feat(security): enforce role + subject ownership checks

BackendAcademy/package.json

@@ -24,6 +24,7 @@
     "class-transformer": "^0.5.1",
     "class-validator": "^0.14.4",
     "file-type": "^19.6.0",
+    "ioredis": "^5.11.1",
     "joi": "^18.0.2",
     "multer": "^2.2.0",
     "prom-client": "^15.1.3",

BackendAcademy/src/admin/admin.controller.ts

@@ -1,15 +1,18 @@
-import { Controller, Get } from '@nestjs/common';
+import { Controller, Get, UseGuards } from '@nestjs/common';
 import { AdminService } from './admin.service';
 import { LocalizationService } from '../i18n/localization.service';
+import { JwtAdminGuard, RolesGuard, Roles, UserRole } from '../auth';
 
 @Controller('admin')
+@UseGuards(JwtAdminGuard, RolesGuard)
 export class AdminController {
   constructor(
     private readonly adminService: AdminService,
     private readonly l10n: LocalizationService,
   ) {}
 
   @Get('analytics/summary')
+  @Roles(UserRole.ADMIN)
   async getDashboardSummary() {
     const summary = await this.adminService.getDashboardSummary();
     return {
@@ -23,4 +26,4 @@ export class AdminController {
       data: summary,
     };
   }
-}
+}

BackendAcademy/src/admin/admin.module.ts

@@ -2,9 +2,10 @@ import { Module } from '@nestjs/common';
 import { AdminController } from './admin.controller';
 import { AdminService } from './admin.service';
 import { SubmissionsModule } from '../submissions/submissions.module';
+import { AuthModule } from '../auth/auth.module';
 
 @Module({
-  imports: [SubmissionsModule],
+  imports: [SubmissionsModule, AuthModule],
   controllers: [AdminController],
   providers: [AdminService],
   exports: [AdminService],

BackendAcademy/src/ai/ai.service.ts

@@ -350,59 +350,6 @@ export class AiService {
       );
     }
 
-
-  async getRecommendation(userId: string): Promise<AiRecommendationResponse> {
-    const snapshot = this.redisService
-      ? await this.redisService.getUserSnapshot(userId)
-      : null;
-
-    if (!snapshot) {
-      return {
-        userId,
-        recommendations: [],
-        explainability: {
-          factors: ['insufficient_data'],
-          confidence: 0.1,
-          userSignalAge: 0,
-          signalsUsed: [],
-          modelVersion: 'rustacademy-recommender-v2',
-        },
-        generatedAt: new Date(),
-      };
-    }
-
-    const explainability = this.redisService
-      ? await this.redisService.getRecommendationExplainability(userId)
-      : null;
-
-    const recommendedCourses = snapshot.recentCourses.length > 0
-      ? snapshot.recentCourses.slice(0, 3)
-      : ['rust-fundamentals', 'smart-contracts-101', 'stellar-basics'];
-
-    const recommendations = recommendedCourses.map((courseId, index) => ({
-      courseId,
-      score: Math.max(0, 1 - index * 0.2 - (snapshot.interactionCount > 0 ? 0 : 0.3)),
-      reason: explainability?.factors[index] || 'course_popularity',
-    }));
-
-    if (this.monitoringService) {
-      this.monitoringService.recordDomainEvent('recommendation_generated', 'ai');
-    }
-
-    return {
-      userId,
-      recommendations,
-      explainability: explainability || {
-        factors: [],
-        confidence: 0.1,
-        userSignalAge: 0,
-        signalsUsed: [],
-        modelVersion: 'rustacademy-recommender-v2',
-      },
-      generatedAt: new Date(),
-    };
-  }
-
     const lines = code.split('\n').filter((l) => l.trim().length > 0).length;
     const hasComments = code.includes('//') || code.includes('/*');
     const hasFunctions = code.includes('fn ');
@@ -466,6 +413,58 @@ export class AiService {
     };
   }
 
