Hardening A/2: close the open routes — decorator order, newsletter relay, request edit link, upload directories, hacker/team PII, deposit amount

[gregv]

First of two stacked backend PRs from the hardening plan (frontend-ohack.dev/docs/plans/hardening-security-seo-reliability-2026-09.md, reconciled against #288/#289). This one closes the open doors found in the audit. Every change landed test-first: each new test was run, seen failing for the documented reason, then the fix landed. Every affected frontend caller was traced (headers sent, fields read) before gating anything; frontend PR hardening/1-security-prep is the companion and is safe to deploy in either order.

What was open, what changed

Route / area	Before (verified on develop)	After
GET /api/messages/hackathon/<event>/<type>/checkins	Public. @auth.* sat above @bp.route, so Flask registered the undecorated function; returned full volunteer docs (email, phone, dietary, Slack ids)	@bp.route outermost → 401/403 as intended. Only caller is the admin check-in workbench, which already sends Bearer + X-Org-Id
PATCH /api/problem-statements/events	Same decorator bug → unauthenticated re-linking of problem statements	Gated. The frontend hook now sends X-Org-Id (FE PR-1)
POST /api/newsletter/send_newsletter, preview_newsletter, GET /<user_id>	Auth commented out → open Gmail relay (arbitrary HTML to arbitrary addresses); module built its own init_auth	volunteer.admin-gated via common.auth; POST /<subscribe>/<doc_id> stays per-user on purpose. No frontend caller exists
PATCH /api/messages/create-hackathon/<id> (anonymous capability link)	Raw doc.update(json) (could set status), emailed the BODY's contactEmail before checking the doc existed, None → 500	Body filtered to the 26 form keys (HACKATHON_REQUEST_EDITABLE_FIELDS, lockstep-tested against the frontend form), 404 before any email, confirmation goes to the STORED contact, adminNotes stripped from the public GET, ids are uuid4
POST /api/messages/upload-image	#289 gated teams/<id>/ only; any logged-in user could still write (and overwrite) ohack.dev/logos, event galleries, nonprofit logos… No body size cap	One gate authorize_upload_directory: non-admins → application photo dirs, images, or their event's hackathons/<e>/planning/… (plan editors); admins anywhere; .. → 400; non-admins can't overwrite (409 file_exists). MAX_CONTENT_LENGTH 32 MiB with a JSON 413
GET /api/hacker/applications/<event>	optional_user; 4-key denylist leaked phone, deposit fields, sent_emails, free text	require_user; projected to HACKER_DIRECTORY_FIELDS (every key findteam.js reads + teamCode + isSelected)
Team payloads (/api/messages/team/<id>, /teams, event payload, /api/team/<event>/me, GET /api/team/<hackathon_id>)	Shipped admin_notes, nonprofit_rankings, comments, communication_history; the hackathon list route also shipped full member user docs (email) to any logged-in user	public_team_view strips the internals everywhere; non-admins get slim member profiles on the list route; admins keep full payloads; new admin-only GET /api/team/admin/<teamid> returns the full doc (the frontend prefers it, falls back on 404). mentor_* stays public by design
Deposit webhook	Marked any checkout.session.completed as paid, never comparing the amount	Compares with the event's default_amount_cents BEFORE the already-paid shortcut → underpaid + Slack audit; missing config fails open. Best-effort (PaymentIntent verification is the deferred follow-up)
Shared secrets / GET /news?limit=	== compares; unset env var matched None; int() crash on bad limit	hmac.compare_digest, unset never matches; 400 on non-int, clamped 1..200

Tests (all new, all seen red first)

test/common/test_view_decorator_order.py (AST guard — named exactly the two broken functions), test/common/auth_stubs.py (rejecting stub: 401 without Bearer, 403 without X-Org-Id), api/messages/tests/test_route_gates.py, test_hackathon_requests.py (+7), test_upload_image_gate.py (rewritten cases + planning-editor case), test_upload_overwrite.py, test/common/test_payload_too_large.py, api/volunteers/tests/test_hacker_applications_projection.py, test_deposit_webhook_amount.py, api/teams/tests/test_public_team_projection.py.

Green locally (run per directory with ENVIRONMENT=test, EMPTY Slack/Resend vars and a throwaway service-account JSON in FIREBASE_CERT_CONFIG): messages (each file), volunteers, teams, judging, peer_votes, submissions, test/common. CI still does not run pytest — that lands in the stacked PR-B.

Deploy notes

• Deploy after frontend PR-1 (it adds X-Org-Id to the problem-statement link request and the admin team route fallback). Everything here is otherwise backwards compatible with the current frontend.
• Non-admin planning editors: attachments now upload (they were 401 for lack of a Bearer, then would have been 403); same-name re-attach by a non-admin gets 409 (planning filenames aren't timestamped) — admins can overwrite.
• Follow-ups tracked in the plan: PaymentIntent verification on submit, per-IP rate limiting, except Exception wrappers that swallow RateLimitException.

Test plan (staging, then prod)

1. Anonymous GET /api/messages/hackathon/<event>/hacker/checkins → 401; /admin/hackathons/<event>?section=checkin still loads counts + list as an admin.
2. Anonymous POST /api/newsletter/send_newsletter → 401.
3. From a hackathon-request email link /hack/request/<id>: edit + save works; PATCH with {"status":"approved"} leaves status unchanged; a made-up id → 404 (was 500).
4. As a logged-in non-admin: POST /api/messages/upload-image with directory=ohack.dev/logos → 403; directory=hackers → 200; the hacker application photo upload and the team dashboard project image upload still work; /hack/<event>/plan attachment as a plan editor works, as an admin works.
5. GET /api/hacker/applications/<event> anonymous → 401; authed → objects have no phone; /hack/<event>/findteam renders profiles unchanged.
6. GET /api/messages/team/<id> → no admin_notes; non-admin GET /api/team/<event> → no admin_notes, members without email_address; /admin/hackathons/<event>?section=teams → open a team → admin notes + nonprofit rankings still show (admin route).
7. /judge/<event>/team/<id> and the event page #teams gallery render as before (mentor fields intact).
8. GET /api/messages/news?limit=abc → 400; ?limit=99999 → 200 items max.

🤖 Generated with Claude Code

[gregv]

CodeQL note (for the reviewer): the one remaining "reflected XSS" alert points at return upload_image_to_cdn(request, allow_overwrite=admin) in messages_views.py. That line pre-dates this PR (only the allow_overwrite= argument was added) and the response is a JSON dict ({"success": true, "url": ...}) — the app's after_request forces Content-Type: application/json on every response, so nothing is rendered as HTML. It is the same false-positive class #288 documented ("Flask serializes the returned dicts as JSON"). The two alerts CodeQL raised on genuinely new code in this PR (the gate's error return, the 413 test route) were fixed by answering from constant response tables. Recommend dismissing this last one as a false positive.

All backend checks otherwise green: PYLint ✅, the new Tests job ✅ (554 tests, lands in #291 and already runs on this branch's workflow file when #291 is stacked).