🛡️ Sentinel: [HIGH] Fix IDOR and Runtime Crashes in Commerce Engine

[dcplatforms]

🛡️ Sentinel Security Report

🚨 Severity: HIGH

💡 Vulnerability:

1. Broken Object Level Authorization (BOLA/IDOR): The /billing/calculate/:sessionId and /invoices/generate endpoints in the Commerce Engine lacked proper validation that the target resources (charging sessions or fleets) belonged to the authenticated user.
2. Logic Errors & Runtime Crashes: The /invoices/generate endpoint was completely non-functional due to undefined variables. Additionally, the startServices bootstrap function contained an insecure block of code that used HTTP response objects (res) outside of a request context, causing the service to crash immediately on startup.
3. Stability Blockers: A SyntaxError in the Token Engine service (duplicate function declaration) prevented the test suite from running.

🎯 Impact:

• An authenticated user could potentially calculate billing costs for any charging session in the system or generate invoices for other fleets by manipulating the fleet_id or sessionId.
• The Commerce Engine was unable to start successfully in its previous state due to the bootstrap crash.
• Security-critical rewards logic in the Token Engine could not be verified by CI/CD due to the syntax error.

🔧 Fix:

• Added explicit fleet_id checks against the verified JWT payload in all sensitive Commerce Engine endpoints.
• Integrated proper InvoicingService and BillingService logic into the API handlers.
• Cleaned up the startServices function to remove non-functional and crashing code.
• Removed the duplicate extractSiteId declaration in the Token Engine.

✅ Verification:

• Token Engine: npm test in services/10-token-engine passed 23/23 tests.
• Syntax: Both modified services verified via node -c.
• Logic: Manually reviewed authorization flow and database joins in services/09-commerce-engine/index.js.

---

PR created automatically by Jules for task 4186013490316551872 started by @dcplatforms

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.