POC: a tiny authorisation regression test
Executable Python with synthetic data: test the policy decision without a network request.
What this demonstrates
This proof of concept is an original teaching example. It makes no network connections and does not target a real product. It shows how to encode an ownership rule as a small test so its intended behaviour is explicit.
Run the local example
Save the code as ownership_test.py and run it with Python 3. It uses only the standard library. The tests cover ownership, a different user, missing identity and a missing owner.
import unittest
def can_read(user_id, document):
owner = document.get("owner")
return user_id is not None and owner is not None and user_id == owner
class OwnershipTests(unittest.TestCase):
def test_owner_allowed(self):
self.assertTrue(can_read("alice", {"owner": "alice"}))
def test_other_user_denied(self):
self.assertFalse(can_read("bob", {"owner": "alice"}))
def test_anonymous_denied(self):
self.assertFalse(can_read(None, {"owner": "alice"}))
def test_missing_owner_denied(self):
self.assertFalse(can_read("alice", {}))
if __name__ == "__main__":
unittest.main()
Understand the limits
The function is deliberately small. A real system may also need tenant rules, explicit sharing, administrative permissions and separate policies for different actions. The point is to make those rules testable, not to replace a complete application policy with this example.
Extend the exercise
Add an explicit sharing list and write the expected cases before changing the function. Decide how read permission differs from update permission. Test that a missing or malformed property cannot silently become permission.
Connect it to remediation
A fix is easier to maintain when its intended boundary is captured in tests. Keep test records synthetic, document the business rule and review the policy whenever roles or sharing behaviour change.