server.mjs · test.mjs
Test the endpoint, not the navigation.
Removing an admin link changes what people see. It does not decide who can read the data. On your own local app, request the inbox endpoint without signing in:
curl -i http://127.0.0.1:3000/api/admin/enquiriesThe reference returns 401 with a short sign-in error. If your app returns records, the server needs an authorization check before loading or returning them. A browser redirect after the response is too late.
Check every action.
Reading the list, requesting an AI draft, and changing review status are separate routes. Each needs the operator check. Test both the anonymous failure and the permitted action after login. Verify logout actually invalidates the server-side session.
The source uses a random session cookie, HttpOnly, SameSite=Strict, and Secure on HTTPS. These are parts of the design; no single cookie flag replaces permission checks. Host and origin checks reject requests coming from a different browser origin.
One operator is a real limitation.
This app has one shared operator role. It has no per-customer isolation. If your project needs accounts for different companies, add a proper ownership model and test user B attempting to read and change user A’s records. Do not share the operator password as a substitute.
Read the human-review lesson and OWASP’s authorization guidance.
Prove it before moving on.
- A direct anonymous request returns no private records.
- All write routes also check permission.
- Signing out invalidates the session.
Use these as checks in your own app. This page does not store course progress.