Security: POST /api/reviews accepts entityId referencing non-existent models

[anshul23102]

Bug Report: Review Submission Does Not Verify entityId Existence

Description

The POST /api/reviews endpoint stores a review referencing an entityId
(model ID) without first checking whether that entity exists in the models
table. This allows any authenticated user to create orphaned reviews for
non-existent or deleted models, corrupting the reviews dataset and causing
runtime errors in any query that JOINs reviews to models.

Steps to Reproduce

1. Authenticate with a valid GitHub OAuth session.
2. Submit a review for a non-existent model ID:

   curl -X POST /api/reviews      -H "Cookie: <session>"      -d '{"entityId": "00000000-0000-0000-0000-000000000000", "rating": 5}'

3. Observe the response is 201 Created.
4. Query the reviews table: an orphaned review exists with no corresponding model.

Root Cause

The API handler calls prisma.review.create() directly without a preceding
prisma.model.findUnique() check or a foreign key constraint at the database level.

Impact

Orphaned reviews cause JOIN queries to fail silently, inflate model counts,
and allow manipulation of the leaderboard rankings through phantom reviews.

Proposed Fix

Verify entity existence before creating the review:

const entity = await prisma.aIModel.findUnique({ where: { id: entityId } });
if (!entity) {
  return NextResponse.json({ error: "Model not found" }, { status: 404 });
}
await prisma.review.create({ data: { entityId, rating, comment, userId } });

Also add a database-level foreign key: entityId UUID REFERENCES ai_models(id) ON DELETE CASCADE.

[anshul23102]

@AditthyaSS Hi! I came across this issue and I would love to work on it as part of GSSoC '26.

I have reviewed the problem description carefully and am confident I can deliver a well-tested, production-ready fix within the contribution timeline. Please let me know if you need any additional context or have specific implementation preferences before I get started.

Could you please assign this issue to me?

/assign
/claim