[security] M-12: TTS endpoint without authentication

[jacobyoby]

Severity: Medium
File: tts/views.py

Problem

Text-to-speech endpoint accessible without authentication.

Remediation

Add @login_required decorator to TTS routes.

Source

Finding from security audit (2026-08-31). See .github/SECURITY_AUDIT_TRIAGE.md.

[jacobyoby]

Triaged, no change: /speakfile is already session-gated, and @login_required would break anonymous screen-reader respondents. Evidence: (1) speak_file() resolves the session key via get_session(filename) (sessions.py:66-77), which reads only the CALLER's own Flask session — without running that interview yourself you get HTTP 400, so no cross-user data is reachable. (2) It then requires an exact SpeakList row match (filename, session uid key, question, digest, type, language, dialect) created during that session's interview progression, and serves audio of question text the caller already sees on screen. (3) Encrypted phrases decrypt with the requester's own 'secret' cookie against their own uid-keyed rows. (4) The blueprint registers only when ENABLE_TTS is set (app_initialize.py). Adding @login_required would disable read-aloud for every anonymous respondent on public interviews — an accessibility regression — while stopping no actual disclosure. The MD5 'digest' is a cache key, not an auth gate, and needs no hardening given (1)-(2).