security_spec.md

# Security Specification for ExamForge

## 1. Data Invariants
- A student profile cannot have the 'teacher' role without admin approval (if admin existed).
- An Exam can only be published/edited by its creator (teacherId).
- A Student can only see results of their own attempts.
- An Attempt must reference a valid Exam ID.
- Scores cannot be modified after submission.

## 2. The Dirty Dozen Payloads
1. **Identity Spoofing**: Attempt to create a student profile with `role: 'teacher'`.
2. **Identity Spoofing**: Attempt to read another student's profile settings.
3. **Privilege Escalation**: Attempt to update an exam created by another teacher.
4. **Data Poisoning**: Attempt to inject 1MB string into `examId`.
5. **State Shortcut**: Attempt to update an Attempt's status from 'completed' back to 'started'.
6. **Integrity Violation**: Attempt to update an Attempt's score directly from the client after completion.
7. **Bypassing Invariants**: Attempt to create an Attempt with a non-existent Exam ID.
8. **Shadow Field**: Attempt to update an Exam with a hidden `verified: true` field.
9. **Query Scraping**: Attempt to list all Exam records without a specific filter.
10. **Resource Exhaustion**: Attempt to create a document ID with 1000 characters.
11. **PII Leak**: Attempt to read user `pin` without ownership.
12. **Time Spoofing**: Attempt to set `createdAt` to a future date instead of server time.

## 3. Test Runner (Draft)
The test runner will ensure these payloads return `PERMISSION_DENIED`.