Negative Authorization Tests Present

A test suite that only verifies authorized access never tests the actual security boundary — it confirms the happy path works but leaves the failure path untested. CWE-284 (Improper Access Control) vulnerabilities frequently survive code review and ship to production because no test ever checked that unauthorized access was rejected. OWASP A01 (Broken Access Control) is the top web application risk; the absence of negative authorization tests means any refactor can silently remove a permission check with no failing test to signal the regression. NIST 800-53 CA-8 (Penetration Testing) requires verifying that security controls reject unauthorized access — automated negative tests are the continuous equivalent.

Add tests that deliberately simulate unauthorized access and assert rejection. One negative test per critical authorization boundary is the minimum — the goal is catching regressions when authorization logic is refactored.

// __tests__/api/posts.test.ts
describe('POST /api/posts/:id - authorization', () => {
  it('returns 404 when user tries to update a post they do not own', async () => {
    const { userA, userB } = await createTestUsers();
    const postByUserB = await createPost(userB);

    const response = await fetch(`/api/posts/${postByUserB.id}`, {
      method: 'PATCH',
      headers: { Authorization: `Bearer ${userA.token}` },
      body: JSON.stringify({ title: 'Hijacked' }),
    });

    expect(response.status).toBe(404); // or 403
  });
});

If the test file __tests__/api/ does not yet exist, create it alongside the route handler file.