fix(api): secure settings api against unauthorised access

[anaghwadhwa123]

Description

This pull request resolves Finding 6.6 (Unauthenticated Access to System Settings) from the previous trimester's vulnerability remediation report. Previously, the /settings and /settings/privacy endpoints inside settings_api.rb were publicly accessible without authentication. This fix adds the AuthenticationHelpers module and enforces a before { authenticated? } block to ensure only authenticated users can access system settings.

Fixes # Finding 6.6 from the Vulnerability Remediation Report

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

How Has This Been Tested?

• Verified that accessing the settings endpoints requires valid user authentication, matching existing secure APIs like users_api.rb and projects_api.rb.

• Tested locally against the running development server using curl:

  curl -i http://localhost:3000/api/settings

  Output:

  HTTP/1.1 419 CUSTOM
  content-type: application/json
  {"error":"No authentication details provided. Authentication is required to access this resource."}
  

This confirms unauthenticated requests are correctly rejected, consistent with the authentication behavior used across all other protected endpoints in the API.

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation if appropriate
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• I have created or extended unit tests to address my new additions
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules

[officialid130-13e13]

Hi @anaghwadhwa123,

• Completed local verification of the changes in the dev container.
• The /api/settings endpoint now enforces authentication as expected.
• Unauthenticated access consistently returns 419 CUSTOM with the correct error payload.
• This matches the intended behaviour described in the PR.

No issues identified.
Approved.

[officialid130-13e13]

@anaghwadhwa123 , I also attempted to generate a valid auth token via Swagger, but the token didn’t work, so I wasn’t able to fully validate the authenticated request flow. Happy to re‑test once a working token is available.