Rules Hub
Coding Rules Library
← Back to all rules
Rule priority, scope & exceptions
Use this to align rules with the senior-level structure (P0/P1/P2, scope, exceptions/tradeoffs).
backend ruleP0universalStack: Node.js
securityauthorizationidor
Scope data queries to the authenticated user
Always constrain read/update/delete queries for user-owned resources by the current user's id (or verify ownership before mutating). Filtering only by resource id lets any authenticated user access or modify another user's records — a broken-object-level-authorization (IDOR) vulnerability.
PR: profico-org-corpus batch2 (all stacks/products)Created: Jul 26, 2026
Bad example
Old codets
| 1 | async function endBooking(bookingId) { |
| 2 | const booking = await Booking.findOne({ where: { id: bookingId } }); |
| 3 | booking.endTime = new Date(); |
| 4 | await booking.save(); |
| 5 | } |
Explanation (EN)
Any logged-in user can end any booking by guessing an id — ownership is never checked.
Objašnjenje (HR)
Good example
New codets
| 1 | async function endBooking(bookingId, userId) { |
| 2 | const booking = await Booking.findOne({ where: { id: bookingId, userId } }); |
| 3 | if (!booking) throw new NotFoundError(); |
| 4 | booking.endTime = new Date(); |
| 5 | await booking.save(); |
| 6 | } |
Explanation (EN)
Constraining by userId ensures a user can only touch their own records.
Objašnjenje (HR)