IDOR / ownership protection const change = await prisma.changeRequest.findUnique({ where: { id }, });
if (!change) { throw new AppError("Change request not found", 404); }
if ( user.role === "REQUESTER" && change.requesterId !== user.id ) { throw new AppError("Forbidden", 403); }
Caption: Requesters can only access their own change requests, preventing unauthorized object access.
Log in or sign up for Devpost to join the conversation.