blake-john/agent-config/fullstack-guardian

@router.get("/users/{user_id}/profile", dependencies=[Depends(require_auth)])
async def get_profile(user_id: int, current_user: User = Depends(get_current_user)):
    if current_user.id != user_id:
        raise HTTPException(status_code=403, detail="Forbidden")
    # 参数化查询——不使用原始字符串插值
    row = await db.fetchone("SELECT id, name, email FROM users WHERE id = ?", (user_id,))
    if not row:
        raise HTTPException(status_code=404, detail="Not found")
    return ProfileResponse(**row)   # 显式 schema——不泄漏密码/令牌

async function fetchProfile(userId: number): Promise<Profile> {
  const res = await apiFetch(`/users/${userId}/profile`);   // apiFetch 自动附加认证头
  if (!res.ok) throw new Error(await res.text());
  return res.json();
}
// 客户端输入防护（绝不是唯一的防护）
if (!Number.isInteger(userId) || userId <= 0) throw new Error("Invalid user ID");