{
  "filename": "server/api/orders/[id]/cancel.post.ts",
  "rule": "- name: nuxt-mutation-tenant-scope\n  where: \"server/api/orders/[id]/cancel.post.ts\"\n  ensure: >-\n    The API cancellation must use tenantId from the required user session in its database mutation.",
  "corrected": "import { db } from \"../../../utils/db\";\n\nexport default defineEventHandler(async event => {\n  const { user } = await requireUserSession(event);\n  if (!user?.id || !user?.tenantId) throw createError({statusCode:401});\n  const id = getRouterParam(event, \"id\");\n  if (!id) throw createError({statusCode:400});\n  const changed = await db.cancelPending({\n    id, tenantId:user.tenantId, ownerId:user.id,\n  });\n  if (changed !== 1) throw createError({statusCode:404});\n  return {cancelled:true};\n});\n",
  "broken": "import { db } from \"../../../utils/db\";\n\nexport default defineEventHandler(async event => {\n  const { user } = await requireUserSession(event);\n  if (!user?.id || !user?.tenantId) throw createError({statusCode:401});\n  const id = getRouterParam(event, \"id\");\n  if (!id) throw createError({statusCode:400});\n  const changed = await db.cancelPending({\n    id, ownerId:user.id,\n  });\n  if (changed !== 1) throw createError({statusCode:404});\n  return {cancelled:true};\n});\n",
  "regression": [
    "tenantId:user.tenantId, ",
    ""
  ],
  "test_scenarios": [
    [
      "Verified owner in tenant",
      "One conditional mutation"
    ],
    [
      "No session",
      "Authentication rejection"
    ],
    [
      "Forged tenant in body",
      "Ignored; session scope controls query"
    ],
    [
      "Other tenant resource id",
      "No change and 404"
    ]
  ],
  "test_source": null,
  "test_command": "npx vitest run tests/server/cancel-order.test.ts"
}