advancedAuthorization

Rows From the Wrong Customer

Decide what you would build from the brief alone. Everything below it is available, but the exercise stops working if you open it first.

The brief you were given

A shared-schema SaaS returned another customer's rows from a reporting endpoint. One query was missing its tenant filter. Make this class of bug structurally impossible.

The trap — the wrong fix that looks right

Fixing the one query, adding a code-review checklist item, and moving on. The fix is correct and the control does not scale: it depends on every reviewer noticing an absence, which is the hardest thing to notice in a diff. The next leak comes from a query written under time pressure, or from a raw SQL report that bypasses the ORM's default scope entirely — a mechanism nobody thought of as "a query" at all.