Protect experiment reporting with privileged auth and bounded inputs

[llinsss]

Problem

The README says every /api/v1/* route requires a bearer API key, but GET /api/v1/experiments/report and POST /api/v1/experiments/report/export have no authentication dependency. The report scans all student profiles, and the export endpoint also writes derived data to disk. Any network caller can currently trigger both operations.

This is a security boundary regression and creates an avoidable denial-of-service/storage-abuse path even when the returned metrics are aggregated.

Proposed change

• Require authenticated, explicitly privileged access for both experiment routes (prefer an admin or dedicated researcher role rather than any parent/teacher account).
• Centralize the dependency at a router/sub-router boundary so future experiment endpoints inherit the policy by default.
• Validate retention_days with a bounded FastAPI Query (for example 1–365) on both routes.
• Make exports non-publicly triggerable and return only a safe artifact identifier, never a host filesystem path.
• Update the authentication documentation/OpenAPI descriptions to state the role requirement.
• Audit all /api/v1 endpoints with a route-table test that fails when a route is accidentally added without the intended auth dependency. Public endpoints, if any, should be explicitly allowlisted.

Acceptance criteria

• Missing or invalid credentials receive 401 on both experiment endpoints.
• Authenticated accounts without the privileged role receive 403.
• A privileged account can retrieve and export the report.
• Invalid or extreme retention_days values receive 422 without scanning profiles or writing a file.
• Automated tests enumerate the registered API routes and enforce the documented authentication policy.
• README examples and generated OpenAPI security metadata match the implementation.

Relevant code

• api/routes.py (get_experiment_report, export_experiment_report)
• agent/auth.py
• dashboard/experiment_report.py
• README.md

[maztah1]

I’d like to take this on because it’s a straightforward security regression with a broader lesson: fixing the endpoints isn’t enough if the same mistake can happen again.

I’ll enforce privileged authentication at the experiment router level, validate retention_days, make exports return safe artifact IDs, and add route-level tests to prevent unauthenticated /api/v1 endpoints from slipping through.

The goal is a secure fix that also strengthens the API’s security boundary going forward.

[grantfox-oss]

🦊 GrantFox — @maztah1 has been assigned to this issue as part of the Third Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #21)
2. Your PR will be reviewed by the DogStark maintainers

Good luck! Track your progress on GrantFox.

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox as part of the Third Campaign campaign!

@maztah1's PR #38 was approved and merged by @llinsss.

🏆 @maztah1: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (742 total points). Track your full progress on GrantFox.

👏 Great work, @maztah1! Keep contributing to DogStark.