Problem Statement
Design robust authorization checks for an API that serves user-owned objects.
Explanation
Enforce ownership at every read and write. Do not rely on the client to hide IDs. Check object access with server-side lookups and role rules. Validate both object-level and property-level authorization so users cannot set privileged fields. Log deny decisions for audit. Add tests for IDOR and for mass-assignment paths. This aligns with OWASP API Top 10 guidance and reduces high-impact data leaks.
Code Solution
SolutionRead Only
const obj = await repo.get(id); if (obj.owner !== auth.userId) return 403; const allowed = pick(body, editableFieldsFor(auth));
