feat: Implement user validation and ownership checks for image, reward, and task APIs

- Added `get_validated_user_id` utility function to validate user authentication across multiple APIs.
- Updated image upload, request, and listing endpoints to ensure user ownership and proper error handling.
- Enhanced reward management endpoints to include user validation and ownership checks.
- Modified task management endpoints to enforce user authentication and ownership verification.
- Updated models to include `user_id` for images, rewards, tasks, and children to track ownership.
- Implemented frontend changes to ensure UI reflects the ownership of tasks and rewards.
- Added a new feature specification to prevent deletion of system tasks and rewards.

backend/api/child_api.py

@@ -21,6 +21,7 @@ from models.child import Child
 from models.pending_reward import PendingReward
 from models.reward import Reward
 from models.task import Task
+from api.utils import get_validated_user_id
 import logging
 
 child_api = Blueprint('child_api', __name__)
@@ -29,14 +30,20 @@ logger = logging.getLogger(__name__)
 @child_api.route('/child/<name>', methods=['GET'])
 @child_api.route('/child/<id>', methods=['GET'])
 def get_child(id):
+    user_id = get_validated_user_id()
+    if not user_id:
+        return jsonify({'error': 'Unauthorized', 'code': 'UNAUTHORIZED'}), 401
     ChildQuery = Query()
-    result = child_db.search(ChildQuery.id == id)
+    result = child_db.search((ChildQuery.id == id) & (ChildQuery.user_id == user_id))
     if not result:
         return jsonify({'error': 'Child not found'}), 404
     return jsonify(Child.from_dict(result[0]).to_dict()), 200
 
 @child_api.route('/child/add', methods=['PUT'])
 def add_child():
+    user_id = get_validated_user_id()
+    if not user_id:
+        return jsonify({'error': 'Unauthorized', 'code': 'UNAUTHORIZED'}), 401
     data = request.get_json()
     name = data.get('name')
     age = data.get('age')
@@ -46,7 +53,7 @@ def add_child():
     if not image:
         image = 'boy01'
 
-    child = Child(name=name, age=age, image_id=image)
+    child = Child(name=name, age=age, image_id=image, user_id=user_id)
     child_db.insert(child.to_dict())
     resp = send_event_for_current_user(
         Event(EventType.CHILD_MODIFIED.value, ChildModified(child.id, ChildModified.OPERATION_ADD)))
@@ -56,13 +63,16 @@ def add_child():
 
 @child_api.route('/child/<id>/edit', methods=['PUT'])
 def edit_child(id):
+    user_id = get_validated_user_id()
+    if not user_id:
+        return jsonify({'error': 'Unauthorized', 'code': 'UNAUTHORIZED'}), 401
     data = request.get_json()
     name = data.get('name', None)
     age = data.get('age', None)
     points = data.get('points', None)
     image = data.get('image_id', None)
     ChildQuery = Query()
-    result = child_db.search(ChildQuery.id == id)
+    result = child_db.search((ChildQuery.id == id) & (ChildQuery.user_id == user_id))
     if not result:
         return jsonify({'error': 'Child not found'}), 404
     child = Child.from_dict(result[0])
@@ -79,18 +89,18 @@ def edit_child(id):
     # Check if points changed and handle pending rewards
     if points is not None:
         PendingQuery = Query()
-        pending_rewards = pending_reward_db.search(PendingQuery.child_id == id)
+        pending_rewards = pending_reward_db.search((PendingQuery.child_id == id) & (PendingQuery.user_id == user_id))
 
         RewardQuery = Query()
         for pr in pending_rewards:
             pending = PendingReward.from_dict(pr)
-            reward_result = reward_db.get(RewardQuery.id == pending.reward_id)
+            reward_result = reward_db.get((RewardQuery.id == pending.reward_id) & ((RewardQuery.user_id == user_id) | (RewardQuery.user_id == None)))
             if reward_result:
                 reward = Reward.from_dict(reward_result)
                 # If child can no longer afford the reward, remove the pending request
                 if child.points < reward.cost:
                     pending_reward_db.remove(
-                        (PendingQuery.child_id == id) & (PendingQuery.reward_id == reward.id)
+                        (PendingQuery.child_id == id) & (PendingQuery.reward_id == reward.id) & (PendingQuery.user_id == user_id)
                     )
                     resp = send_event_for_current_user(
                         Event(EventType.CHILD_REWARD_REQUEST.value, ChildRewardRequest(id, reward.id, ChildRewardRequest.REQUEST_CANCELLED)))
@@ -104,14 +114,21 @@ def edit_child(id):
 
