{
  "filename": "R/order_module.R",
  "rule": "- name: write-observer-checks-permission\n  where: \"R/order_module.R\"\n  ensure: >-\n    The cancellation observeEvent must require identity$can_cancel before invoking updateOrder, not just a non-null identity.",
  "corrected": "orderServer <- function(id, actor, updateOrder) {\n  shiny::moduleServer(id, function(input, output, session) {\n    shiny::observeEvent(input$cancel, {\n      identity <- actor()\n      shiny::req(!is.null(identity), isTRUE(identity$can_cancel))\n      shiny::req(is.character(input$order_id), length(input$order_id) == 1L)\n      updateOrder(identity$tenant_id, identity$user_id, input$order_id)\n    })\n  })\n}\n",
  "broken": "orderServer <- function(id, actor, updateOrder) {\n  shiny::moduleServer(id, function(input, output, session) {\n    shiny::observeEvent(input$cancel, {\n      identity <- actor()\n      shiny::req(!is.null(identity))\n      shiny::req(is.character(input$order_id), length(input$order_id) == 1L)\n      updateOrder(identity$tenant_id, identity$user_id, input$order_id)\n    })\n  })\n}\n",
  "regression": [
    "      shiny::req(!is.null(identity), isTRUE(identity$can_cancel))",
    "      shiny::req(!is.null(identity))"
  ],
  "test_scenarios": [
    [
      "Permitted session",
      "Scoped adapter invoked"
    ],
    [
      "Read-only session sends cancel input",
      "req prevents write"
    ],
    [
      "Two sessions",
      "Separate actor context, no global identity"
    ],
    [
      "Forged order id",
      "Adapter enforces ownership"
    ]
  ],
  "test_source": null,
  "test_command": "Rscript -e 'testthat::test_file(\"tests/testthat/test-order-module.R\")'"
}