PUT /owners/{ownerId}/pets/{petId} allows updating pets that do not belong to the specified owner

[sourav-18]

The endpoint PUT /api/owners/{ownerId}/pets/{petId} allows an owner to update a pet that does not belong to them.

Steps to reproduce:

1. Use a valid ownerId
2. Provide a petId that belongs to another owner
3. Send update request

Actual:
The pet is updated successfully

Expected:
The update should be rejected (404 or 403)

[vfedoriv]

Hi @sourav-18,

The app has multiple security issues and only basic authorization (@PreAuthorize).
From this point of view, any authorized user (with the role roles.OWNER_ADMIN) can update other owners’ details, including pets.

Because the app is mostly created for users who are just starting to learn Spring/Spring Boot and serves as a basic REST service for those building front-end apps, I think it should stay as is and not include complex RBAC, etc.

P.S.
We have a security branch, but to be honest, I have no idea of its current state.

[sourav-18]

Thank you @vfedoriv for the clarification!

That makes sense, considering the project’s goal as a learning resource.

I understand that keeping the implementation simple is important here. I’ll keep this in mind for future contributions.

Thanks again for the guidance!