From 1f583621ce1664f5d49643319fbfd05935273189 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:49:07 +0000
Subject: [PATCH] fix(security): prevent privilege escalation during public
 user registration

- Ignore user-supplied role in req.body on POST /api/v1/auth/register to enforce default user role
- Add unit test verifying that self-assigned roles during public registration are ignored

Co-authored-by: SOURAV-ROY <8663561+SOURAV-ROY@users.noreply.github.com>
---
 controllers/authController.js |  4 ++--
 tests/auth.test.js            | 22 ++++++++++++++++++++++
 2 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/controllers/authController.js b/controllers/authController.js
index cd78730..97e0454 100644
--- a/controllers/authController.js
+++ b/controllers/authController.js
@@ -8,14 +8,14 @@ const config = require("../config/config.json");
 // @route           POST /api/v1/auth/register
 // @access          Public
 exports.register = asyncHandler(async (req, res, next) => {
-  const { name, email, password, role } = req.body;
+  const { name, email, password } = req.body;
 
   // Create user ************************************************
+  // Public registration strictly defaults role to "user" to prevent privilege escalation
   const user = await User.create({
     name,
     email,
     password,
-    role,
   });
 
   // Create token ***********************************************
diff --git a/tests/auth.test.js b/tests/auth.test.js
index 557cd7e..30a0f26 100644
--- a/tests/auth.test.js
+++ b/tests/auth.test.js
@@ -26,12 +26,34 @@ describe("Auth Routes", () => {
     await connectDB();
   });
 
+  const publisherEmail = `testpublisher_${Date.now()}@example.com`;
+
   afterAll(async () => {
     // Cleanup
     await User.deleteOne({ email: testUser.email });
+    await User.deleteOne({ email: publisherEmail });
     await mongoose.connection.close();
   });
 
+  it("should ignore requested role on public registration and default to 'user'", async () => {
+    await getCsrfToken();
+    const res = await request(app)
+      .post("/api/v1/auth/register")
+      .set("x-csrf-token", csrfToken)
+      .set("Cookie", cookies)
+      .send({
+        name: "Test Publisher",
+        email: publisherEmail,
+        password: "password123",
+        role: "publisher",
+      });
+    expect(res.statusCode).toEqual(200);
+
+    const createdUser = await User.findOne({ email: publisherEmail });
+    expect(createdUser).not.toBeNull();
+    expect(createdUser.role).toEqual("user");
+  });
+
   it("should register a new user", async () => {
     await getCsrfToken();
     const res = await request(app)