From 163b7efcaaf7e784ebbf5a7576b22c7d9175f6e5 Mon Sep 17 00:00:00 2001
From: Fent Jani <37303771+bpstr@users.noreply.github.com>
Date: Wed, 16 Sep 2026 00:04:55 +0200
Subject: [PATCH] Add missing-enforcement competency fixture

---
 .../competency/missing-server-enforcement/SCENARIO.md        | 5 +++++
 tests/fixtures/competency/missing-server-enforcement/api.py  | 3 +++
 tests/fixtures/competency/missing-server-enforcement/web.ts  | 1 +
 3 files changed, 9 insertions(+)
 create mode 100644 tests/fixtures/competency/missing-server-enforcement/SCENARIO.md
 create mode 100644 tests/fixtures/competency/missing-server-enforcement/api.py
 create mode 100644 tests/fixtures/competency/missing-server-enforcement/web.ts

diff --git a/tests/fixtures/competency/missing-server-enforcement/SCENARIO.md b/tests/fixtures/competency/missing-server-enforcement/SCENARIO.md
new file mode 100644
index 0000000..db0c06f
--- /dev/null
+++ b/tests/fixtures/competency/missing-server-enforcement/SCENARIO.md
@@ -0,0 +1,5 @@
+# Missing server enforcement
+
+Question: Is project deletion protected by admin authorization?
+
+Expected: report frontend gating separately from server enforcement and record the absent server-side check as a gap. Never infer backend authorization from UI behavior.
diff --git a/tests/fixtures/competency/missing-server-enforcement/api.py b/tests/fixtures/competency/missing-server-enforcement/api.py
new file mode 100644
index 0000000..3518051
--- /dev/null
+++ b/tests/fixtures/competency/missing-server-enforcement/api.py
@@ -0,0 +1,3 @@
+def delete_project(request, project_id):
+    # Intentionally missing authorization check.
+    return request.db.delete_project(project_id)
diff --git a/tests/fixtures/competency/missing-server-enforcement/web.ts b/tests/fixtures/competency/missing-server-enforcement/web.ts
new file mode 100644
index 0000000..84427f7
--- /dev/null
+++ b/tests/fixtures/competency/missing-server-enforcement/web.ts
@@ -0,0 +1 @@
+export function canDelete(user: { role: string }) { return user.role === 'admin'; }