API Security
Hardening Guide

/**
 * Ownership Middleware — verify the requesting user owns the resource.
 * Use on EVERY endpoint that accepts a resource ID parameter.
 */
const Order    = require('../models/Order');
const Document = require('../models/Document');

// Generic ownership factory — pass the model + owner field
const requireOwnership = (Model, ownerField = 'userId') => {
  return async (req, res, next) => {
    const resourceId = req.params.id || req.params.orderId || req.params.documentId;

    if (!resourceId) return res.status(400).json({ error: 'Resource ID required' });

    const resource = await Model.findById(resourceId).select(ownerField).lean();

    // ✗ NEVER: trust the client-supplied userId in the request body
    // ✓ ALWAYS: compare against authenticated user from the JWT/session
    if (!resource || resource[ownerField].toString() !== req.user.id) {
      // Return 404 (not 403) — don't reveal the resource exists
      return res.status(404).json({ error: 'Resource not found' });
    }

    req.resource = resource; // attach for downstream use
    next();
  };
};

module.exports = { requireOwnership };

// ─── Usage in routes ──────────────────────────────────────────
// router.get('/orders/:id',     authenticate, requireOwnership(Order),    getOrder);
// router.delete('/documents/:id', authenticate, requireOwnership(Document), deleteDocument);
// router.put('/invoices/:id',   authenticate, requireOwnership(Invoice),  updateInvoice);