{
  "filename": "src/shop/orders.clj",
  "rule": "- name: ring-write-permission\n  where: \"src/shop/orders.clj\"\n  ensure: >-\n    The handler must reject a session actor without :orders/write before calling cancel-pending.",
  "corrected": "(ns shop.orders)\n\n(defn cancel-handler [cancel-pending]\n  (fn [request]\n    (let [actor (get-in request [:session :actor])\n          order-id (get-in request [:path-params :id])]\n      (cond\n        (nil? actor) {:status 401 :body \"Sign in required\"}\n        (not (contains? (:permissions actor) :orders/write))\n          {:status 403 :body \"Permission required\"}\n        :else\n          (let [changed (cancel-pending (:tenant-id actor) (:user-id actor) order-id)]\n            (if (= 1 changed)\n              {:status 204 :body \"\"}\n              {:status 404 :body \"Order not available\"}))))))\n",
  "broken": "(ns shop.orders)\n\n(defn cancel-handler [cancel-pending]\n  (fn [request]\n    (let [actor (get-in request [:session :actor])\n          order-id (get-in request [:path-params :id])]\n      (cond\n        (nil? actor) {:status 401 :body \"Sign in required\"}\n        :else\n          (let [changed (cancel-pending (:tenant-id actor) (:user-id actor) order-id)]\n            (if (= 1 changed)\n              {:status 204 :body \"\"}\n              {:status 404 :body \"Order not available\"}))))))\n",
  "regression": [
    "        (not (contains? (:permissions actor) :orders/write))\n          {:status 403 :body \"Permission required\"}\n",
    ""
  ],
  "test_scenarios": [
    [
      "Missing session actor",
      "401"
    ],
    [
      "Read-only actor",
      "403, no adapter call"
    ],
    [
      "Permitted actor",
      "Trusted tenant/user forwarded"
    ],
    [
      "Other tenant id",
      "Conditional adapter rejects"
    ]
  ],
  "test_source": null,
  "test_command": "clojure -M:test"
}