fix(env-vars): require auth on GET, POST and DELETE handlers

[nyxsky404]

What

All three handlers in app/api/env-vars/route.ts had no authentication checks. Any unauthenticated client could GET /api/env-vars?project=x&reveal=1 and receive fully decrypted secret values, or call POST/DELETE to write/remove vars for any project.

Change

Added auth() guard at the top of each handler — same pattern already used in /api/attack-pipeline/route.ts. Returns 401 before touching any data if the session is missing.

Closes #120

Summary by CodeRabbit

• Bug Fixes
  • Enhanced security for environment variable management. All environment variable operations now require user authentication. Unauthenticated requests will receive an authorization error. This ensures sensitive configuration data can only be accessed, modified, or deleted by properly authenticated users, protecting your application's critical settings from unauthorized changes.

[vercel]

@nyxsky404 is attempting to deploy a commit to the Deekshith Gowda HS's projects Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

Warning

Review limit reached

@nyxsky404, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 52 minutes and 12 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 00530cbc-4a01-4747-a4f6-705508d9014d

📥 Commits

Reviewing files that changed from the base of the PR and between 7ec7c24 and 7cc72a6.

📒 Files selected for processing (1)

• app/api/env-vars/route.ts

📝 Walkthrough

Walkthrough

Adds auth() import and session-based authorization guards to the GET, POST, and DELETE handlers in app/api/env-vars/route.ts. Each handler now returns 401 Unauthorized immediately when no authenticated session.user.id is present.

Changes

Env-vars route authentication

Layer / File(s)	Summary
Session auth guard on GET, POST, and DELETE app/api/env-vars/route.ts	Imports auth and inserts an identical session.user.id check at the top of each handler, returning 401 Unauthorized for unauthenticated requests before any env-var logic executes.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

🐇 A rabbit guards the garden gate,
No secret leaks — auth seals the fate!
GET, POST, DELETE all check the key,
401 for those who aren't free.
Hop hop, the secrets stay tucked away! 🔐

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The PR adds auth guards to GET/POST/DELETE handlers as required by issue #120, but lacks the authorized-user validation step for project ownership.	Implement project ownership validation in each handler to verify session.user.id owns the requested project, completing the full security requirement.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title directly and concisely describes the main security fix applied: adding authentication to three env-vars handlers.
Out of Scope Changes check	✅ Passed	All changes are directly aligned with fixing the authentication vulnerability documented in issue #120; no unrelated modifications detected.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@app/api/env-vars/route.ts`:
- Around line 16-19: After verifying the user is authenticated with the session
check in the env-vars route handler, add an authorization check to ensure the
authenticated user has access to the specific project they are requesting. Query
the database to verify the user owns or has permission to access the project
before allowing them to read, create, or delete environment variables. This
authorization gap must be fixed not only in the current GET handler context but
also in the POST and DELETE handlers to prevent any authenticated user from
accessing or modifying environment variables for projects they do not have
access to.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: f7789a98-16b9-4fde-84f3-69f1b964e89a

📥 Commits

Reviewing files that changed from the base of the PR and between bbb3b64 and 7ec7c24.

📒 Files selected for processing (1)

• app/api/env-vars/route.ts