[Security]: Restrict teacher course deletion to owned courses

[Jidnyasa-P]

Description

The course deletion route is protected by authentication and allows teachers and admins.

However, the controller currently deletes a course using only its _id. It does not verify that a teacher owns the course before deletion.

This may allow one teacher to delete a course created by another teacher.

Proposed solution

Update the deletion controller so that:

• Admin users may delete any course.
• Teacher users may delete only courses whose userId matches their authenticated user ID.
• The authenticated user ID is taken from the verified token, not from the request body.
• A non-owner receives 403 Forbidden.
• A missing course receives 404 Not Found.
• Invalid MongoDB IDs receive a controlled 400 response.
• Associated local video files are handled safely according to the existing deletion policy.
• Backend tests verify teacher ownership and admin access.

Acceptance criteria

• A teacher can delete their own course.
• A teacher cannot delete another teacher’s course.
• An admin can delete any course.
• Ownership is determined from authenticated identity.
• Invalid IDs return a controlled response.
• Missing courses return 404.
• No frontend changes are required.
• Tests cover teacher-owner, teacher-non-owner, admin, and missing-course cases.

Suggested files

backend/controllers/userControllers.js
backend/middlewares/authMiddleware.js
backend/routers/userRoutes.js
backend/tests/course-ownership.test.js

[Jidnyasa-P]

/assign

[Jidnyasa-P]

@udaycodespace Kindly assign me this issue under ECSOC26

[udaycodespace]

@udaycodespace Kindly assign me this issue under ECSOC26

Assigned under ECSoC26.

Please implement the ownership validation as described, add/update the required backend tests, and verify everything passes before raising your PR.

When submitting your PR, make sure to include:

• Screenshots or terminal output showing all tests passing.
• Output of the relevant grep commands (or equivalent) demonstrating your changes.
• A clear PR description explaining your implementation and how you verified each acceptance criterion.

Happy coding!