deckhearth/lib/auth/requireAccess.js

/**
 * AccessGrant authorization (L2 audit fix: AccessGrant join for AuthZ / IDOR prevention).
 * Per AGENTS.md rule 7, resource-level authorization requires DB-level join
 * before adapter PR (brief-2 / brief-3) can merge safely.
 */

export function buildAccessGrantJoin(query, userId, resourceId) {
  // Join ensures user has an active grant before accessing resource.
  return `
    LEFT JOIN access_grants ag
      ON ag.resource_id = ${resourceId}
      AND ag.user_id = ${userId}
      AND ag.status = 'granted'
    WHERE (ag.id IS NOT NULL OR resource_owner = ${userId})
  `;
}