Question

An AI agent added this Express route to let a logged-in user fetch one of their invoices. Authentication middleware already runs upstream and sets `req.user.id`. The code passes the team's tests (which only check the owner's own invoice). What's the defect, and how should review have caught it?

1app.get("/api/invoices/:id", requireAuth, async (req, res) => {2  const invoice = await db.invoice.findUnique({3    where: { id: req.params.id },4  });5  if (!invoice) return res.status(404).json({ error: "not found" });6  res.json(invoice);7});