 @child_api.route('/child/list', methods=['GET'])
 def list_children():
-    children = child_db.all()
+    user_id = get_validated_user_id()
+    if not user_id:
+        return jsonify({'error': 'Unauthorized', 'code': 'UNAUTHORIZED'}), 401
+    ChildQuery = Query()
+    children = child_db.search(ChildQuery.user_id == user_id)
     return jsonify({'children': children}), 200
 
 # Child DELETE
 @child_api.route('/child/<id>', methods=['DELETE'])
 def delete_child(id):
+    user_id = get_validated_user_id()
+    if not user_id:
+        return jsonify({'error': 'Unauthorized', 'code': 'UNAUTHORIZED'}), 401
     ChildQuery = Query()
-    if child_db.remove(ChildQuery.id == id):
+    if child_db.remove((ChildQuery.id == id) & (ChildQuery.user_id == user_id)):
         resp = send_event_for_current_user(Event(EventType.CHILD_MODIFIED.value, ChildModified(id, ChildModified.OPERATION_DELETE)))
         if resp:
             return resp
@@ -120,13 +137,16 @@ def delete_child(id):
 
 @child_api.route('/child/<id>/assign-task', methods=['POST'])
 def assign_task_to_child(id):
+    user_id = get_validated_user_id()
+    if not user_id:
+        return jsonify({'error': 'Unauthorized', 'code': 'UNAUTHORIZED'}), 401
     data = request.get_json()
     task_id = data.get('task_id')
     if not task_id:
         return jsonify({'error': 'task_id is required'}), 400
 
     ChildQuery = Query()
-    result = child_db.search(ChildQuery.id == id)
+    result = child_db.search((ChildQuery.id == id) & (ChildQuery.user_id == user_id))
     if not result:
         return jsonify({'error': 'Child not found'}), 404
 
@@ -139,6 +159,9 @@ def assign_task_to_child(id):
 # python
 @child_api.route('/child/<id>/set-tasks', methods=['PUT'])
 def set_child_tasks(id):
+    user_id = get_validated_user_id()
+    if not user_id:
+        return jsonify({'error': 'Unauthorized', 'code': 'UNAUTHORIZED'}), 401
     data = request.get_json() or {}
     task_ids = data.get('task_ids')
     if 'type' not in data:
@@ -151,7 +174,7 @@ def set_child_tasks(id):
         return jsonify({'error': 'task_ids must be a list'}), 400
 
     ChildQuery = Query()
-    result = child_db.search(ChildQuery.id == id)
+    result = child_db.search((ChildQuery.id == id) & (ChildQuery.user_id == user_id))
     if not result:
         return jsonify({'error': 'Child not found'}), 404
     child = Child.from_dict(result[0])
@@ -179,13 +202,16 @@ def set_child_tasks(id):
 
 @child_api.route('/child/<id>/remove-task', methods=['POST'])
 def remove_task_from_child(id):
+    user_id = get_validated_user_id()
+    if not user_id:
+        return jsonify({'error': 'Unauthorized', 'code': 'UNAUTHORIZED'}), 401
     data = request.get_json()
     task_id = data.get('task_id')
     if not task_id:
         return jsonify({'error': 'task_id is required'}), 400
 
     ChildQuery = Query()
-    result = child_db.search(ChildQuery.id == id)
+    result = child_db.search((ChildQuery.id == id) & (ChildQuery.user_id == user_id))
     if not result:
         return jsonify({'error': 'Child not found'}), 404
 
@@ -198,8 +224,11 @@ def remove_task_from_child(id):
 
 @child_api.route('/child/<id>/list-tasks', methods=['GET'])
 def list_child_tasks(id):
+    user_id = get_validated_user_id()
+    if not user_id:
+        return jsonify({'error': 'Unauthorized', 'code': 'UNAUTHORIZED'}), 401
     ChildQuery = Query()
-    result = child_db.search(ChildQuery.id == id)
+    result = child_db.search((ChildQuery.id == id) & (ChildQuery.user_id == user_id))
     if not result:
         return jsonify({'error': 'Child not found'}), 404
 
@@ -209,7 +238,7 @@ def list_child_tasks(id):
     TaskQuery = Query()
     child_tasks = []
     for tid in task_ids:
-        task = task_db.get(TaskQuery.id == tid)
+        task = task_db.get((TaskQuery.id == tid) & ((TaskQuery.user_id == user_id) | (TaskQuery.user_id == None)))
         if not task:
             continue
         ct = ChildTask(task.get('name'), task.get('is_good'), task.get('points'), task.get('image_id'), task.get('id'))
@@ -219,8 +248,11 @@ def list_child_tasks(id):
 
