בדיקת אבטחה בעזרת AI: להוכיח הרשאות בתרגיל מקומי

Read this tutorial as reference material:
https://nethanelfitoussi.com/article/ai-security-code-review?lang=en

Goal: apply the documented workflow to my development project.
Read the existing project instructions, inspect the relevant files and explain the smallest useful setup.

Available starter files:
https://nethanelfitoussi.com/api/media/b10c304f-9e50-4c20-8185-b8190a92c5cd.zip
Download and inspect these files in a temporary folder before using them. Do not overwrite existing project instructions.

If I have not supplied a project folder, ask which development project to use. Do not invent a repository URL.

Additional project setup instructions:
Use the downloaded starter lab in a NEW folder. Read README.md and both English prompts first. Run its dependency-free Node.js tests before editing.

Act as a security reviewer for this LOCAL training project. Read lab.mjs and
lab.test.mjs before proposing changes. The actor must come from verified server
authentication. Map the invoice owner, tenant boundary and finance_admin exception.
Produce a table: claim, exact file/line, required attacker capability, affected
data, existing test and missing evidence. Separate confirmed findings from
hypotheses. Check same-tenant and cross-tenant cases, anonymous users and missing
fields. Do not assume that a hidden button or an unpredictable ID is authorization.
Do not contact a live service or change files yet.

Implement only the smallest agreed authorization correction in this local exercise.
Keep the same-tenant owner and finance administrator use cases working. Add a
negative regression case that would fail with the original faulty policy. Run node
--test lab.test.mjs and report the real result, remaining assumptions and diff. Do
not weaken an existing check to make a test pass. In an application, derive identity
and roles from verified server authentication and enforce the policy on every
relevant request. Stop before deployment.

Adapt example paths, commands and acceptance criteria to this repository rather than assuming they match.

Give me a short plan, then make the agreed local changes and run the relevant checks. Report actual results and anything not verified. Stop before credentials, paid services, production changes, push, merge or deployment.