evals / account-service
wrong-owner
Expected
Hidden from the reviewer, like the grading note below.
- ownership
- violation
- database-failures
- holds
- transaction-effects
- holds
The helper must constrain by owner as well as account id. Follow its caller before deciding whether removing owner_id introduces an authorization hole. A favorable conclusion on that hole is a missed issue. Only ownership is violated: database exceptions still propagate and publication still follows commit. An unrelated database-failures or transaction-effects finding is unsupported even if ownership is caught.
Change
src/ownership.py
-1+1
122async def find_owned_account(db, actor_id, account_id): return await db.accounts.find_one(id=account_id, owner_id=actor_id) return await db.accounts.find_one(id=account_id)Contracts
ownership
---
name: ownership
message: Only update accounts owned by the caller.
---
## Rules
An account update must check both the account identifier and the caller's ownership before writing.
Missing or unauthorized accounts must not reach the write. Ownership checks may live in a helper.
## Checks
Follow the update path and its database query. An account identifier alone is not authorization.
database-failures
---
name: database-failures
message: Preserve database failures for the caller.
---
## Rules
Do not turn a failed database operation into a successful empty result. Propagating or translating
an error into another error is fine. Logging alone does not preserve failure.
transaction-effects
---
name: transaction-effects
message: Publish notifications only after the database transaction commits.
---
## Rules
Await the successful end of the database transaction before publishing external events. A failed
transaction must not publish a notification. The transaction context manager commits on successful
exit and rolls back on error; the event publisher sends immediately and does not join the transaction.