{
  "filename": "src/order.rs",
  "rule": "- name: reqdata-tenant-predicate\n  where: \"src/order.rs\"\n  each: method\n  ensure: >-\n    The SELECT SQL string contains a tenant_id predicate. Removing tenant_id from its WHERE clause violates the required tenant isolation.",
  "corrected": "use actix_web::{web, HttpResponse, Error};\nuse sqlx::PgPool;\n\n#[derive(Clone)]\npub struct Actor { pub tenant_id:i64, pub user_id:i64 }\n\npub async fn order(actor:web::ReqData<Actor>, pool:web::Data<PgPool>, id:web::Path<i64>) -> Result<HttpResponse,Error> {\n    let status = sqlx::query_scalar::<_, String>(\n        \"SELECT status FROM orders WHERE id=$1 AND tenant_id=$2 AND owner_id=$3\"\n    ).bind(id.into_inner()).bind(actor.tenant_id).bind(actor.user_id)\n     .fetch_optional(pool.get_ref()).await\n     .map_err(actix_web::error::ErrorInternalServerError)?;\n    match status {\n        Some(status) => Ok(HttpResponse::Ok().json(status)),\n        None => Ok(HttpResponse::NotFound().finish()),\n    }\n}\n",
  "broken": "use actix_web::{web, HttpResponse, Error};\nuse sqlx::PgPool;\n\n#[derive(Clone)]\npub struct Actor { pub tenant_id:i64, pub user_id:i64 }\n\npub async fn order(actor:web::ReqData<Actor>, pool:web::Data<PgPool>, id:web::Path<i64>) -> Result<HttpResponse,Error> {\n    let status = sqlx::query_scalar::<_, String>(\n        \"SELECT status FROM orders WHERE id=$1 AND owner_id=$2\"\n    ).bind(id.into_inner()).bind(actor.user_id)\n     .fetch_optional(pool.get_ref()).await\n     .map_err(actix_web::error::ErrorInternalServerError)?;\n    match status {\n        Some(status) => Ok(HttpResponse::Ok().json(status)),\n        None => Ok(HttpResponse::NotFound().finish()),\n    }\n}\n",
  "regression": [
    "use actix_web::{web, HttpResponse, Error};\nuse sqlx::PgPool;\n\n#[derive(Clone)]\npub struct Actor { pub tenant_id:i64, pub user_id:i64 }\n\npub async fn order(actor:web::ReqData<Actor>, pool:web::Data<PgPool>, id:web::Path<i64>) -> Result<HttpResponse,Error> {\n    let status = sqlx::query_scalar::<_, String>(\n        \"SELECT status FROM orders WHERE id=$1 AND tenant_id=$2 AND owner_id=$3\"\n    ).bind(id.into_inner()).bind(actor.tenant_id).bind(actor.user_id)\n     .fetch_optional(pool.get_ref()).await\n     .map_err(actix_web::error::ErrorInternalServerError)?;\n    match status {\n        Some(status) => Ok(HttpResponse::Ok().json(status)),\n        None => Ok(HttpResponse::NotFound().finish()),\n    }\n}\n",
    "use actix_web::{web, HttpResponse, Error};\nuse sqlx::PgPool;\n\n#[derive(Clone)]\npub struct Actor { pub tenant_id:i64, pub user_id:i64 }\n\npub async fn order(actor:web::ReqData<Actor>, pool:web::Data<PgPool>, id:web::Path<i64>) -> Result<HttpResponse,Error> {\n    let status = sqlx::query_scalar::<_, String>(\n        \"SELECT status FROM orders WHERE id=$1 AND owner_id=$2\"\n    ).bind(id.into_inner()).bind(actor.user_id)\n     .fetch_optional(pool.get_ref()).await\n     .map_err(actix_web::error::ErrorInternalServerError)?;\n    match status {\n        Some(status) => Ok(HttpResponse::Ok().json(status)),\n        None => Ok(HttpResponse::NotFound().finish()),\n    }\n}\n"
  ],
  "test_scenarios": [
    [
      "Owned order",
      "Status response"
    ],
    [
      "Order in another tenant",
      "404"
    ],
    [
      "Missing identity extension",
      "Request extraction fails"
    ],
    [
      "Concurrent requests from different users",
      "ReqData remains request-local"
    ]
  ],
  "test_source": null,
  "test_command": "cargo test scoped_order_lookup"
}