{
  "filename": "orders.ts",
  "rule": "- name: verified-token-write-scope\n  where: \"orders.ts\"\n  ensure: >-\n    The cancellation handler must reject a verified token without orders:write before invoking cancelOrder.",
  "corrected": "import { Hono } from \"hono\";\nimport { jwt } from \"hono/jwt\";\n\ntype Env = { Bindings: { JWT_SECRET: string }; Variables: { jwtPayload: { sub: string; tenant_id: string; scope?: string } } };\nexport function createOrdersApp(cancelOrder: (tenant: string, owner: string, id: string) => Promise<void>) {\n  const app = new Hono<Env>();\n  app.use(\"/orders/*\", (c, next) => jwt({secret:c.env.JWT_SECRET,alg:\"HS256\"})(c,next));\n  app.post(\"/orders/:id/cancel\", async c => {\n    const claims = c.get(\"jwtPayload\");\n    const scopes = (claims.scope ?? \"\").split(\" \");\n    if (!scopes.includes(\"orders:write\")) return c.json({error:\"Permission required\"},403);\n    if (!claims.sub || !claims.tenant_id) return c.json({error:\"Identity required\"},401);\n    await cancelOrder(claims.tenant_id, claims.sub, c.req.param(\"id\"));\n    return c.json({status:\"cancelled\"});\n  });\n  return app;\n}\n",
  "broken": "import { Hono } from \"hono\";\nimport { jwt } from \"hono/jwt\";\n\ntype Env = { Bindings: { JWT_SECRET: string }; Variables: { jwtPayload: { sub: string; tenant_id: string; scope?: string } } };\nexport function createOrdersApp(cancelOrder: (tenant: string, owner: string, id: string) => Promise<void>) {\n  const app = new Hono<Env>();\n  app.use(\"/orders/*\", (c, next) => jwt({secret:c.env.JWT_SECRET,alg:\"HS256\"})(c,next));\n  app.post(\"/orders/:id/cancel\", async c => {\n    const claims = c.get(\"jwtPayload\");\n    const scopes = (claims.scope ?? \"\").split(\" \");\n    if (!claims.sub || !claims.tenant_id) return c.json({error:\"Identity required\"},401);\n    await cancelOrder(claims.tenant_id, claims.sub, c.req.param(\"id\"));\n    return c.json({status:\"cancelled\"});\n  });\n  return app;\n}\n",
  "regression": [
    "    if (!scopes.includes(\"orders:write\")) return c.json({error:\"Permission required\"},403);\n",
    ""
  ],
  "test_scenarios": [
    [
      "Valid token with read scope only",
      "403, adapter not called"
    ],
    [
      "Invalid token signature",
      "Verification rejects"
    ],
    [
      "Missing tenant claim",
      "401 before adapter"
    ],
    [
      "Valid write token",
      "Adapter receives verified tenant and subject"
    ]
  ],
  "test_source": null,
  "test_command": "npx vitest run tests/orders.test.ts"
}