Mock CTO interview: preventing one customer from seeing another customer's orders (BOLA)

# ======================================================================
# Q: CTO: "How do you ensure that one customer cannot see another customer's
# orders?"
#
# You: "This is BOLA, the number 1 vulnerability in the OWASP API Top 10. I
# don't rely on the customer not knowing the IDs. The queryset is always
# filtered by tenant in get_queryset(), so a foreign id returns 404 and not 403,
# so it doesn't even leak that it exists. I have a test for every endpoint. I
# also use UUIDs for public IDs, but as an additional measure, not as the
# solution."
# ======================================================================

class OrderViewSet(viewsets.ReadOnlyModelViewSet):
    serializer_class = OrderV1Serializer
    permission_classes = [IsAuthenticated]

    def get_queryset(self):
        return Order.objects.filter(company_id=self.request.user.company_id)

def test_cannot_read_other_company_order(api_client, user_a, order_of_b):
    api_client.force_authenticate(user_a)
    r = api_client.get(f'/api/v1/orders/{order_of_b.pk}/')
    assert r.status_code == 404