fix(security): resolve BOLA vulnerability in /users handler [vibe-remediation-1785955870]

[SecH0us3]

AI Remediation Auto-Fix (Pass 1 Triage + Pass 2 Remediation)

Pass 1 Triage Result

CONFIRMED

The /users GET endpoint returns sensitive user account data (IDs, names, emails, roles, and in some cases password hashes) without any authorization checks. The code shows no token validation, no header verification, and no authentication logic before returning the user list, confirming...

Pass 2 Remediation Details

The /users endpoint at line 711 returns sensitive user data (emails, roles) without checking for authentication. Following the existing pattern in /api/goods (lines 797-800), the fix adds an authorization header check to require authentication before returning user records.

--- a/demo/src/index.ts
+++ b/demo/src/index.ts
@@ -709,6 +709,10 @@
       }
 
       if (method === "GET" && path === "/users") {
+        const auth = request.headers.get("Authorization");
+        if (!auth) {
+          return new Response("Unauthorized", { status: 401, headers: corsHeaders });
+        }
...

---
*Created automatically by Swazz AI Remediation Engine.*