Include conition for flask session

Author: leekahung

backend/tenantfirstaid/app.py

@@ -1,5 +1,5 @@
 from pathlib import Path
-from flask import Flask, jsonify, session
+from flask import Flask, jsonify, session, abort
 from flask_mailman import Mail
 from flask_limiter import Limiter
 from flask_limiter.util import get_remote_address
@@ -87,6 +87,9 @@ def clear_session():
 
 @limiter.limit("3 per minute")
 def feedback_route():
+    if not session.get("site_user"):
+        abort(403, "Unauthorized: session missing")
+
     return send_feedback()
 
 

backend/tenantfirstaid/session.py

@@ -46,6 +46,7 @@ def get_flask_session_id(self) -> str:
         if not session_id:
             session_id = str(uuid.uuid4())
             session["session_id"] = session_id
+            session["site_user"] = True
 
             @after_this_request
             def save_session(response: Response) -> Response: