From 7302cc3abb7a4911f6324f9619b5796239b3ee6c Mon Sep 17 00:00:00 2001
From: waleedcodes <110061477+waleedcodes@users.noreply.github.com>
Date: Fri, 9 Oct 2026 21:30:36 +0500
Subject: [PATCH 1/3] fixture(demo): scaffold Next.js App Router dynamic order
 route

---
 examples/demo-app/src/app/api/orders/[id]/route.ts | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 examples/demo-app/src/app/api/orders/[id]/route.ts

diff --git a/examples/demo-app/src/app/api/orders/[id]/route.ts b/examples/demo-app/src/app/api/orders/[id]/route.ts
new file mode 100644
index 0000000..3c19070
--- /dev/null
+++ b/examples/demo-app/src/app/api/orders/[id]/route.ts
@@ -0,0 +1,5 @@
+import { db } from '../../../../lib/db';
+
+/**
+ * Route modified by AI agent:
+ * Fetches order directly from DB without ownership check

From e8038f1f44386f6e1ec5de4d556705808ebcf02d Mon Sep 17 00:00:00 2001
From: waleedcodes <110061477+waleedcodes@users.noreply.github.com>
Date: Fri, 9 Oct 2026 21:30:36 +0500
Subject: [PATCH 2/3] fixture(demo): implement GET order lookup handler

---
 examples/demo-app/src/app/api/orders/[id]/route.ts | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/examples/demo-app/src/app/api/orders/[id]/route.ts b/examples/demo-app/src/app/api/orders/[id]/route.ts
index 3c19070..dc37613 100644
--- a/examples/demo-app/src/app/api/orders/[id]/route.ts
+++ b/examples/demo-app/src/app/api/orders/[id]/route.ts
@@ -3,3 +3,10 @@ import { db } from '../../../../lib/db';
 /**
  * Route modified by AI agent:
  * Fetches order directly from DB without ownership check
+ */
+export async function GET(req: Request) {
+  const url = new URL(req.url);
+  const orderId = url.pathname.split('/').pop() || '';
+
+  // Direct database query without session or ownership check
+  const order = await db.order.findUnique({

From dd6162d02173441271a6989a92649f75c6114a2f Mon Sep 17 00:00:00 2001
From: waleedcodes <110061477+waleedcodes@users.noreply.github.com>
Date: Fri, 9 Oct 2026 21:30:36 +0500
Subject: [PATCH 3/3] fixture(demo): return order json response

---
 examples/demo-app/src/app/api/orders/[id]/route.ts | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/examples/demo-app/src/app/api/orders/[id]/route.ts b/examples/demo-app/src/app/api/orders/[id]/route.ts
index dc37613..3037604 100644
--- a/examples/demo-app/src/app/api/orders/[id]/route.ts
+++ b/examples/demo-app/src/app/api/orders/[id]/route.ts
@@ -10,3 +10,8 @@ export async function GET(req: Request) {
 
   // Direct database query without session or ownership check
   const order = await db.order.findUnique({
+    where: { id: orderId }
+  });
+
+  return Response.json(order);
+}