 @child_api.route('/child/<id>/list-assignable-tasks', methods=['GET'])
 def list_assignable_tasks(id):
+    user_id = get_validated_user_id()
+    if not user_id:
+        return jsonify({'error': 'Unauthorized', 'code': 'UNAUTHORIZED'}), 401
     ChildQuery = Query()
-    result = child_db.search(ChildQuery.id == id)
+    result = child_db.search((ChildQuery.id == id) & (ChildQuery.user_id == user_id))
     if not result:
         return jsonify({'error': 'Child not found'}), 404
 
@@ -237,7 +269,7 @@ def list_assignable_tasks(id):
     TaskQuery = Query()
     assignable_tasks = []
     for tid in assignable_ids:
-        task = task_db.get(TaskQuery.id == tid)
+        task = task_db.get((TaskQuery.id == tid) & ((TaskQuery.user_id == user_id) | (TaskQuery.user_id == None)))
         if not task:
             continue
         ct = ChildTask(task.get('name'), task.get('is_good'), task.get('points'), task.get('image_id'), task.get('id'))
@@ -248,8 +280,11 @@ def list_assignable_tasks(id):
 
 @child_api.route('/child/<id>/list-all-tasks', methods=['GET'])
 def list_all_tasks(id):
+    user_id = get_validated_user_id()
+    if not user_id:
+        return jsonify({'error': 'Unauthorized', 'code': 'UNAUTHORIZED'}), 401
     ChildQuery = Query()
-    result = child_db.search(ChildQuery.id == id)
+    result = child_db.search((ChildQuery.id == id) & (ChildQuery.user_id == user_id))
     if not result:
         return jsonify({'error': 'Child not found'}), 404
     has_type = "type" in request.args
@@ -261,14 +296,12 @@ def list_all_tasks(id):
     assigned_ids = set(child.get('tasks', []))
 
     # Get all tasks from database
-    all_tasks = task_db.all()
+    ChildTaskQuery = Query()
+    all_tasks = task_db.search((ChildTaskQuery.user_id == user_id) | (ChildTaskQuery.user_id == None))
 
     tasks = []
 
     for task in all_tasks:
-        if not task or not task.get('id'):
-            continue
-
         ct = ChildTask(
             task.get('name'),
             task.get('is_good'),
@@ -289,13 +322,16 @@ def list_all_tasks(id):
 
 @child_api.route('/child/<id>/trigger-task', methods=['POST'])
 def trigger_child_task(id):
+    user_id = get_validated_user_id()
+    if not user_id:
+        return jsonify({'error': 'Unauthorized', 'code': 'UNAUTHORIZED'}), 401
     data = request.get_json()
     task_id = data.get('task_id')
     if not task_id:
         return jsonify({'error': 'task_id is required'}), 400
 
     ChildQuery = Query()
-    result = child_db.search(ChildQuery.id == id)
+    result = child_db.search((ChildQuery.id == id) & (ChildQuery.user_id == user_id))
     if not result:
         return jsonify({'error': 'Child not found'}), 404
 
@@ -304,7 +340,7 @@ def trigger_child_task(id):
         return jsonify({'error': f'Task not found assigned to child {child.name}'}), 404
     # look up  the task and get the details
     TaskQuery = Query()
-    task_result = task_db.search(TaskQuery.id == task_id)
+    task_result = task_db.search((TaskQuery.id == task_id) & ((TaskQuery.user_id == user_id) | (TaskQuery.user_id == None)))
     if not task_result:
         return jsonify({'error': 'Task not found in task database'}), 404
     task: Task = Task.from_dict(task_result[0])
@@ -323,13 +359,16 @@ def trigger_child_task(id):
 
 @child_api.route('/child/<id>/assign-reward', methods=['POST'])
 def assign_reward_to_child(id):
+    user_id = get_validated_user_id()
+    if not user_id:
+        return jsonify({'error': 'Unauthorized', 'code': 'UNAUTHORIZED'}), 401
     data = request.get_json()
     reward_id = data.get('reward_id')
     if not reward_id:
         return jsonify({'error': 'reward_id is required'}), 400
 
     ChildQuery = Query()
-    result = child_db.search(ChildQuery.id == id)
+    result = child_db.search((ChildQuery.id == id) & (ChildQuery.user_id == user_id))
     if not result:
         return jsonify({'error': 'Child not found'}), 404
 
