Harden API with rate limits, DeviceId isolation, and tighter CORS.

Limit auth/read/write JSON traffic per IP while leaving audio streams unrestricted; close JWT+deviceId IDOR and add path/input guards.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/TafsirQuran.Api/Endpoints/FavoriteEndpoints.cs

@@ -1,6 +1,6 @@
 using System.Security.Claims;
 using Microsoft.EntityFrameworkCore;
-using TafsirQuran.Api.Auth;
+using TafsirQuran.Api.Security;
 using TafsirQuran.Domain.Entities;
 using TafsirQuran.Infrastructure.Persistence;
 using TafsirQuran.Shared.Dtos;
@@ -9,37 +9,55 @@ namespace TafsirQuran.Api.Endpoints;
 
 public static class FavoriteEndpoints
 {
-    public static RouteGroupBuilder MapFavoriteEndpoints(this WebApplication app)
+    public static IEndpointRouteBuilder MapFavoriteEndpoints(this WebApplication app)
     {
         var group = app.MapGroup("/api/favorites/ayahs");
 
-        group.MapGet("/", async (string deviceId, ClaimsPrincipal user, AppDbContext db, CancellationToken ct) =>
+        group.MapGet("/", async (string? deviceId, ClaimsPrincipal user, AppDbContext db, CancellationToken ct) =>
         {
-            var userId = JwtTokenService.GetUserId(user);
-            var items = await db.AyahFavorites.AsNoTracking()
+            if (!EndpointSecurity.TryResolveOwner(user, deviceId, out var userId, out var deviceKey, out var error))
+                return error!;
+
+            var query = db.AyahFavorites.AsNoTracking()
                 .Include(f => f.Surah)
                 .Include(f => f.Tafsir)
-                .Where(f => f.DeviceId == deviceId || (userId.HasValue && f.UserId == userId))
-                .OrderByDescending(f => f.CreatedAt)
-                .ToListAsync(ct);
+                .AsQueryable();
+
+            query = userId.HasValue
+                ? query.Where(f => f.UserId == userId)
+                : query.Where(f => f.DeviceId == deviceKey);
+
+            var items = await query.OrderByDescending(f => f.CreatedAt).ToListAsync(ct);
 
             return Results.Ok(items.Select(f => new AyahFavoriteDto(
                 f.Id, f.TafsirId, f.Tafsir.Slug, f.SurahId, f.Surah.NameFa, f.AyahNumber, f.CreatedAt)).ToList());
-        });
+        }).RequireRateLimiting("read");
 
         group.MapPost("/", async (ToggleAyahRequest request, ClaimsPrincipal user, AppDbContext db, CancellationToken ct) =>
         {
-            var userId = JwtTokenService.GetUserId(user);
-            var exists = await db.AyahFavorites.AnyAsync(f =>
-                f.TafsirId == request.TafsirId &&
-                f.SurahId == request.SurahNumber &&
-                f.AyahNumber == request.AyahNumber &&
-                (f.DeviceId == request.DeviceId || (userId.HasValue && f.UserId == userId)), ct);
+            if (!EndpointSecurity.TryResolveOwner(user, request.DeviceId, out var userId, out var deviceKey, out var error))
+                return error!;
+
+            if (!EndpointSecurity.IsValidSurahAyah(request.SurahNumber, request.AyahNumber))
+                return Results.BadRequest(new { error = "invalid_ayah" });
+
+            var exists = userId.HasValue
+                ? await db.AyahFavorites.AnyAsync(f =>
+                    f.TafsirId == request.TafsirId &&
+                    f.SurahId == request.SurahNumber &&
+                    f.AyahNumber == request.AyahNumber &&
+                    f.UserId == userId, ct)
+                : await db.AyahFavorites.AnyAsync(f =>
+                    f.TafsirId == request.TafsirId &&
+                    f.SurahId == request.SurahNumber &&
+                    f.AyahNumber == request.AyahNumber &&
+                    f.DeviceId == deviceKey, ct);
+
             if (exists) return Results.NoContent();
 
             db.AyahFavorites.Add(new AyahFavorite
             {
-                DeviceId = request.DeviceId,
+                DeviceId = deviceKey ?? request.DeviceId.Trim(),
                 UserId = userId,
                 TafsirId = request.TafsirId,
                 SurahId = request.SurahNumber,
@@ -47,21 +65,30 @@ public static class FavoriteEndpoints
             });
             await db.SaveChangesAsync(ct);
             return Results.Created($"/api/favorites/ayahs/{request.SurahNumber}/{request.AyahNumber}", null);
-        });
+        }).RequireRateLimiting("write");
 
         group.MapDelete("/{surahNumber:int}/{ayahNumber:int}", async (
-            int surahNumber, int ayahNumber, Guid tafsirId, string deviceId, ClaimsPrincipal user, AppDbContext db, CancellationToken ct) =>
+            int surahNumber, int ayahNumber, Guid tafsirId, string? deviceId, ClaimsPrincipal user, AppDbContext db, CancellationToken ct) =>
         {
-            var userId = JwtTokenService.GetUserId(user);
-            var items = await db.AyahFavorites
-                .Where(f => f.TafsirId == tafsirId && f.SurahId == surahNumber && f.AyahNumber == ayahNumber &&
-                            (f.DeviceId == deviceId || (userId.HasValue && f.UserId == userId)))
-                .ToListAsync(ct);
+            if (!EndpointSecurity.TryResolveOwner(user, deviceId, out var userId, out var deviceKey, out var error))
+                return error!;
+
+            if (!EndpointSecurity.IsValidSurahAyah(surahNumber, ayahNumber))
+                return Results.BadRequest(new { error = "invalid_ayah" });
+
+            var items = userId.HasValue
+                ? await db.AyahFavorites
+                    .Where(f => f.TafsirId == tafsirId && f.SurahId == surahNumber && f.AyahNumber == ayahNumber && f.UserId == userId)
+                    .ToListAsync(ct)
+                : await db.AyahFavorites
+                    .Where(f => f.TafsirId == tafsirId && f.SurahId == surahNumber && f.AyahNumber == ayahNumber && f.DeviceId == deviceKey)
+                    .ToListAsync(ct);
+
             db.AyahFavorites.RemoveRange(items);
             await db.SaveChangesAsync(ct);
             return Results.NoContent();
-        });
+        }).RequireRateLimiting("write");
 
-        return group;
+        return app;
     }
 }