+  async getRecommendation(userId: string): Promise<AiRecommendationResponse> {
+    const snapshot = this.redisService
+      ? await this.redisService.getUserSnapshot(userId)
+      : null;
+
+    if (!snapshot) {
+      return {
+        userId,
+        recommendations: [],
+        explainability: {
+          factors: ['insufficient_data'],
+          confidence: 0.1,
+          userSignalAge: 0,
+          signalsUsed: [],
+          modelVersion: 'rustacademy-recommender-v2',
+        },
+        generatedAt: new Date(),
+      };
+    }
+
+    const explainability = this.redisService
+      ? await this.redisService.getRecommendationExplainability(userId)
+      : null;
+
+    const recommendedCourses = snapshot.recentCourses.length > 0
+      ? snapshot.recentCourses.slice(0, 3)
+      : ['rust-fundamentals', 'smart-contracts-101', 'stellar-basics'];
+
+    const recommendations = recommendedCourses.map((courseId, index) => ({
+      courseId,
+      score: Math.max(0, 1 - index * 0.2 - (snapshot.interactionCount > 0 ? 0 : 0.3)),
+      reason: explainability?.factors[index] || 'course_popularity',
+    }));
+
+    if (this.monitoringService) {
+      this.monitoringService.recordDomainEvent('recommendation_generated', 'ai');
+    }
+
+    return {
+      userId,
+      recommendations,
+      explainability: explainability || {
+        factors: [],
+        confidence: 0.1,
+        userSignalAge: 0,
+        signalsUsed: [],
+        modelVersion: 'rustacademy-recommender-v2',
+      },
+      generatedAt: new Date(),
+    };
+  }
+
   // ──────────────────────────────────────────────────────────────────
   // Chat history management (#372, #373)
   // ──────────────────────────────────────────────────────────────────

BackendAcademy/src/analytics/analytics.service.ts

@@ -404,7 +404,6 @@ export class AnalyticsService {
       totalDiscrepanciesFound: totalDiscrepancies,
     };
   }
-}
 
   // ── Notification batching analytics (#386) ────────────────
 

BackendAcademy/src/assets/assets.module.ts

@@ -1,7 +1,7 @@
-import {'Module' } from '@nestjs/common';
-import {'AssetsController' } from './assets.controller';
-import {'AssetsService' } from './assets.service';
-import {'SecurityModule' } from '../security/security.module';
+import { Module } from '@nestjs/common';
+import { AssetsController } from './assets.controller';
+import { AssetsService } from './assets.service';
+import { SecurityModule } from '../security/security.module';
 
 /**
  * Module exposing asset upload, metadata, download, and delete endpoints

BackendAcademy/src/audit/audit.service.ts

@@ -39,7 +39,7 @@ export class AuditLogService {
 
     // Provide structured output to the standard logger without secrets
     this.logger.log(
-      `Audit: ${event.action} | Actor: ${event.actor ?? '-'} | Outcome: ${event.outcome} | Session: ${event.session ?? '-'} | Correlation: ${correlation}`,
+`Audit: ${event.action} | Actor: ${event.actor ?? '-'} | Outcome: ${event.outcome} | Session: ${event.session ?? '-'} | Correlation: ${correlation}`,
     );
 
     return log;

BackendAcademy/src/auth/auth-session.controller.ts

@@ -1,7 +1,6 @@
 import {
   Body,
   Controller,
-  Delete,
   Get,
   HttpCode,
   HttpStatus,
@@ -68,9 +67,9 @@ export class AuthSessionController {
 
   @Get(':userId')
   @HttpCode(HttpStatus.OK)
-  getActiveSessions(
+  async getActiveSessions(
     @Param('userId') userId: string,
-  ): Omit<Session, 'refreshTokenHash'>[] {
+  ): Promise<Omit<Session, 'refreshTokenHash'>[]> {
     return this.authSessionService.getActiveSessions(userId);
   }