@@ -341,22 +380,23 @@ def assign_reward_to_child(id):
 
 @child_api.route('/child/<id>/list-all-rewards', methods=['GET'])
 def list_all_rewards(id):
+    user_id = get_validated_user_id()
+    if not user_id:
+        return jsonify({'error': 'Unauthorized', 'code': 'UNAUTHORIZED'}), 401
     ChildQuery = Query()
-    result = child_db.search(ChildQuery.id == id)
+    result = child_db.search((ChildQuery.id == id) & (ChildQuery.user_id == user_id))
     if not result:
         return jsonify({'error': 'Child not found'}), 404
 
-    child = result[0]
-    assigned_ids = set(child.get('rewards', []))
+    child = Child.from_dict(result[0])
+    assigned_ids = set(child.rewards)
 
     # Get all rewards from database
-    all_rewards = reward_db.all()
+    ChildRewardQuery = Query()
+    all_rewards = reward_db.search((ChildRewardQuery.user_id == user_id) | (ChildRewardQuery.user_id == None))
     rewards = []
 
     for reward in all_rewards:
-        if not reward or not reward.get('id'):
-            continue
-
         cr = ChildReward(
             reward.get('name'),
             reward.get('cost'),
@@ -379,6 +419,9 @@ def list_all_rewards(id):
 
 @child_api.route('/child/<id>/set-rewards', methods=['PUT'])
 def set_child_rewards(id):
+    user_id = get_validated_user_id()
+    if not user_id:
+        return jsonify({'error': 'Unauthorized', 'code': 'UNAUTHORIZED'}), 401
     data = request.get_json() or {}
     reward_ids = data.get('reward_ids')
     if not isinstance(reward_ids, list):
@@ -388,7 +431,7 @@ def set_child_rewards(id):
     new_reward_ids = [rid for rid in dict.fromkeys(reward_ids) if rid]
 
     ChildQuery = Query()
-    result = child_db.search(ChildQuery.id == id)
+    result = child_db.search((ChildQuery.id == id) & (ChildQuery.user_id == user_id))
     if not result:
         return jsonify({'error': 'Child not found'}), 404
 
@@ -396,7 +439,7 @@ def set_child_rewards(id):
     RewardQuery = Query()
     valid_reward_ids = []
     for rid in new_reward_ids:
-        if reward_db.get(RewardQuery.id == rid):
+        if reward_db.get((RewardQuery.id == rid) & ((RewardQuery.user_id == user_id) | (RewardQuery.user_id == None))):
             valid_reward_ids.append(rid)
 
     # Replace rewards with validated IDs
@@ -411,13 +454,16 @@ def set_child_rewards(id):
 
 @child_api.route('/child/<id>/remove-reward', methods=['POST'])
 def remove_reward_from_child(id):
+    user_id = get_validated_user_id()
+    if not user_id:
+        return jsonify({'error': 'Unauthorized', 'code': 'UNAUTHORIZED'}), 401
     data = request.get_json()
     reward_id = data.get('reward_id')
     if not reward_id:
         return jsonify({'error': 'reward_id is required'}), 400
 
     ChildQuery = Query()
-    result = child_db.search(ChildQuery.id == id)
+    result = child_db.search((ChildQuery.id == id) & (ChildQuery.user_id == user_id))
     if not result:
         return jsonify({'error': 'Child not found'}), 404
 
@@ -430,8 +476,11 @@ def remove_reward_from_child(id):
 
 @child_api.route('/child/<id>/list-rewards', methods=['GET'])
 def list_child_rewards(id):
+    user_id = get_validated_user_id()
+    if not user_id:
+        return jsonify({'error': 'Unauthorized', 'code': 'UNAUTHORIZED'}), 401
     ChildQuery = Query()
-    result = child_db.search(ChildQuery.id == id)
+    result = child_db.search((ChildQuery.id == id) & (ChildQuery.user_id == user_id))
     if not result:
         return jsonify({'error': 'Child not found'}), 404
 
@@ -441,7 +490,7 @@ def list_child_rewards(id):
     RewardQuery = Query()
     child_rewards = []
     for rid in reward_ids:
-        reward = reward_db.get(RewardQuery.id == rid)
+        reward = reward_db.get((RewardQuery.id == rid) & ((RewardQuery.user_id == user_id) | (RewardQuery.user_id == None)))
         if not reward:
             continue
         cr = ChildReward(reward.get('name'), reward.get('cost'), reward.get('image_id'), reward.get('id'))
@@ -451,8 +500,11 @@ def list_child_rewards(id):
 
