First review: authorization regression

Scope and prerequisites

New to the approach? Read why AI-generated code still needs security review, then use the review workflow to define scope and evidence. Follow the safety boundaries before sharing any real input.

This tutorial supports the authentication/API topics in our editorial backlog. Use Node.js 24+ and a disposable local directory. No server, credentials, real user data, or provider is involved. Linmas 0.8.0 instructions were checked on 2026-09-08; no Codex or Claude host run is claimed.

1. Inspect the complete input

Save the following as authorization-review.mjs, or download the fixture. The deliberately vulnerable branch is for local learning only.

import assert from 'node:assert/strict';

// Synthetic, in-memory fixture: never deploy the deliberately vulnerable variant.
const documents = [{ id: 'doc-1', owner: 'alice', text: 'Synthetic note' }];
function readDocument(user, id, enforceOwner) {
  if (!user || typeof user.id !== 'string' || !user.id) return { status: 401 };
  if (typeof id !== 'string' || !/^doc-[0-9]+$/.test(id)) return { status: 400 };
  const document = documents.find((entry) => entry.id === id);
  if (!document || (enforceOwner && document.owner !== user.id)) return { status: 404 };
  return { status: 200, body: document.text };
}

assert.equal(readDocument({ id: 'bob' }, 'doc-1', false).status, 200);
console.log('BEFORE: reproduced cross-user read in the deliberately vulnerable fixture.');
assert.equal(readDocument({ id: 'bob' }, 'doc-1', true).status, 404);
assert.equal(readDocument({ id: 'alice' }, 'doc-1', true).status, 200);
assert.equal(readDocument(null, 'doc-1', true).status, 401);
assert.equal(readDocument({ id: 'alice' }, '../secret', true).status, 400);
assert.equal(readDocument({ id: 'alice' }, 'doc-9', true).status, 404);
console.log('AFTER: cross-user denied; owner allowed; anonymous, invalid, and missing inputs handled.');

2. Request a bounded review

After installing and verifying Secure Code Reviewer, supply this fixture to your authorized host:

Review authorization-review.mjs using linmas-secure-code-reviewer. Trace whether Bob can read Alice's document when enforceOwner is false. Separate evidence from assumptions; propose the smallest fix and tests for owner, cross-user, anonymous, malformed, and missing-document requests. Do not modify files or call a live provider.

Submitting a prompt to a hosted agent may send its context to that provider. The command below needs no agent; this page contains a human-authored illustrative finding, not captured model output.

3. Inspect the finding and fix

Confirmed in this fixture: Bob receives status 200 when ownership enforcement is disabled. Looking up an object by ID is not authorization. The fix compares the authenticated user ID with the stored owner before returning the body. Derive identity from trusted server authentication, never a client-supplied owner field.

The example uses 404 for both absent and inaccessible documents. Review that choice against your API contract; keep legitimate owner access working. Production code must always enforce ownership rather than expose this teaching toggle.

4. Run regression verification

node authorization-review.mjs

If Node is unavailable or the file cannot be found, follow installation troubleshooting. Run this command from the directory containing the downloaded file, or pass its quoted absolute path.

Expected exit code: 0. Expected output:

BEFORE: reproduced cross-user read in the deliberately vulnerable fixture.
AFTER: cross-user denied; owner allowed; anonymous, invalid, and missing inputs handled.

An assertion failure exits nonzero. Review the failing case rather than removing the assertion. These checks exercise in-memory authorization only: they do not test sessions, database queries, tenant roles, transport, or concurrent updates.

5. Record the evidence

Record the input revision, command, runtime, observed output, test gaps, and human disposition. Local assertions are not a Linmas Review Capsule or proof of a model review. For recorded provider evidence, follow Review Capsule documentation with explicit consent and a sanitized input.

Continue with the review method or route a multi-domain change. Human review remains required.