Find the missing authorization boundary.

01 / Inspect the code

Authenticated does not mean authorized.

This deliberately unsafe handler lets any signed-in account access an object by ID. The guarded version scopes each query to its caller's tenant.

// Deliberately vulnerable: authentication alone is insufficient
async function readDocument(session, documentId) {
  if (!session) return { status: 401 };
  const document = await db.document.findUnique({
    where: { id: documentId }
  });
  if (!document) return { status: 404 };
  return { status: 200, body: document };
}

Review finding: the database lookup lacks a tenant predicate. The session check cannot enforce resource ownership.

02 / Run a synthetic request

Returning another tenant's document is a confirmed flaw in the synthetic unsafe handler.