عرض عملي: أداة حالة الطلب تحترم الملكية

خطوة بخطوة

1. Define get_order_status(orderId) with a typed schema.
2. Execute it by calling orders with the customer's bearer token.
3. Return a trimmed result or NOT_ALLOWED/NOT_FOUND (same shape for both, to avoid probing).
4. Write the test: customer A asks for customer B's order and gets no data.
5. Planned mistake: use a service account for the call; the test fails because B's order is visible. Fix by forwarding the user token.
6. Show the trace of the call in logs without the token value.