"""Synthetic authorization-review fixture. Standard library only; no network calls."""
import unittest

INVOICES = {"inv-1": {"id": "inv-1", "owner_id": "alice", "amount": 50}}


def get_invoice(user_id, invoice_id):
    """Flawed example: accepts an authenticated user but never checks ownership."""
    return INVOICES[invoice_id]


def get_invoice_scoped(user_id, invoice_id):
    invoice = INVOICES.get(invoice_id)
    if invoice is None or invoice["owner_id"] != user_id:
        raise LookupError("Invoice not found")
    return invoice


class AuthorizationReview(unittest.TestCase):
    def test_original_exposes_another_users_invoice(self):
        self.assertEqual(get_invoice("bob", "inv-1")["owner_id"], "alice")

    def test_owner_can_read(self):
        self.assertEqual(get_invoice_scoped("alice", "inv-1")["amount"], 50)

    def test_other_user_and_unknown_invoice_are_rejected(self):
        for user, invoice_id in [("bob", "inv-1"), ("alice", "missing")]:
            with self.assertRaisesRegex(LookupError, "Invoice not found"):
                get_invoice_scoped(user, invoice_id)


if __name__ == "__main__":
    unittest.main()