#0105
A blogging platform stores posts and the comments attached to them. Access to comments is supposed to be restricted to the owner of the parent post.
The getComment function fetches a comment by ID and returns it — but never checks whether the requesting user owns the parent post.
Any authenticated user can read the comments on any post by guessing comment IDs, bypassing the post's visibility settings.
Nested resource endpoints (e.g. /posts/:postId/comments/:commentId) must enforce ownership at every level. Checking only the leaf resource misses the hierarchy of access controls.
getComment so it verifies the requesting user owns the parent post before returning the comment.'Forbidden' when the requester does not own the parent post.'Not found' when the comment or its parent post does not exist.getComment('alice', 'cmt-1', comments, posts)// cmt-1 is on post-bob-1 which belongs to bob// → throws Error('Forbidden')
getComment('bob', 'cmt-1', comments, posts)// bob owns the parent post// → returns { id: 'cmt-1', postId: 'post-bob-1', ... }
'Forbidden' and 'Not found'.