Run an Authorization Matrix as a Test

Background

Broken object-level authorization hides in the gaps between roles. Writing the expected statuses as data turns access control into a regression test instead of a code review opinion.

Problem

Given the expected status code for each actor case and the statuses the endpoint actually returned, report whether the matrix passed and which cases diverged.

Input

JSON object: { cases: [{ name, expected }], actual: { [name]: number } }

Output

JSON object: { passed: boolean, failed: string[] }

Sample tests

Input: {"cases":[{"name":"anonymous","expected":401},{"name":"owner","expected":200},{"name":"admin","expected":200}],"actual":{"anonymous":401,"owner":200,"admin":403}}

Expected: {"passed":false,"failed":["admin"]}

Input: {"cases":[{"name":"other-tenant","expected":404},{"name":"same-tenant","expected":403}],"actual":{"other-tenant":404,"same-tenant":403}}

Expected: {"passed":true,"failed":[]}

Your solution

Learning objective

Express authorization expectations as a failing test before changing endpoint code.