Jun 28 - Code optimize - Fix Critical/High issues

app/routes/auth.py

@@ -524,6 +524,7 @@ def reset_password(token):
 # ── MT-4: Superadmin impersonation ────────────────────────────────────────────
 
 @bp.route('/impersonate')
+@login_required
 def impersonate_entry():
     """
     Validate a superadmin impersonation token and bind the session to a tenant.
@@ -531,7 +532,8 @@ def impersonate_entry():
         GET /auth/impersonate?token=<signed_token>
     Sets session['impersonating_tenant_id'] which the tenancy middleware reads
     to short-circuit normal Host resolution for the duration of the session.
-    This route is CSRF-exempt by nature — the HMAC token already provides auth.
+    Requires an authenticated user so the HMAC token alone cannot grant access
+    to an anonymous session.
     """
     from flask import session as flask_session
     token = request.args.get('token', '')
@@ -550,6 +552,11 @@ def impersonate_entry():
     tenant_id     = payload.get('tid')
     superadmin_id = payload.get('said')
 
+    if tenant_id is None:
+        logger.warning('AUTH | impersonate_invalid | reason=missing tid in payload')
+        flash('Invalid impersonation token (missing tenant).', 'danger')
+        return redirect(url_for('auth.login'))
+
     flask_session['impersonating_tenant_id']     = tenant_id
     flask_session['impersonating_superadmin_id'] = superadmin_id