{
  "filename": "src/routes/orders/[id]/+page.server.ts",
  "rule": "- name: action-tenant-predicate\n  where: \"src/routes/orders/[id]/+page.server.ts\"\n  ensure: >-\n    The cancellation action must pass locals.user.tenantId to the conditional database mutation, not only orderId and ownerId.",
  "corrected": "import { error, fail } from \"@sveltejs/kit\";\nimport type { Actions } from \"./$types\";\nimport { db } from \"$lib/server/db\";\n\nexport const actions: Actions = {\n  cancel: async ({locals,params}) => {\n    if (!locals.user) error(401, \"Sign in required\");\n    const changed = await db.cancelPending({\n      orderId:params.id, tenantId:locals.user.tenantId, ownerId:locals.user.id,\n    });\n    if (changed !== 1) return fail(404, {unavailable:true});\n    return {cancelled:true};\n  },\n};\n",
  "broken": "import { error, fail } from \"@sveltejs/kit\";\nimport type { Actions } from \"./$types\";\nimport { db } from \"$lib/server/db\";\n\nexport const actions: Actions = {\n  cancel: async ({locals,params}) => {\n    if (!locals.user) error(401, \"Sign in required\");\n    const changed = await db.cancelPending({\n      orderId:params.id, ownerId:locals.user.id,\n    });\n    if (changed !== 1) return fail(404, {unavailable:true});\n    return {cancelled:true};\n  },\n};\n",
  "regression": [
    "tenantId:locals.user.tenantId, ",
    ""
  ],
  "test_scenarios": [
    [
      "Signed out",
      "401 before database call"
    ],
    [
      "Owned pending row",
      "Success"
    ],
    [
      "Cross-tenant id",
      "Zero scoped changes and 404 failure"
    ],
    [
      "Second cancellation",
      "No repeated state transition"
    ]
  ],
  "test_source": null,
  "test_command": "npx vitest run tests/cancel-action.test.ts"
}