skills.rest
Globussoft-Technologies
Globussoft-TechnologiesOFFICIAL
Explore all skills by this author →
Website𝕏@globussoftGitHub

medcore-bola-sweep

Sweep Express route handlers for BOLA/IDOR and patch with assertPatientOwnsResource.

2|3|Updated Apr 13, 2026
Search Tags:#authorization#integration testing#prisma#express#idor#bola#owasp api1
One-click install
npx skills add https://github.com/Globussoft-Technologies/medcore --skill medcore-bola-sweep
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: medcore-bola-sweep
Source: https://github.com/Globussoft-Technologies/medcore/tree/main/.claude/skills/medcore-bola-sweep
Command: npx skills add https://github.com/Globussoft-Technologies/medcore --skill medcore-bola-sweep

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

It reduces the risk of cross-patient data exposure (BOLA/IDOR) in MedCore’s API by auditing patient-reachable Express route handlers and ensuring each row access is correctly authorized.

Core Features & Use Cases

  • Route file BOLA sweep: Scans a single apps/api/src/routes/ route file for /:id-style handlers and determines whether PATIENT callers can access resources they do not own.
  • Patch or document outcomes: Applies assertPatientOwnsResource (with the correct parent/ownership argument shape) to patch real gaps, or adds an inline verified-safe / staff-only rationale.
  • Per-route integration tests: Creates isolated apps/api/src/test/integration/cross-patient-<route>.test.ts coverage for PATCHED handlers to prevent regressions, without racing on shared test files.
  • Batch-safe workflow support: Works as a paired step with /medcore-fanout to close Issue #511’s long tail efficiently and safely.

Quick Start

Audit and patch a candidate route file by invoking this skill on apps/api/src/routes/<x>.ts, letting it scan PATIENT-reachable /:id handlers, apply assertPatientOwnsResource where needed, and generate a matching cross-patient-<route>.test.ts file.

Frequently Asked Questions about medcore-bola-sweep

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I fix BOLA and IDOR vulnerabilities in Express API route handlers?▼

Preventing cross-patient data exposure involves auditing Express route handlers with `/:id` parameters to identify IDOR risks and enforcing per-row ownership via `assertPatientOwnsResource` checks.

How do I add integration tests for patched BOLA vulnerabilities in Express?▼

Add integration tests for patched BOLA vulnerabilities by creating isolated `cross-patient-<route>.test.ts` files that validate patient separation and prevent regressions without racing on shared test files.

What is a BOLA sweep for patient-scoped API routes?▼

A BOLA sweep scans Express route files to determine whether PATIENT callers can access unowned resources through `/:id` parameters, applying ownership checks to patch gaps or documenting staff-only rationales.

Does Prisma require per-row authorization checks to prevent IDOR in patient APIs?▼

Yes, Prisma queries in patient-scoped routes require per-row authorization checks like `assertPatientOwnsResource` to prevent IDOR, as router-level gating alone does not guarantee row-level ownership.

How do I remediate OWASP API1 broken object level authorization in a healthcare API?▼

Remediate OWASP API1 broken object level authorization by sweeping Express route files for patient-scoped queries, verifying gating strategies, and applying `assertPatientOwnsResource` to enforce strict row-level ownership.

What are the limitations of router-level authorization for preventing BOLA?▼

Router-level authorization limitations include failing to enforce per-row ownership, meaning PATIENT callers can still access unowned resources via `/:id` params unless per-handler `assertPatientOwnsResource` checks are applied.

Related Skills

Explore More Legal & Compliance Skills→
OreStudioOreStudio
25

ores-http-recipes

Compare API route definitions against HTTP recipe documentation to detect mismatches.

Official
Intermediate
cslsoftwarescslsoftwares

quality-regression-guard

Capture baseline module behavior and compare test results to detect regressions.

Community
Advanced
Globussoft-TechnologiesGlobussoft-Technologies
2

medcore-fanout

Dispatch concurrent foreground Agent calls across non-overlapping file lanes in the MedCore monorepo.

Official
Advanced
ollieb89ollieb89

auth-implementation-patterns

Implement JWT, OAuth2, and RBAC authentication across APIs and web apps.

Community
Advanced