// Skillstore example: a real Claude Code + public Skillstore connector review,
// using a deliberately vulnerable, fictional invoice endpoint. No customer code.
// Run locally: node --test invoice-review.mjs
// Retrieved method: Addy Osmani and contributors, Security and hardening v0.1.0.
// https://github.com/addyosmani/agent-skills/tree/1401c8b8030e023baeebb31781a6653fe8e93026/skills/security-and-hardening
// This illustrates the workflow, not an improvement against an unassisted agent.
import assert from "node:assert/strict";
import test from "node:test";

export function originalGetInvoice({ invoiceId, session }, invoices) {
  if (!session?.userId) return { status: 401 };
  const invoice = invoices.get(invoiceId);
  if (!invoice) return { status: 404 };
  return { status: 200, body: { id: invoice.id, total: invoice.total } };
}

export function getInvoice({ invoiceId, session }, invoices) {
  if (!session?.userId) return { status: 401 };
  const invoice = invoices.get(invoiceId);
  if (!invoice || invoice.orgId !== session.orgId) return { status: 404 };
  return { status: 200, body: { id: invoice.id, total: invoice.total } };
}

const invoices = new Map([["inv_1", { id: "inv_1", orgId: "org_a", total: 10 }]]);
const ownSession = { userId: "u_a", orgId: "org_a" };
const foreignSession = { userId: "u_b", orgId: "org_b" };

test("reproduce the original bug: another organization receives the invoice", () => {
  assert.deepEqual(originalGetInvoice({ invoiceId: "inv_1", session: foreignSession }, invoices),
    { status: 200, body: { id: "inv_1", total: 10 } });
});
test("patched: another organization cannot read the invoice", () => {
  assert.deepEqual(getInvoice({ invoiceId: "inv_1", session: foreignSession }, invoices), { status: 404 });
});
test("patched: the same organization can read the invoice", () => {
  assert.deepEqual(getInvoice({ invoiceId: "inv_1", session: ownSession }, invoices),
    { status: 200, body: { id: "inv_1", total: 10 } });
});
test("patched: an unauthenticated request stays unauthorized", () => {
  assert.deepEqual(getInvoice({ invoiceId: "inv_1", session: null }, invoices), { status: 401 });
});
test("patched: a missing invoice stays missing", () => {
  assert.deepEqual(getInvoice({ invoiceId: "missing", session: ownSession }, invoices), { status: 404 });
});