 @child_api.route('/child/<id>/list-assignable-rewards', methods=['GET'])
 def list_assignable_rewards(id):
+    user_id = get_validated_user_id()
+    if not user_id:
+        return jsonify({'error': 'Unauthorized', 'code': 'UNAUTHORIZED'}), 401
     ChildQuery = Query()
-    result = child_db.search(ChildQuery.id == id)
+    result = child_db.search((ChildQuery.id == id) & (ChildQuery.user_id == user_id))
     if not result:
         return jsonify({'error': 'Child not found'}), 404
 
@@ -465,7 +517,7 @@ def list_assignable_rewards(id):
     RewardQuery = Query()
     assignable_rewards = []
     for rid in assignable_ids:
-        reward = reward_db.get(RewardQuery.id == rid)
+        reward = reward_db.get((RewardQuery.id == rid) & ((RewardQuery.user_id == user_id) | (RewardQuery.user_id == None)))
         if not reward:
             continue
         cr = ChildReward(reward.get('name'), reward.get('cost'), reward.get('image_id'), reward.get('id'))
@@ -475,13 +527,16 @@ def list_assignable_rewards(id):
 
 @child_api.route('/child/<id>/trigger-reward', methods=['POST'])
 def trigger_child_reward(id):
+    user_id = get_validated_user_id()
+    if not user_id:
+        return jsonify({'error': 'Unauthorized', 'code': 'UNAUTHORIZED'}), 401
     data = request.get_json()
     reward_id = data.get('reward_id')
     if not reward_id:
         return jsonify({'error': 'reward_id is required'}), 400
 
     ChildQuery = Query()
-    result = child_db.search(ChildQuery.id == id)
+    result = child_db.search((ChildQuery.id == id) & (ChildQuery.user_id == user_id))
     if not result:
         return jsonify({'error': 'Child not found'}), 404
 
@@ -490,7 +545,7 @@ def trigger_child_reward(id):
         return jsonify({'error': f'Reward not found assigned to child {child.name}'}), 404
     # look up  the task and get the details
     RewardQuery = Query()
-    reward_result = reward_db.search(RewardQuery.id == reward_id)
+    reward_result = reward_db.search((RewardQuery.id == reward_id) & ((RewardQuery.user_id == user_id) | (RewardQuery.user_id == None)))
     if not reward_result:
         return jsonify({'error': 'Reward not found in reward database'}), 404
     reward: Reward = Reward.from_dict(reward_result[0])
@@ -523,8 +578,11 @@ def trigger_child_reward(id):
 
 @child_api.route('/child/<id>/affordable-rewards', methods=['GET'])
 def list_affordable_rewards(id):
+    user_id = get_validated_user_id()
+    if not user_id:
+        return jsonify({'error': 'Unauthorized', 'code': 'UNAUTHORIZED'}), 401
     ChildQuery = Query()
-    result = child_db.search(ChildQuery.id == id)
+    result = child_db.search((ChildQuery.id == id) & (ChildQuery.user_id == user_id))
     if not result:
         return jsonify({'error': 'Child not found'}), 404
 
@@ -534,14 +592,17 @@ def list_affordable_rewards(id):
     RewardQuery = Query()
     affordable = [
         Reward.from_dict(reward).to_dict() for reward_id in reward_ids
-        if (reward := reward_db.get(RewardQuery.id == reward_id)) and points >= Reward.from_dict(reward).cost
+        if (reward := reward_db.get((RewardQuery.id == reward_id) & ((RewardQuery.user_id == user_id) | (RewardQuery.user_id == None)))) and points >= Reward.from_dict(reward).cost
     ]
     return jsonify({'affordable_rewards': affordable}), 200
 
 @child_api.route('/child/<id>/reward-status', methods=['GET'])
 def reward_status(id):
+    user_id = get_validated_user_id()
+    if not user_id:
+        return jsonify({'error': 'Unauthorized', 'code': 'UNAUTHORIZED'}), 401
     ChildQuery = Query()
-    result = child_db.search(ChildQuery.id == id)
+    result = child_db.search((ChildQuery.id == id) & (ChildQuery.user_id == user_id))
     if not result:
         return jsonify({'error': 'Child not found'}), 404
 
