{
  "filename": "src/main/java/example/CancelOrder.java",
  "rule": "- name: method-security-write-authority\n  where: \"src/main/java/example/CancelOrder.java\"\n  ensure: >-\n    The public cancel service method must require orders:write with @PreAuthorize before invoking the mutation repository.",
  "corrected": "package example;\nimport org.springframework.security.access.prepost.PreAuthorize;\nimport org.springframework.stereotype.Service;\nimport org.springframework.transaction.annotation.Transactional;\n\n@Service\npublic class CancelOrder {\n    private final OrderRepository orders;\n    public CancelOrder(OrderRepository orders) { this.orders = orders; }\n    @PreAuthorize(\"hasAuthority('orders:write')\")\n    @Transactional\n    public void cancel(Actor actor, long id) {\n        int changed = orders.cancelPending(id, actor.tenantId(), actor.userId());\n        if (changed != 1) throw new IllegalArgumentException(\"Order not available\");\n    }\n}\n",
  "broken": "package example;\nimport org.springframework.security.access.prepost.PreAuthorize;\nimport org.springframework.stereotype.Service;\nimport org.springframework.transaction.annotation.Transactional;\n\n@Service\npublic class CancelOrder {\n    private final OrderRepository orders;\n    public CancelOrder(OrderRepository orders) { this.orders = orders; }\n    @Transactional\n    public void cancel(Actor actor, long id) {\n        int changed = orders.cancelPending(id, actor.tenantId(), actor.userId());\n        if (changed != 1) throw new IllegalArgumentException(\"Order not available\");\n    }\n}\n",
  "regression": [
    "    @PreAuthorize(\"hasAuthority('orders:write')\")\n",
    ""
  ],
  "test_scenarios": [
    [
      "Authenticated read-only principal",
      "Denied before repository mutation"
    ],
    [
      "orders:write principal with owned pending row",
      "One update"
    ],
    [
      "Cross-tenant id",
      "Zero rows and rejection"
    ],
    [
      "Security annotation removed",
      "Negative permission test fails"
    ]
  ],
  "test_source": null,
  "test_command": "./mvnw test -Dtest=CancelOrderSecurityTest"
}