Evidence Board

Review this authenticated application’s authorization boundaries without changing code first.

Identify every protected view and its direct URL, required authentication state, required permission or role, and permitted data scope.

Then propose and implement authorization tests that call the protected URLs directly rather than relying only on whether navigation links are visible.

For each protected URL, test:

- An anonymous visitor is redirected to login or denied.
- An authenticated user without the required permission receives `403 Forbidden`.
- An authenticated user cannot access another user’s private record by changing the URL identifier.
- A manager cannot access records belonging to a team they do not manage.
- A properly authorized user can access the view.
- A superuser can access the view when appropriate.
- Unauthorized POST requests do not change the database.
- Missing records return `404` without exposing unrelated data.

Keep template tests that verify role-appropriate links are displayed or hidden, but treat those as presentation tests only. Enforce authorization in the server-side view.

Before implementing, provide:

1. A protected-route inventory.
2. The expected result for each role and route.
3. The test files you propose to change.
4. Any authorization weakness discovered in the current views.
5. The exact database state that must remain unchanged after denied requests.

Wait for Pilot in Command approval before changing files. After approval, implement the tests, run the complete test suite, and report successful paths, denied paths, failures, and limitations.