fix: AI analysis history user isolation & password change Turnstile bypass

backend_api_python/app/routes/auth.py

@@ -472,10 +472,25 @@ def send_verification_code():
         if not email or not email_service.is_valid_email(email):
             return jsonify({'code': 0, 'msg': 'Invalid email address', 'data': None}), 400
         
-        # Verify Turnstile
-        turnstile_ok, turnstile_msg = security.verify_turnstile(turnstile_token, ip_address)
-        if not turnstile_ok:
-            return jsonify({'code': 0, 'msg': turnstile_msg, 'data': None}), 400
+        # For change_password type with logged-in user, skip Turnstile verification
+        # because user already authenticated
+        skip_turnstile = False
+        if code_type == 'change_password':
+            # Try to get user_id from token (this route doesn't require login)
+            from app.utils.auth import verify_token
+            auth_header = request.headers.get('Authorization')
+            if auth_header:
+                parts = auth_header.split()
+                if len(parts) == 2 and parts[0].lower() == 'bearer':
+                    payload = verify_token(parts[1])
+                    if payload and payload.get('user_id'):
+                        skip_turnstile = True
+        
+        # Verify Turnstile (skip for authenticated change_password requests)
+        if not skip_turnstile:
+            turnstile_ok, turnstile_msg = security.verify_turnstile(turnstile_token, ip_address)
+            if not turnstile_ok:
+                return jsonify({'code': 0, 'msg': turnstile_msg, 'data': None}), 400
         
         # Check rate limit
         can_send, rate_msg = security.can_send_verification_code(email, ip_address)

backend_api_python/app/routes/fast_analysis.py

@@ -49,13 +49,17 @@ def analyze():
                 'data': None
             }), 400
         
+        # Get current user's ID to associate analysis with user
+        user_id = getattr(g, 'user_id', None)
+        
         service = get_fast_analysis_service()
         result = service.analyze(
             market=market,
             symbol=symbol,
             language=language,
             model=model,
-            timeframe=timeframe
+            timeframe=timeframe,
+            user_id=user_id
         )
         
         if result.get('error'):
@@ -197,8 +201,11 @@ def get_all_history():
         page = int(request.args.get('page', 1))
         pagesize = min(int(request.args.get('pagesize', 20)), 50)
         
+        # Get current user's ID to filter history
+        user_id = getattr(g, 'user_id', None)
+        
         memory = get_analysis_memory()
-        result = memory.get_all_history(page=page, page_size=pagesize)
+        result = memory.get_all_history(user_id=user_id, page=page, page_size=pagesize)
         
         return jsonify({
             'code': 1,
@@ -229,8 +236,11 @@ def delete_history(memory_id: int):
     DELETE /api/fast-analysis/history/123
     """
     try:
+        # Get current user's ID to ensure they can only delete their own records
+        user_id = getattr(g, 'user_id', None)
+        
         memory = get_analysis_memory()
-        success = memory.delete_history(memory_id)
+        success = memory.delete_history(memory_id, user_id=user_id)
         
         if success:
             return jsonify({
@@ -241,7 +251,7 @@ def delete_history(memory_id: int):
         else:
             return jsonify({
                 'code': 0,
-                'msg': 'Record not found',
+                'msg': 'Record not found or no permission',
                 'data': None
             }), 404