Locked At The Door

A document app has this route pair. locals.user is populated by an auth hook on every request.

// src/routes/documents/[id]/+page.server.ts
export const load = async ({ params, locals }) => {
  const doc = await db.query.documents.findFirst({
    where: eq(documents.id, params.id)
  })
  if (!doc) error(404, 'not found')
  if (doc.ownerId !== locals.user.id) error(403, 'forbidden')
  return { doc }
}

// src/routes/api/documents/[id]/+server.ts
export const PATCH = async ({ params, request, locals }) => {
  if (!locals.user) error(401, 'unauthenticated')
  const body = await request.json()
  await db.update(documents)
    .set({ title: body.title })
    .where(eq(documents.id, params.id))
  return json({ ok: true })
}

A signed-in user who does not own d_91 opens a terminal. Which request succeeds?

Neither. The eq(documents.id, params.id) predicate scopes the update to one row, so a non-owner can only ever rewrite a title they already own.

PATCH /api/documents/d_91 with {"title":"owned"}, because the ownership test lives only in the page load and the endpoint is a separately addressable route that never repeats it.

Neither. The framework runs the page load for a route before any endpoint under it, so the 403 fires first.

GET /documents/d_91, because load fetches the row before comparing owners, so the document is already in the serialized payload by the time the check runs.