{
  "filename": "app/api/orders/[id]/route.ts",
  "rule": "- name: private-order-cache\n  where: \"app/api/orders/[id]/route.ts\"\n  ensure: >-\n    The GET handler response for an authenticated order must set Cache-Control to private, no-store. It must never advertise public caching.",
  "corrected": "import { NextRequest, NextResponse } from \"next/server\";\nimport { requireActor } from \"@/lib/auth\";\nimport { prisma } from \"@/lib/db\";\n\nexport async function GET(request: NextRequest,\n  context: { params: Promise<{ id: string }> }) {\n  const actor = await requireActor();\n  const { id } = await context.params;\n  const order = await prisma.order.findFirst({\n    where: { id, tenantId: actor.tenantId, ownerId: actor.id },\n    select: { id: true, status: true },\n  });\n  return NextResponse.json(order ?? { error: \"Not found\" }, {\n    status: order ? 200 : 404,\n    headers: { \"Cache-Control\": \"private, no-store\" },\n  });\n}\n",
  "broken": "import { NextRequest, NextResponse } from \"next/server\";\nimport { requireActor } from \"@/lib/auth\";\nimport { prisma } from \"@/lib/db\";\n\nexport async function GET(request: NextRequest,\n  context: { params: Promise<{ id: string }> }) {\n  const actor = await requireActor();\n  const { id } = await context.params;\n  const order = await prisma.order.findFirst({\n    where: { id, tenantId: actor.tenantId, ownerId: actor.id },\n    select: { id: true, status: true },\n  });\n  return NextResponse.json(order ?? { error: \"Not found\" }, {\n    status: order ? 200 : 404,\n    headers: { \"Cache-Control\": \"public, max-age=300\" },\n  });\n}\n",
  "regression": [
    "\"private, no-store\"",
    "\"public, max-age=300\""
  ],
  "test_scenarios": [
    [
      "Authorized response",
      "200 with private, no-store"
    ],
    [
      "Scoped miss",
      "404 with private, no-store"
    ],
    [
      "Second user requests same URL",
      "No previous response reused by a shared cache"
    ],
    [
      "Deployment adds a CDN rule",
      "Headers and cache behavior checked at the edge"
    ]
  ],
  "test_source": null,
  "test_command": "npx vitest run tests/private-order-response.test.ts"
}