aKinderWellness Testing and Quality analysis

The addNewMessage endpoint allows sending messages using any arbitrary senderId as long as it is a valid MongoDB ObjectId. The backend does not verify whether the sender exists or matches the authenticated user.
The API accepts user-controlled senderId input without proper validation. This allows an attacker to impersonate any user or even non-existent users.

Steps to Reproduce:

1. Intercept or craft a request to the endpoint: https://api.akinderwellness.com:4001/api/chat/addNewMessage
2. Modify the senderId field with any valid MongoDB ObjectId (existing or non-existing).
3. Send the request.

Observed Result:
The message is successfully created and stored, even when the senderId does not correspond to a real or authorized user.

Expected Result:
The server should derive the sender identity from the authenticated session (JWT), not from client input.
The sender must:
Exist in the database
Match the authenticated user
Be a participant in the chat

NOTE: A request in postman has been created to reproduce the bug easily.