{"id":"sec-dev-authz-test-cases","audience":"developers","category":"security","track":"security","technique":"context","title":"Write the test cases that prove an access fix works","free":false,"task":"You fixed an invoice access bug and need tests that prove it. Write exactly 4 test names as it(...) lines in exactly 1 code block (no test bodies), covering the 4 cases in the acceptance criteria, using the team's naming style from the existing tests. Under 20 words outside the code.","materialLabel":"The fix, acceptance criteria and existing tests (attached to your prompt automatically)","material":"Ticket BILL-412 (security fix): GET /api/invoices/:id/pdf returned any customer's invoice to any logged-in user.\n\nThe fix (billing-service/routes/invoices.js):\nrouter.get(\"/api/invoices/:id/pdf\", requireLogin, async (req, res) => {\n  const invoice = await Invoice.findById(req.params.id);\n  if (!invoice || (invoice.customerId !== req.user.customerId && req.user.role !== \"support\")) {\n    return res.status(404).end();\n  }\n  res.type(\"pdf\").send(await renderPdf(invoice));\n});\n\nAcceptance criteria:\n1. A customer can download their own invoice PDF (200).\n2. A customer gets 404 for another customer's invoice (not 403, so we don't reveal it exists).\n3. A request with no login gets 401.\n4. A support staff user can download any customer's invoice PDF (200).\n\nExisting tests in the same file, for naming style:\nit(\"returns 200 with JSON when a customer requests their own invoice\")\nit(\"returns 404 when a customer requests another customer's invoice JSON\")","rules":[{"type":"codeBlocks","count":1},{"type":"maxCodeLines","max":6},{"type":"maxProseWords","max":20}],"mistakes":[{"title":"Generic tests","why":"The AI writes its own cases, like 'handles errors', instead of your acceptance criteria.","fix":"Say: \"One test per acceptance criterion, exactly 4.\"","checks":["r0"]},{"title":"Ignoring the naming style","why":"The AI names tests 'should work for owner'.","fix":"Add: \"Match our style: returns <status> when ...\"","checks":["r1"]},{"title":"The textbook status code","why":"The AI expects 403 for another customer's invoice.","fix":"Ask: \"Another customer's invoice returns 404, not 403.\"","checks":["r2"]},{"title":"Full test files","why":"The AI writes setup, mocks and bodies you didn't ask for.","fix":"Limit it: \"Only 4 it(...) lines in 1 code block, no bodies.\"","checks":["codeBlocks","maxCodeLines","maxProseWords"]}],"promptHints":[{"label":"Uses the acceptance criteria","patterns":["acceptance criteria","criteri","4 cases"]},{"label":"Matches the naming style","patterns":["naming style","returns \\d+ when","existing tests","same style"]},{"label":"Asks for names only","patterns":["no (test )?bod","names only","it\\(","just the names"]},{"label":"Asks for one code block","patterns":["(one|1|single) code block","code block"]},{"label":"Limits the explanation","patterns":["\\d+\\s*words","short (note|explanation)","one (line|sentence)","no (explanation|prose|other text)"]}],"hint":"Security tests should prove exactly what the ticket promised. Point the AI at the acceptance criteria and your naming style, and ask for just the test names.","rubricLabels":["There are exactly 4 it(...) names, one per acceptance criterion: own invoice 200, another customer's invoice 404, no login 401, support user 200","The names follow the team style 'returns <status> when ...' and mention the PDF","The other-customer test expects 404 (not 403), and there are no test bodies or extra tests"]}