Missing authorisation check

What it looks like

• A handler that checks who you are and never checks what you may do.
• An ownership check removed because 'the route is already behind auth'.
• A permission looked up for the wrong resource, or the wrong workspace.

Why it survives review

Every test is written from the point of view of somebody who is allowed, because that is who the feature is for. The hole is only visible from the outside, by somebody who is not supposed to be there — and no test in the suite is written from that position.

How to see it

1. For every handler, name the resource and ask what makes *this* principal entitled to *this* one. Being logged in is not an answer.
2. Check the check is against the resource being acted on, not against a different one fetched nearby.
3. A deleted if in an auth path deserves more scrutiny than an added one.

A minimal pair

Any logged-in user can now edit any document, including ones belonging to other workspaces.

Practise it

1 diff in the corpus carry this class. They are not listed, because knowing which diff contains what would make finding it a comprehension question about this page.