Phase 3 harden CSRF invalid POST and work access handling

app/modules/work_detail/ui.py

@@ -14,6 +14,12 @@ from app.modules.work_detail.service import get_task_for_action, load_unified_en
 router = APIRouter(prefix="/work", tags=["unified-work-detail-ui"])
 
 
+def _csrf_rejected(request: Request):
+    from app.core.http_responses import forbidden_response
+    return forbidden_response(request, "CSRF validation failed")
+
+
+
 def _base_ctx(request: Request, db, user, **ctx):
     base = {
         "request": request,
@@ -56,6 +62,15 @@ def unified_work_board(request: Request):
         db.close()
 
 
+
+
+# Phase 3 security hardening: /work/engagements is a listing alias, not a create endpoint.
+# Existing engagement creation remains in the services module.
+@router.post("/engagements")
+def unified_engagements_post_rejected(request: Request):
+    return _csrf_rejected(request)
+
+
 @router.get("/engagements")
 def unified_engagements_index(request: Request):
     """Compatibility alias for /work/engagements.
@@ -79,6 +94,8 @@ def unified_engagement_detail(request: Request, engagement_id: int):
         user = get_current_user(request, db=db)
         if not user:
             return RedirectResponse(url="/login", status_code=303)
+        if "Client" in set(get_user_roles(db, user.id)):
+            return forbidden_response(request, "Access denied")
         detail = load_unified_engagement_detail(db, request=request, user=user, engagement_id=engagement_id)
         if not detail:
             return not_found_response(request, "Work engagement not found or access denied")
@@ -92,7 +109,10 @@ def unified_engagement_detail(request: Request, engagement_id: int):
 
 @router.post("/tasks/{task_id}/status")
 async def unified_task_status_update(request: Request, task_id: int, csrf_token: str = Form(...), status: str = Form(...), priority: str = Form("")):
-    validate_csrf(request, csrf_token)
+    try:
+        validate_csrf(request, csrf_token)
+    except PermissionError:
+        return _csrf_rejected(request)
     db = CommonSessionLocal()
     try:
         user = get_current_user(request, db=db)
@@ -122,7 +142,10 @@ async def unified_task_comment_add(
     visibility: str = Form("internal"),
     message: str = Form(""),
 ):
-    validate_csrf(request, csrf_token)
+    try:
+        validate_csrf(request, csrf_token)
+    except PermissionError:
+        return _csrf_rejected(request)
     db = CommonSessionLocal()
     try:
         user = get_current_user(request, db=db)