404, mimetype="application/json")
diff --git a/tests/test_books_auth.py b/tests/test_books_auth.py
new file mode 100644
index 0000000..614388c
--- /dev/null
+++ b/tests/test_books_auth.py
@@ -0,0 +1,8 @@
+from pathlib import Path
+
+
+def test_book_lookup_is_scoped_to_authenticated_owner():
+    source = Path("api_views/books.py").read_text()
+    section = source[source.index("def get_by_title"):]
+    assert "Book.query.filter_by(user=user" in section
+    assert "if vuln:  # Broken Object Level Authorization" not in section