pretty much as soon as possible after your validate parameters calls you should have some validate context and capability checks.
you do have a heklper class which calls various functions but those functions are inconsistent about checking "can this user calling the webservice actually perform this task.
ideally those checks should sit right in the execute function and not inside your helper class so it's really easy to review from a security perspective.
pretty much as soon as possible after your validate parameters calls you should have some validate context and capability checks.
you do have a heklper class which calls various functions but those functions are inconsistent about checking "can this user calling the webservice actually perform this task.
more info on this is here: https://moodledev.io/docs/apis/subsystems/external/writing-a-service#context-and-capability-checks
ideally those checks should sit right in the execute function and not inside your helper class so it's really easy to review from a security perspective.
note this is a blocker for plugins db approval.