/**
 * IDOR / broken-access-control precision regression suite.
 *
 * Guards the three targeted false-positive fixes shipped to address ~7 dogfood
 * false positives on routes that ARE correctly authorized:
 *
 *   Fix 1 — Trusted origins: values derived from `supabase.auth.getUser()`,
 *            `getServerSession()` etc. are server-derived, not request taint.
 *            A tenant filter bound to such a value is correct and must NOT fire.
 *
 *   Fix 2 — Tenant-column gate: only flag when the column being filtered by a
 *            request-derived value IS a tenant-boundary column (user_id, org_id …).
 *            `.eq('branch', req.query.branch)` while `.eq('user_id', session.user.id)`
 *            is present must NOT fire.
 *
 *   Fix 3 — Guard middleware: a handler that calls `getAdminOrError()`,
 *            `requireUser()`, `requireAuth()`, `withAuth()`, or `getServerSession()`
 *            is considered authorized — must NOT fire.
 *
 * Recall guard: a genuinely vulnerable route (tenant column bound directly to a
 * request value, no session check) MUST still produce a finding.
 */
export {};
//# sourceMappingURL=idor-precision.test.d.ts.map