Initial commit: site monorepo with API, web, and infra.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-16 10:11:54 +03:00
commit 016910ffb7
447 changed files with 73972 additions and 0 deletions
@@ -0,0 +1,15 @@
+import { expect, test } from "@playwright/test";
+import { API_URL, registerVerifyLogin, uniqueEmail } from "../helpers/api";
+
+test.describe("§15.7 scenario 8: IDOR", () => {
+  test("user A cannot patch user B via admin route", async ({ request }) => {
+    const userA = await registerVerifyLogin(request, uniqueEmail("e2e-a"));
+    const userB = await registerVerifyLogin(request, uniqueEmail("e2e-b"));
+
+    const forbidden = await request.patch(`${API_URL}/api/v1/admin/users/${userB.user.id}`, {
+      headers: { Authorization: `Bearer ${userA.accessToken}` },
+      data: { status: "blocked" }
+    });
+    expect(forbidden.status()).toBe(403);
+  });
+});