fix: enforce authentication on sensitive backend routes

[code-with-kishan]

🔐 Enforce Authentication on Sensitive Backend Routes

This pull request improves backend security by enforcing explicit authentication on sensitive API endpoints that previously relied on implicit or upstream checks.

🚨 Problem

Several backend routes handling critical operations (recording uploads, rendering jobs, and email invitations) did not explicitly enforce authentication at the route level.
If middleware configuration was bypassed or misapplied, these endpoints could be accessed without proper authorization.

✅ What’s Changed

Authentication is now explicitly enforced using authenticateToken middleware on sensitive routes:

• Recording APIs

  • /upload-chunk
  • /upload-complete-video
  • /merge-chunks
  • /session/:sessionId/videos
  • /recordings/:participantId

• Render API

  • /render

• Email APIs

  • /send-invitation
  • /send-bulk-invitations

🛡️ Security Impact

• Prevents unauthorized access to sensitive backend functionality
• Adds defense-in-depth at the route level
• Improves reliability and maintainability
• Aligns with OWASP A01 – Broken Access Control

🔗 Related Issue

Fixes #62

🏷️ Program

ECWoC’26

---

🙌 Notes for Reviewers

• No breaking API changes
• Follows existing authentication patterns
• Changes are limited to route-level enforcement only

🙋 Request for Review

Hi @anothercoder-nik 👋
I’ve implemented authentication enforcement for the sensitive backend routes as discussed in Issue #62.

If any changes, improvements, or adjustments are required, please let me know — I’d be happy to update the PR accordingly.
Looking forward to your feedback. Thank you!

Thank you for reviewing! 🚀