fix(security): resolve 403 Forbidden on voice turn - normalize patient ID matching with PAT-prefix support - Bearer token now prioritized over X-API-Key for identity resolution - Master API key gets admin role for service-to-service bypass - Centralized verify_session_ownership helper across all IDOR checks - Files: security.py, voice_onboarding.py, onboarding.py, documents.py

ai-patient-onboarding/app/api/voice_onboarding.py

@@ -32,7 +32,7 @@ from app.services.patient_submission_service import PatientSubmissionService
 from app.services.result_extraction_service import ResultExtractionService
 from app.services.voice_service import VoiceService
 
-from app.core.security import get_auth_context, AuthContext, check_rate_limit
+from app.core.security import get_auth_context, AuthContext, check_rate_limit, verify_session_ownership
 
 router = APIRouter(
     prefix="/v1/voice-onboarding",
@@ -159,11 +159,7 @@ async def voice_turn(
         )
 
     # 1b. IDOR Session Ownership Check
-    if session.patient_id != auth.patient_id and auth.role != "admin":
-        raise HTTPException(
-            status_code=403,
-            detail="Forbidden: You do not have authorization to access or modify this voice session.",
-        )
+    verify_session_ownership(session.patient_id, auth, detail="Forbidden: You do not have authorization to access or modify this voice session.")
 
     if session.status == "completed":
         session.status = "in_progress"
@@ -393,11 +389,7 @@ async def complete_voice_onboarding(
         )
 
     # 1b. Verify Session Ownership (IDOR Prevention)
-    if session.patient_id != auth.patient_id and auth.role != "admin":
-        raise HTTPException(
-            status_code=403,
-            detail="Forbidden: You do not have authorization to complete this voice session.",
-        )
+    verify_session_ownership(session.patient_id, auth, detail="Forbidden: You do not have authorization to complete this voice session.")
 
     state = onboarding_service.get_state(db, session_id)