{
  "filename": "app/Policies/OrderPolicy.php",
  "rule": "The update policy grants access only when the authenticated user id equals the order user_id. It must not return true for a different user.",
  "fixed": "<?php\n\nnamespace App\\Policies;\n\nuse App\\Models\\Order;\nuse App\\Models\\User;\n\nclass OrderPolicy\n{\n    public function update(User $user, Order $order): bool\n    {\n        return (int) $user->id === (int) $order->user_id;\n    }\n}\n",
  "broken": "<?php\n\nnamespace App\\Policies;\n\nuse App\\Models\\Order;\nuse App\\Models\\User;\n\nclass OrderPolicy\n{\n    public function update(User $user, Order $order): bool\n    {\n        return true;\n    }\n}\n",
  "test": {
    "filename": "tests/Unit/OrderPolicyTest.php",
    "source": "<?php\n\nnamespace Tests\\Unit;\n\nuse App\\Models\\Order;\nuse App\\Models\\User;\nuse App\\Policies\\OrderPolicy;\nuse Tests\\TestCase;\n\nclass OrderPolicyTest extends TestCase\n{\n    public function test_only_owner_can_update(): void\n    {\n        $owner = new User();\n        $owner->id = 10;\n        $other = new User();\n        $other->id = 11;\n        $order = new Order();\n        $order->user_id = 10;\n        $policy = new OrderPolicy();\n        $this->assertTrue($policy->update($owner, $order));\n        $this->assertFalse($policy->update($other, $order));\n    }\n}\n",
    "command": "php artisan test --filter=OrderPolicyTest"
  }
}