Study session IDs are sequential integers, enabling unauthorized room enumeration

[anshul23102]

Bug Description

Study session join links use auto-incrementing numeric IDs (e.g., /session/42). An attacker can enumerate all sessions by iterating integers, joining private sessions without an invitation.

Steps to Reproduce

1. Create a private session and note its ID (e.g., 15).
2. Try accessing /session/14, /session/13, etc.
3. Observe: other users' private sessions are accessible.

Root Cause

The sessions table uses SERIAL or BIGSERIAL as the primary key and exposes that integer directly in the join URL.

Impact

Unauthorized access to private peer-learning sessions; exposure of session content to uninvited participants.

Proposed Fix

ALTER TABLE sessions ADD COLUMN public_id UUID
  DEFAULT gen_random_uuid() NOT NULL UNIQUE;

Use public_id (UUID) in all join URLs and API routes instead of the integer primary key.

[anshul23102]

@durdana3105 Hi! I came across this issue and I would love to work on it as part of GSSoC '26.

I have reviewed the problem description carefully and am confident I can deliver a well-tested, production-ready fix within the contribution timeline. Please let me know if you need any additional context or have specific implementation preferences before I get started.

Could you please assign this issue to me?

/assign
/claim