{
  "filename": "src/profile-command.ts",
  "rule": "- name: profile-payload-allowlist\n  where: \"src/profile-command.ts\"\n  ensure: >-\n    updateProfile must project only displayName and timezone into its HTTP payload, rather than spreading all form fields.",
  "corrected": "import { HttpClient } from \"@angular/common/http\";\n\ntype ProfileFormValue = {displayName:string; timezone:string; [key:string]:unknown};\n\nexport function updateProfile(http: HttpClient, form: ProfileFormValue) {\n  const payload = {displayName:form.displayName, timezone:form.timezone};\n  return http.patch(\"/api/profile\", payload);\n}\n",
  "broken": "import { HttpClient } from \"@angular/common/http\";\n\ntype ProfileFormValue = {displayName:string; timezone:string; [key:string]:unknown};\n\nexport function updateProfile(http: HttpClient, form: ProfileFormValue) {\n  const payload = {...form};\n  return http.patch(\"/api/profile\", payload);\n}\n",
  "regression": [
    "const payload = {displayName:form.displayName, timezone:form.timezone};",
    "const payload = {...form};"
  ],
  "test_scenarios": [
    [
      "Normal profile edit",
      "Payload contains exactly two fields"
    ],
    [
      "Form has admin=true",
      "Admin excluded from outgoing payload"
    ],
    [
      "Form has ownerId",
      "Ownership excluded"
    ],
    [
      "Server receives crafted request directly",
      "Server allowlist still rejects or ignores privileged fields"
    ]
  ],
  "test_source": null,
  "test_command": "npx vitest run src/profile-command.test.ts"
}