Add object-level authorisation

Not solved

Any signed-in customer can read any invoice by changing the ID. Enforce ownership without locking out admins.

invoices.js

Test results

Run the tests to check your code. It runs on the server in an isolated sandbox with no network access.