Phase 1: Critical security fixes - 59 permissions, grants, RLS, mass-assignment, ownership, leaks, MIME

app/routes/users.py

@@ -63,6 +63,14 @@ async def create_user(
     user_id = uuid.UUID(current_user["user_id"])
     role_id = _parse_role_id(body.role_id)
 
+    # Mass-Assignment protection: only system admin can create admin users
+    role = body.role
+    if role == "admin" and not current_user.get("is_system_admin"):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail={"detail": "Only system admin can create admin users", "code": "role_escalation_forbidden"},
+        )
+
     try:
         user = await user_service.create_user(
             db,
@@ -70,7 +78,7 @@ async def create_user(
             body.email,
             body.name,
             body.password,
-            body.role,
+            role,
             role_id,
             body.is_active,
         )
@@ -190,6 +198,13 @@ async def update_user(
                 detail={"detail": "Cannot modify your own role or active status", "code": "self_modification_forbidden"},
             )
 
+    # Mass-Assignment protection: only system admin can change roles to admin
+    if body.role == "admin" and not current_user.get("is_system_admin"):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail={"detail": "Only system admin can assign admin role", "code": "role_escalation_forbidden"},
+        )
+
     # Determine if role_id was explicitly sent (Pydantic v2)
     role_id_sent = "role_id" in body.model_fields_set