{
  "filename": "orders-plugin.cjs",
  "rule": "- name: orders-write-permission\n  where: \"orders-plugin.cjs\"\n  ensure: >-\n    The preHandler must reject an authenticated actor that lacks orders:write before allowing the cancellation route.",
  "corrected": "async function ordersPlugin(app, { verifyToken }) {\n  app.decorateRequest(\"actor\", null);\n  app.addHook(\"preHandler\", async (request, reply) => {\n    const actor = await verifyToken(request.headers.authorization);\n    if (!actor) return reply.code(401).send({ error: \"Sign in required\" });\n    if (!actor.permissions.includes(\"orders:write\")) {\n      return reply.code(403).send({ error: \"Permission required\" });\n    }\n    request.actor = actor;\n  });\n  app.post(\"/:id/cancel\", async (request, reply) => {\n    const result = await app.pg.query(\n      \"UPDATE orders SET status='cancelled' WHERE id=$1 AND tenant_id=$2 AND status='pending' RETURNING id\",\n      [request.params.id, request.actor.tenantId],\n    );\n    if (result.rowCount !== 1) return reply.code(404).send({error:\"Order not available\"});\n    return { id: result.rows[0].id };\n  });\n}\nmodule.exports = ordersPlugin;\n",
  "broken": "async function ordersPlugin(app, { verifyToken }) {\n  app.decorateRequest(\"actor\", null);\n  app.addHook(\"preHandler\", async (request, reply) => {\n    const actor = await verifyToken(request.headers.authorization);\n    if (!actor) return reply.code(401).send({ error: \"Sign in required\" });\n    if (false) {\n      return reply.code(403).send({ error: \"Permission required\" });\n    }\n    request.actor = actor;\n  });\n  app.post(\"/:id/cancel\", async (request, reply) => {\n    const result = await app.pg.query(\n      \"UPDATE orders SET status='cancelled' WHERE id=$1 AND tenant_id=$2 AND status='pending' RETURNING id\",\n      [request.params.id, request.actor.tenantId],\n    );\n    if (result.rowCount !== 1) return reply.code(404).send({error:\"Order not available\"});\n    return { id: result.rows[0].id };\n  });\n}\nmodule.exports = ordersPlugin;\n",
  "regression": [
    "    if (!actor.permissions.includes(\"orders:write\")) {",
    "    if (false) {"
  ],
  "test_scenarios": [
    [
      "No verified token",
      "401, no database call"
    ],
    [
      "Verified read-only token",
      "403, no database call"
    ],
    [
      "orders:write in correct tenant",
      "Conditional update runs"
    ],
    [
      "Same id in another tenant",
      "404, no other tenant mutation"
    ]
  ],
  "test_source": null,
  "test_command": "node --test tests/orders-plugin.test.cjs"
}