Check access rules

Test both allowed and denied access.

Test access with denied cases

Test both allowed and denied identities. Enforce access before reading or writing data. This lab uses synthetic data; testing one function does not validate production authentication.

A lock prevents entry before anyone sees the contents.

Authorize before reading data

Hiding a button is insufficient. Call the API as another account. The backend must deny access before returning content, and logs must not leak it.

A door lock must prevent entry, not merely hide the room sign.

Practice

Fix ticket-read policy and try a denied case.

Edit only canReadTicket in model.mjs: owner/member and an admin with a valid id may read; others or missing/invalid actors deny. Preserve original tests and run access tests. State that this lab has no real auth/backend.

Check your work

Owner, other member, admin and guest cases are covered.

Local policy is not presented as production security.

References