Find why these generated authorization tests can pass without protecting tenant isolation.
JavaScript
import assert from "node:assert/strict";
function canRead(user, record) {
return user.tenantId === record.tenantId;
}
const tenantA = { tenantId: "a" };
const tenantBRecord = { tenantId: "b" };
function generatedTest() {
const canRead = () => true;
assert.equal(canRead(tenantA, tenantBRecord), true);
try {
canRead(tenantA, tenantBRecord);
} catch {
assert.ok(true);
}
}
generatedTest();