Demo: an order-status tool that respects ownership
On This Lesson 3 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
build a read-only tool that cannot leak another customer's order. Prepares MID-069-LAB1.
Draft outline details
Step by step
- Define
get_order_status(orderId)with a typed schema. - Execute it by calling
orderswith the customer's bearer token. - Return a trimmed result or
NOT_ALLOWED/NOT_FOUND(same shape for both, to avoid probing). - Write the test: customer A asks for customer B's order and gets no data.
- Planned mistake: use a service account for the call; the test fails because B's order is visible. Fix by forwarding the user token.
- Show the trace of the call in logs without the token value.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.