fix: block framework endpoints

[s-aga-r]

No description provided.

[Copilot]

Pull request overview

This PR enables authentication and authorization controls for the mail application by activating the auth_hooks configuration and implementing path-based access validation to restrict non-System Users from accessing certain framework endpoints.

Key Changes:

• Enabled the auth_hooks in the mail app configuration to activate authentication validation
• Implemented path-based authorization logic that blocks framework API endpoints for non-System Users while allowing specific whitelisted paths

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 6 comments.

File	Description
mail/hooks.py	Uncommented the auth_hooks configuration to enable the mail.auth.validate authentication hook
mail/auth.py	Added new authentication validation module with path-based access control logic for restricting non-System Users from accessing framework endpoints

---

Critical Issues Identified:

The implementation contains several critical security vulnerabilities that should be addressed:

1. Logic flaw allowing unrestricted access: Paths that don't start with "/api/" bypass validation entirely (except for explicit DENIED_PATHS), potentially allowing unauthorized access to non-API routes.

2. Path normalization bypass vulnerability: The code doesn't normalize paths before validation, allowing potential bypasses through double slashes, path traversal, or URL encoding.

3. Missing guest user handling: The code doesn't explicitly check for Guest users before database queries, which could lead to unexpected behavior.

4. Insufficient documentation: The security-critical function and constants lack documentation explaining the security model and usage guidelines.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.