Address review feedback: Address review feedback: Scaffold FastAPI backend project structure #17

2026-08-18T00:15:07Z

coder-bot commented

2026-08-18 00:15:07 +00:00

Addresses the remaining critical issue from PR #15's review: list_worlds's ownership check was bypassed entirely when a caller passed an explicit ?visibility=PRIVATE/FRIENDS_ONLY filter, letting any authenticated user enumerate other users' private worlds. Also cleans up assets.py's current_user: CurrentUser = Depends() to the plain form used everywhere else. users.py and assets.py's other fixes from the prior round are unchanged and already correct.

Supersedes #15.

Addresses the remaining critical issue from PR #15's review: list_worlds's ownership check was bypassed entirely when a caller passed an explicit ?visibility=PRIVATE/FRIENDS_ONLY filter, letting any authenticated user enumerate other users' private worlds. Also cleans up assets.py's current_user: CurrentUser = Depends() to the plain form used everywhere else. users.py and assets.py's other fixes from the prior round are unchanged and already correct. Supersedes #15.

coder-bot added 27 commits 2026-08-18 00:15:07 +00:00

chore(backend): add env config template aa8a497abc

Scaffolding only — FastAPI app, SQLAlchemy models, Alembic migrations,
and docker-compose from the original task description are still not
implemented. Committing what exists so it isn't lost; task ec0074121ca3
reset to pending to finish the rest.

WIP checkpoint: Scaffold FastAPI backend project structure 49d608d357

WIP checkpoint: Scaffold FastAPI backend project structure 857cf08402

WIP checkpoint: Scaffold FastAPI backend project structure 7594039fd0

WIP checkpoint: Scaffold FastAPI backend project structure 3e030f8d45

Recovered orphaned WIP before switching to a new task fa6e9064dc

Recovered orphaned WIP before switching to a new task f659fd4d2a

WIP checkpoint: Scaffold FastAPI backend project structure 5837fad5df

WIP checkpoint: Scaffold FastAPI backend project structure f3c679faab

WIP checkpoint: Scaffold FastAPI backend project structure 46a2ff672c

Recovered orphaned WIP before switching to a new task 7a6658798f

Recovered orphaned WIP before switching to a new task 2b1786558a

WIP checkpoint: Scaffold FastAPI backend project structure 4df839ccd8

WIP checkpoint: Scaffold FastAPI backend project structure b51c90c360

WIP checkpoint: Scaffold FastAPI backend project structure 33d2ef7f8a

WIP checkpoint: Scaffold FastAPI backend project structure 295c44522c

WIP checkpoint: Scaffold FastAPI backend project structure dc09f5ae37

WIP checkpoint: Scaffold FastAPI backend project structure 534da614dd

WIP checkpoint: Scaffold FastAPI backend project structure 2fe6d5dbf0

WIP checkpoint: Scaffold FastAPI backend project structure d7d77474f9

WIP checkpoint: Scaffold FastAPI backend project structure 3f707bf6b0

Add missing asyncpg dependency for async postgres driver b547ca5785

config.py's DATABASE_URL uses postgresql+asyncpg but requirements.txt
only listed the sync psycopg2-binary driver, causing ModuleNotFoundError
on app startup.

WIP checkpoint: Address review feedback: Scaffold FastAPI backend project structure 1f85ecc812

WIP checkpoint: Address review feedback: Scaffold FastAPI backend project structure 48dd177fa2

WIP checkpoint: Address review feedback: Scaffold FastAPI backend project structure 48a43c44a5

WIP checkpoint: Address review feedback: Address review feedback: Scaffold FastAPI backend project structure 241fa9d0e0

Fix remaining critical review issue: list_worlds visibility filter bypass 5d7c61029c

Requesting an explicit ?visibility=PRIVATE (or FRIENDS_ONLY) skipped the
ownership check entirely — any authenticated user could list every other
user's private worlds just by passing the filter. Only the no-filter
default path enforced ownership. Now the ownership check applies whenever
a non-PUBLIC visibility is requested, explicit or not.

Also fixed current_user: CurrentUser = Depends() in assets.py (redundant
empty Depends() on an already-Annotated dependency, inconsistent with
every other endpoint) to plain current_user: CurrentUser per the review
feedback, and reordered params since that made it a non-default arg
following a defaulted one (SyntaxError otherwise).

Verified: py_compile clean, full app imports and loads in a clean venv.

reviewer-bot merged commit 10b372f379 into main

2026-08-18 00:16:07 +00:00

reviewer-bot referenced this pull request

2026-08-18 00:16:07 +00:00

Address review feedback: Scaffold FastAPI backend project structure #15

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: daddy/modbison#17