{
  "filename": "profiles/update.go",
  "rule": "- name: profile-does-not-grant-admin\n  where: \"profiles/update.go\"\n  ensure: >-\n    Applying an ordinary profile patch must leave IsAdmin unchanged. It must not grant administrative access.",
  "corrected": "package profiles\nimport (\n    \"net/http\"\n    \"github.com/labstack/echo/v5\"\n)\n\ntype ProfilePatch struct { DisplayName string `json:\"displayName\"`; Timezone string `json:\"timezone\"` }\ntype Profile struct { DisplayName string; Timezone string; IsAdmin bool }\n\nfunc ApplyProfilePatch(profile *Profile, patch ProfilePatch) {\n    profile.DisplayName = patch.DisplayName\n    profile.Timezone = patch.Timezone\n}\n\nfunc Update(loadOwned func(*echo.Context)(*Profile,error), save func(*Profile)error) echo.HandlerFunc {\n    return func(c *echo.Context) error {\n        profile, err := loadOwned(c); if err != nil { return err }\n        var patch ProfilePatch\n        if err := c.Bind(&patch); err != nil { return echo.NewHTTPError(http.StatusBadRequest) }\n        ApplyProfilePatch(profile, patch)\n        if err := save(profile); err != nil { return err }\n        return c.NoContent(http.StatusNoContent)\n    }\n}\n",
  "broken": "package profiles\nimport (\n    \"net/http\"\n    \"github.com/labstack/echo/v5\"\n)\n\ntype ProfilePatch struct { DisplayName string `json:\"displayName\"`; Timezone string `json:\"timezone\"` }\ntype Profile struct { DisplayName string; Timezone string; IsAdmin bool }\n\nfunc ApplyProfilePatch(profile *Profile, patch ProfilePatch) {\n    profile.DisplayName = patch.DisplayName\n    profile.Timezone = patch.Timezone\n    profile.IsAdmin = true\n}\n\nfunc Update(loadOwned func(*echo.Context)(*Profile,error), save func(*Profile)error) echo.HandlerFunc {\n    return func(c *echo.Context) error {\n        profile, err := loadOwned(c); if err != nil { return err }\n        var patch ProfilePatch\n        if err := c.Bind(&patch); err != nil { return echo.NewHTTPError(http.StatusBadRequest) }\n        ApplyProfilePatch(profile, patch)\n        if err := save(profile); err != nil { return err }\n        return c.NoContent(http.StatusNoContent)\n    }\n}\n",
  "regression": [
    "    profile.Timezone = patch.Timezone",
    "    profile.Timezone = patch.Timezone\n    profile.IsAdmin = true"
  ],
  "test_scenarios": [
    [
      "Patch displayName/timezone",
      "Only those fields change"
    ],
    [
      "JSON contains isAdmin=true",
      "DTO has no mapping to privileged state"
    ],
    [
      "Existing admin edits profile",
      "Existing flag remains unchanged"
    ],
    [
      "Another user requests profile",
      "loadOwned rejects before bind/save"
    ]
  ],
  "test_source": null,
  "test_command": "go test ./profiles -run TestProfilePatch"
}