feat(api): production security, cors hardening, latency optimizations, postman artifacts & frontend documentation

ai-patient-onboarding/app/api/documents.py

@@ -7,6 +7,9 @@ from app.database.database import get_db
 from app.schemas.documents import DocumentExtractionResponse
 from app.services.onboarding_service import OnboardingService
 
+from fastapi import APIRouter, Depends, File, HTTPException, Request, UploadFile
+from app.core.security import get_auth_context, AuthContext, check_rate_limit
+
 router = APIRouter(
     prefix="/v1/documents",
     tags=["Medical Documents"],
@@ -20,8 +23,13 @@ router = APIRouter(
 async def upload_medical_document(
     session_id: str,
     file: UploadFile = File(...),
+    req_obj: Request = None,
+    auth: AuthContext = Depends(get_auth_context),
     db: Session = Depends(get_db),
 ):
+    if req_obj and req_obj.client:
+        check_rate_limit(req_obj.client.host, limit=10, window_sec=60)
+
     onboarding_service = OnboardingService()
     gemini_client = GeminiClient()
 
@@ -29,9 +37,28 @@ async def upload_medical_document(
     if not session:
         raise HTTPException(status_code=404, detail="Onboarding session not found")
 
-    state = onboarding_service.get_state(db, session_id)
-    file_bytes = await file.read()
+    # 1b. Verify Session Ownership (IDOR Prevention)
+    if session.patient_id != auth.patient_id and auth.role != "admin":
+        raise HTTPException(
+            status_code=403,
+            detail="Forbidden: You do not have authorization to upload documents to this session.",
+        )
+
+    # Enforce MIME type and File Size Limits (10MB MAX)
+    allowed_mimes = ["image/jpeg", "image/png", "image/webp", "application/pdf"]
     mime_type = file.content_type or "application/pdf"
+    if mime_type not in allowed_mimes:
+        raise HTTPException(
+            status_code=400,
+            detail=f"Unsupported document format: {mime_type}. Allowed formats: JPEG, PNG, WEBP, PDF.",
+        )
+
+    file_bytes = await file.read()
+    if len(file_bytes) > 10 * 1024 * 1024:
+        raise HTTPException(
+            status_code=413,
+            detail="File size exceeds maximum allowed limit of 10MB.",
+        )
 
     patient_context = {
         "id": session.patient_id,