Least privilege, every requestLeast privilege, every request

Change the ID in the URL

Signed in as Ava at Northwind. Try another invoice ID.

export async function GET(req, { params }) {
  const user = await getAuthenticatedUser();
  if (!user) return new Response(null, { status: 401 });

  const { data, error } = await db.from("invoices")
    .select("*")
    .eq("id", params.id)
    .eq("company_id", user.companyId) // ownership lives in the query
    .maybeSingle();

  if (error) return new Response(null, { status: 500 });
  // 404, not 403: don't confirm that someone else's ID exists
  if (!data) return new Response(null, { status: 404 });
  return Response.json(data);
}

Edit roles, then call the API

Tick permissions, pick a role, and Send hidden actions.

Switch off one layer

Toggle layers and watch which attacks reach the data.

app.use(requireHttps);                                      // HSTS, Secure cookies
app.use(rateLimit({ windowMs: 15 * 60 * 1000, max: 100 })); // 429
app.use(authenticate);                                      // 401
app.use(validate(schema));                                  // Zod, unknown keys stripped
app.use(authorize);                                         // role + ownership, 403

-- in the database
create policy tenant_isolation on invoices
  using (company_id in (
    select company_id from company_users where user_id = auth.uid()
  ));

Why it matters, pros and cons