[arko33]

What

GET /api/invoices/:id skipped the ownership check whenever SECURE_MODE was not on, so any caller could read another owner's invoice — BOLA / OWASP API1:2023 #1.

Ownership is now enforced unconditionally and the env-var gate is gone, so no deployment can silently turn the hole back on.

-  if (!isSecureMode()) {
-    return { invoice, allowed: true };
-  }
   const allowed = invoice.ownerId === requestingUserId;
   return { invoice, allowed };

Behaviour

Caller	Before	After
alice → inv-1001 (own)	200	200
bob → inv-1001 (not own)	200 + full payload	403
bob → inv-9999 (missing)	404	404
no x-user-id	401	401

403 vs 404 is preserved so a caller who cannot read an invoice also cannot probe whether the id exists.

Also in this PR

• docs/openapi.json — the contract the TestSprite suite is built from (invoices + health + autopsy, inline schemas, no $ref)
• docs/test-prd.md — the PRD the generated tests assert against
• README no longer documents SECURE_MODE; there is nothing to configure

Verification

curl -H "x-user-id: bob" https://ghostinthecodebase.vercel.app/api/invoices/inv-1001   # 403 after merge

Typecheck passes (npx tsc --noEmit). The TestSprite suite pins all four rows above.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
ghostinthecodebase	Ready	Preview	Oct 21, 2026 12:37am UTC

[testsprite]

Test Run In Progress

TestSprite has queued 13 tests for ghostinthecodebase and will run them against this PR's deployment: https://ghostinthecodebase-git-fix-bola-guard-ako-7127.vercel.app.

This comment will update automatically when the run completes. View Execution Live ↗

---

_{Automated end-to-end testing powered by}