Fix BOLA (Broken Object Level Authorization) in Spiral

BOLA (Broken Object Level Authorization) is the low-hanging fruit that sinks ships. In Spiral, this vulnerability manifests when developers trust the ID provided in the URI/Request without verifying if the authenticated user has the right to access that specific object. If you're blindly hitting repository methods with raw user input, you're leaking data.

The Vulnerable Pattern

public function getInvoice(string $id, InvoiceRepository $invoices): array
{
    // VULNERABLE: Any authenticated user can access any invoice by guessing the ID
    $invoice = $invoices->findByPK($id);
if ($invoice === null) {
    throw new NotFoundException();
}

return $invoice->toArray();
}

The Secure Implementation

The fix is simple: stop trusting the client. In the vulnerable example, the code only checks if the object exists, not who it belongs to. The secure implementation uses Spiral's GuardInterface to grab the current actor's context and forces the Cycle ORM to include the 'user_id' in the SQL WHERE clause. This ensures that even if an attacker guesses a valid UUID, the database will return null because the ownership check fails at the query level. For complex scenarios, use Spiral's RBAC/Permissions component to define explicit 'view' policies for specific resource instances.

public function getInvoice(string $id, InvoiceRepository $invoices, GuardInterface $guard): array
{
    $user = $guard->getUser()->getEntity();
// SECURE: Query is scoped to the current user's ID
$invoice = $invoices->findOne([
    'id' => $id,
    'user_id' => $user->getId()
]);

if ($invoice === null) {
    // Return 404 to prevent ID enumeration/discovery
    throw new NotFoundException();
}

return $invoice->toArray();
}