Contributor

Summary

• Added role validation for ?roles= query parameter in VerifyEmail HTTP handler
• Roles are now checked against user's stored roles using validators.IsValidRoles()
• Prevents privilege escalation via URL manipulation

Test plan

• Verify email verification with no roles param works (uses user's stored roles)
• Verify email verification with valid roles subset works
• Verify email verification with unauthorized roles returns 400

Fixes #486

Roles from the query string were used without validation against the
user's stored roles, allowing privilege escalation via URL manipulation.

Fixes #486

Merge branch 'main' into fix/verify-email-handler-role-validation

695b12b

test: add unit tests for role validation

aa70796