# AuthRace — Go API authorization and concurrency test harness

I built AuthRace to reproduce **broken object-level authorization (BOLA)** and concurrent duplicate-write paths without touching an external target. It spins up an ephemeral local `httptest` server, drives adversarial HTTP requests, and compares a deliberately vulnerable reference handler against a repaired implementation.

## Run

```sh
go test -race ./...
go vet ./...\n# Optional coverage-guided local parser fuzzing:\n# go test -fuzz=FuzzHardenedHTTPParser -fuzztime=30s .
go run ./cmd/auth-race
```

The local replay experiment submits 24 concurrent requests with a shared idempotency key. The vulnerable fixture applies all 24 writes; the fixed handler atomically records the logical operation and applies it once. Cross-tenant access is modeled separately and must be rejected by the hardened handler.

## Engineering decisions

- Authorization comes from a **synthetic verified-principal fixture**, not caller-controlled body tenant IDs. This harness does not claim to implement production JWT validation.
- Idempotency keys are bound to a principal and payload fingerprint. A reused ID with changed parameters causes an explicit conflict.
- Check-and-write share a mutex in the in-memory service to make the atomicity boundary visible. Real services require transactional storage, unique constraints, and an outbox/reconciliation strategy for external side effects.
- Invalid amounts, tenant scopes, missing principal and malformed requests are rejected before mutation.
- Tests execute both the exploit and the corresponding fix; a test that never demonstrates the vulnerable behavior is an incomplete regression harness.

## Limits

No outside hosts, credential collection, mass scanning, exploit deployment, or real payment APIs. This is a controlled local proof of failure modes. Distributed idempotency, crashes, consistency levels, rate limits, workload identity and real production tracing are not part of this reference.