Product route: No authentication/authorization on write endpoints #14
Description
Severity: Medium
Category: Security
Description
In api/src/routes/product.ts, the POST, PUT, and DELETE endpoints have no authentication or authorization checks. Per the project's auth design (@github.com emails grant admin access), write operations should be gated behind admin authorization.
Suggested Fix
Add middleware to verify authenticated user has admin privileges before allowing mutating operations on products.
Affected File
api/src/routes/product.ts(POST, PUT, DELETE handlers)