Submission: Whose record is this?
Name / student identifier:
Before the repair
- Who was the demonstration user?
- What happened when you requested 101? What happened for 102?
- Why is the second result incorrect under the lesson's ownership rule?
Your repair
Attach your edited authorize.mjs. Explain what the comparison checks. Confirm you saved and restarted the server.
Verification
| Request | Expected result | Your observed status and result |
|---|---|---|
| 101 | Allowed | |
| 102 | Denied without Sam's record | |
| 999 | Not found | |
| abc | Invalid request |
Paste the output of node checks.mjs here. If you could not run it, explain what stopped you; do not claim unperformed checks passed.
Explain
- Why does knowing a record ID not give permission to read it?
- Why is hiding the request button insufficient?
- Why must we test Alex's access as well as Sam's denial?
- Which part was supplied instead of implemented: authentication or authorization?