@@ -552,13 +613,13 @@ def reward_status(id):
     RewardQuery = Query()
     statuses = []
     for reward_id in reward_ids:
-        reward: Reward = Reward.from_dict(reward_db.get(RewardQuery.id == reward_id))
+        reward: Reward = Reward.from_dict(reward_db.get((RewardQuery.id == reward_id) & ((RewardQuery.user_id == user_id) | (RewardQuery.user_id == None))))
         if not reward:
             continue
         points_needed = max(0, reward.cost - points)
         #check to see if this reward id and child id is in the pending rewards db if so set its redeeming flag to true
         pending_query = Query()
-        pending = pending_reward_db.get((pending_query.child_id == child.id) & (pending_query.reward_id == reward.id))
+        pending = pending_reward_db.get((pending_query.child_id == child.id) & (pending_query.reward_id == reward.id) & (pending_query.user_id == user_id))
         status = RewardStatus(reward.id, reward.name, points_needed, reward.cost, pending is not None, reward.image_id)
         statuses.append(status.to_dict())
 
@@ -568,13 +629,16 @@ def reward_status(id):
 
 @child_api.route('/child/<id>/request-reward', methods=['POST'])
 def request_reward(id):
+    user_id = get_validated_user_id()
+    if not user_id:
+        return jsonify({'error': 'Unauthorized', 'code': 'UNAUTHORIZED'}), 401
     data = request.get_json()
     reward_id = data.get('reward_id')
     if not reward_id:
         return jsonify({'error': 'reward_id is required'}), 400
 
     ChildQuery = Query()
-    result = child_db.search(ChildQuery.id == id)
+    result = child_db.search((ChildQuery.id == id) & (ChildQuery.user_id == user_id))
     if not result:
         return jsonify({'error': 'Child not found'}), 404
 
@@ -600,7 +664,7 @@ def request_reward(id):
             'reward_cost': reward.cost
         }), 400
 
-    pending = PendingReward(child_id=child.id, reward_id=reward.id)
+    pending = PendingReward(child_id=child.id, reward_id=reward.id, user_id=user_id)
     pending_reward_db.insert(pending.to_dict())
     logger.info(f'Pending reward request created for child {child.name} for reward {reward.name}')
     send_event_for_current_user(Event(EventType.CHILD_REWARD_REQUEST.value, ChildRewardRequest(child.id, reward.id, ChildRewardRequest.REQUEST_CREATED)))
@@ -615,13 +679,16 @@ def request_reward(id):
 
 @child_api.route('/child/<id>/cancel-request-reward', methods=['POST'])
 def cancel_request_reward(id):
+    user_id = get_validated_user_id()
+    if not user_id:
+        return jsonify({'error': 'Unauthorized', 'code': 'UNAUTHORIZED'}), 401
     data = request.get_json()
     reward_id = data.get('reward_id')
     if not reward_id:
         return jsonify({'error': 'reward_id is required'}), 400
 
     ChildQuery = Query()
-    result = child_db.search(ChildQuery.id == id)
+    result = child_db.search((ChildQuery.id == id) & (ChildQuery.user_id == user_id))
     if not result:
         return jsonify({'error': 'Child not found'}), 404
 
@@ -630,7 +697,7 @@ def cancel_request_reward(id):
     # Remove matching pending reward request
     PendingQuery = Query()
     removed = pending_reward_db.remove(
-        (PendingQuery.child_id == child.id) & (PendingQuery.reward_id == reward_id)
+        (PendingQuery.child_id == child.id) & (PendingQuery.reward_id == reward_id) & (PendingQuery.user_id == user_id)
     )
 
     if not removed:
@@ -651,7 +718,11 @@ def cancel_request_reward(id):
 
 @child_api.route('/pending-rewards', methods=['GET'])
 def list_pending_rewards():
-    pending_rewards = pending_reward_db.all()
+    user_id = get_validated_user_id()
+    if not user_id:
+        return jsonify({'error': 'Unauthorized', 'code': 'UNAUTHORIZED'}), 401
+    PendingQuery = Query()
+    pending_rewards = pending_reward_db.search(PendingQuery.user_id == user_id)
     reward_responses = []
 
     RewardQuery = Query()
@@ -661,7 +732,7 @@ def list_pending_rewards():
         pending = PendingReward.from_dict(pr)
 
         # Look up reward details
-        reward_result = reward_db.get(RewardQuery.id == pending.reward_id)
+        reward_result = reward_db.get((RewardQuery.id == pending.reward_id) & ((RewardQuery.user_id == user_id) | (RewardQuery.user_id == None)))
         if not reward_result:
             continue
         reward = Reward.from_dict(reward_result)